CodeProof-AI

Overview

CodeProof AI is a local-first Python CLI and reusable GitHub Action for verifying Python repositories. It runs deterministic checks, normalizes evidence, calculates a transparent confidence score, and exports JSON, Markdown and HTML reports. It does not claim that code is correct — it reports whether configured checks passed.

Features

• Checkers: ruff, mypy, pytest, Bandit, Semgrep, import-smoke
• Weighted policy and required-tool gates
• AST test-gap inventory plus reviewable smoke-test generation
• CI-friendly exit codes
• GitHub composite Action
• Optional pip-audit dependency scanning (opt-in)
• Modern local developer workspace (`codeproof serve`)

Install

python -m venv .venv
pip install -e ".[checkers]"
codeproof scan .

Commands

codeproof tools          # supported checks and behavior
codeproof doctor         # availability and install guidance
codeproof init           # write a default policy
codeproof inventory .    # public symbols, not coverage
codeproof scan . --checks ruff,pytest,syntax --jobs 3

Policy

Partial policies overlay the six default checks; disabled checks don't appear. Required tools cannot be bypassed. A syntax-only scan sets required_tools: [] with only syntax enabled.

required_tools: []
source_paths: [src]
checks:
  syntax: {enabled: true, weight: 10}

Confidence model

The score is the weighted percentage of included checks that pass. Missing required tools fail policy; optional missing tools are marked unavailable and excluded from the denominator.

Developer workspace

codeproof serve .

Run scans from a responsive browser workspace with presets, durable history, searchable findings, comparison and policy inspection.

Security

pytest and import checks execute repository code. Scan untrusted repositories only in an isolated container or ephemeral runner.