alejandrosaenz117/Guppy Security Scanner

Admiral Ackbar-inspired security analysis for GitHub PRs

Trust Signals

name	description	required	default
api_key	LLM API key (OpenAI, Anthropic, or Google). Prefer setting LLM_API_KEY as an environment variable instead.	no	—
provider	LLM provider: anthropic, openai, or google	no	anthropic
model	Model name (e.g., claude-3-5-sonnet-20241022, gpt-4, gemini-2.0-flash)	no	claude-3-5-sonnet-20241022
skeptic_pass	Run a second skeptic pass to filter false positives (disable for single-pass mode)	no	true
post_comments	Post findings as inline PR comments	no	true
fail_on_severity	Fail the build if findings meet this severity (critical\|high\|medium\|low\|none)	no	high
comment_severity_threshold	Minimum severity for posting PR comments (critical\|high\|medium\|low\|none)	no	high
github_token	GitHub token for PR interactions. Prefer setting GITHUB_TOKEN as an environment variable instead.	no	—
upload_sarif	Upload findings as SARIF to GitHub Advanced Security (requires security-events: write)	no	false
sca_enabled	Enable SCA dependency scanning via lockfile diff analysis	no	true
sca_scanner	Scanner to use for SCA (osv)	no	osv
sca_reachability	Enable LLM reachability analysis for SCA findings	no	true
sca_reachability_threshold	Minimum CVE severity for call-site (Phase 2) reachability analysis (critical\|high\|medium\|low\|none)	no	high
sca_reachability_confidence_threshold	Minimum reachability confidence score (1-3) for a finding to be considered blocking	no	2

name	description
findings_count	Total number of vulnerabilities found
blocking_count	Number of blocking-level vulnerabilities
sca_findings_count	Total number of SCA vulnerabilities found
sca_blocking_count	Number of blocking-level SCA vulnerabilities