wisent-ai/codespy
Fast, offline code security scanner. Zero dependencies. Finds secrets, injection vulnerabilities, misconfigurations, and code quality issues across 13+ languages.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan (relative to workspace root) | no | . |
| severity | Minimum severity to report: info, low, medium, high, critical | no | low |
| format | Output format: terminal, json, sarif, markdown | no | sarif |
| output-file | File path for output (when using json/sarif/markdown format) | no | codespy-results.sarif |
| fail-on-findings | Fail the action if findings at or above this severity are found. Set to "none" to never fail. | no | high |
| show-fixes | Include fix suggestions in output | no | true |
| upload-sarif | Automatically upload SARIF results to GitHub Code Scanning (requires sarif format) | no | true |
| python-version | Python version to use | no | 3.12 |
Outputs
| name | description |
|---|---|
| total-findings | Total number of findings |
| critical-count | Number of critical findings |
| high-count | Number of high findings |
| medium-count | Number of medium findings |
| low-count | Number of low findings |
| security-score | Security score (0-100) |
| security-grade | Security grade (A+ to F) |
| sarif-file | Path to SARIF output file (if generated) |