Druk

Druk is an agentic software supply chain and application security engine.

Most modern security tools generate a high volume of alerts for vulnerable dependencies. However, they rarely verify if the vulnerable function is actually called by the application code. This leads to alert fatigue and false positives.

Druk addresses this by combining SBOM generation, CVE enrichment, SAST, Secrets detection, and OpenSSF Supply Chain scoring with Code Property Graph reachability analysis. It filters out dormant vulnerabilities and uses a lightweight LLM agent system to synthesize a human-readable threat model and answer questions about the security posture of the application.

Key Features

1. Reachability Analysis: Druk uses high-speed, language-native tooling (like govulncheck and native Python AST regex parsing coupled with Transitive Dependency Graph resolution) to trace findings down to your actual imports. A critical advisory that is never imported or called gets demoted. An advisory reachable from your active codebase gets flagged as a priority.
2. Bounded Remediation Loop: Once deterministic scans are complete, an AI Remediation Agent natively proposes fixes, tests, and config changes. An independent Checker Agent (using a different LLM provider) then verifies the fix for safety.
3. Attack Path Correlation: The Finder natively determines the most plausible attacker path and correlates independent SAST, Secrets, and SCA findings into unified Attack Chains.
4. Offline Capable: By setting DRUK_LLM_PROVIDER=ollama, the entire AI pipeline runs locally on your machine without sending code telemetry to external APIs.
5. CI/CD Native: Running druk ci --fail-on reachable-critical executes headlessly and returns a non-zero exit code to block a pull request only if a vulnerable dependency is actually reachable by an attacker.
6. Interactive TUI: Druk features a real-time Bubble Tea terminal user interface to visualize the scan phases as they occur.

Architecture

Druk is designed around a deterministic core wrapped in an agentic shell. This ensures that findings are verifiable and not hallucinated by the LLM.

       ┌────────────────────────┐
       │   User / CI Pipeline   │
       └───────────┬────────────┘
                   │  druk analyze
                   ▼
       ┌────────────────────────┐
       │      Planner Agent     │ (Determines scan depth & tools)
       └───────────┬────────────┘
                   │
  ┌────────────────▼──────────────────────────────────────────────┐
  │               DETERMINISTIC CORE PIPELINE                     │
  │                                                               │
  │  ┌──────────────┐   ┌──────────────┐   ┌──────────────┐       │
  │  │  Syft SBOM   │   │ Semgrep SAST │   │   Gitleaks   │       │
  │  └──────┬───────┘   └──────┬───────┘   └──────┬───────┘       │
  │         │                  │                  │               │
  │  ┌──────▼────────────┐     │                  │               │
  │  │ OSV.dev Discovery │     │                  │               │
  │  │ (Bulk querybatch) │     │                  │               │
  │  └──────┬────────────┘     │                  │               │
  │         │                  │                  │               │
  │  ┌──────▼────────────┐     │                  │               │
  │  │ OSV.dev Enrichment│     │                  │               │
  │  │ (CVSS Extraction) │     │                  │               │
  │  └──────┬────────────┘     │                  │               │
  │         │                  │                  │               │
  │         └────────┬─────────┘                  │               │
  │                  ▼                            │               │
  │           ┌─────────────┐                     │               │
  │           │ Native Go/  │ (Language Native    │               │
  │           │ Python AST  │  Reachability)      │               │
  │           └──────┬──────┘                     │               │
  │                  │                            │               │
  │           ┌──────▼──────┐                     │               │
  │           │ Reachability│ (Validates call     │               │
  │           │  Analysis   │  paths to CVEs)     │               │
  │           └──────┬──────┘                     │               │
  │                  │                            │               │
  │           ┌──────▼──────┐                     │               │
  │           │  Severity   │ (Demotes dormant    │               │
  │           │ Re-Ranking  │  vulnerabilities)   │               │
  │           └──────┬──────┘                     │               │
  │                  │                            │               │
  └──────────────────┼────────────────────────────┼───────────────┘
                     │                            │
             ┌───────▼────────────────────────────▼───────┐
             │            CANONICAL JSON REPORT           │
             └───────┬────────────────────────────┬───────┘
                     │                            │
  ┌──────────────────▼────────────┐ ┌─────────────▼───────────────────┐
  │        AGENTIC AI SHELL       │ │         OUTPUT LAYER            │
  │                               │ │                                 │
  │ ┌───────────────────────────┐ │ │  ┌───────────────────────────┐  │
  │ │    Finder & Correlator    │ │ │  │  JSON / SARIF Exporters   │  │
  │ │(Maps Attack Paths & Chains)│ │ │  │ (For GitHub Adv Security) │  │
  │ └─────────────┬─────────────┘ │ │  └───────────────────────────┘  │
  │               ▼               │ │                                 │
  │ ┌───────────────────────────┐ │ │  ┌───────────────────────────┐  │
  │ │    Checker (Validation)   │ │ │  │     Bubble Tea TUI        │  │
  │ └─────────────┬─────────────┘ │ │  │ (Live interactive report  │  │
  │               ▼               │ │  │  with 7-pane dashboard)   │  │
  │ ┌───────────────────────────┐ │ │  └───────────────────────────┘  │
  │ │   Remediation & Verifier  │ │ │                                 │
  │ │ (Proposes & Verifies Fixes)│ │ │  ┌───────────────────────────┐  │
  │ └─────────────┬─────────────┘ │ │  │       HTML Dashboard      │  │
  │               ▼               │ │  │   (Exportable Web View)   │  │
  │ ┌───────────────────────────┐ │ │  └───────────────────────────┘  │
  │ │     Synthesizer & Q&A     │-┼─┼─►                               │
  │ └───────────────────────────┘ │ │                                 │
  └───────────────────────────────┘ └─────────────────────────────────┘

Druk implements a highly disciplined Bounded Agentic Loop:

1. The Planner Agent: Analyzes the repository metadata and determines scan depths.
2. The Finder & Correlator Agents: Instead of just summarizing, they map the most plausible attacker path and correlate independent SAST/Secrets/SCA findings into combined Attack Chains.
3. The Checker Agent: An adversarial LLM (DeepSeek/Groq) that independently verifies the Finder's contextual risk assessment.
4. The Remediation Loop: The Remediation Agent proposes structured JSON fixes (including regression risks and test coverage), which are then verified by the Remediation Checker for safety.
5. The Synthesizer & Q&A Agent: A grounded tool-calling loop that executes local Go functions to read the report rather than guessing, enforcing a strict token budget to prevent runaway loops.

Supported LLM Providers

Druk uses a multi-provider architecture to enforce adversarial separation of concerns:

• OpenAI: Used for general synthesis, correlation, and remediation proposal (gpt-4o-mini).
• DeepSeek: (Default) Used as the adversarial checker to verify findings and remediation plans.
• Groq & Ollama: Fully supported for lightning-fast inference or 100% air-gapped local execution.

Installation

# Clone the repository
git clone https://github.com/Samk1710/druk.git
cd druk

# Build the binary
go build -o druk main.go
sudo mv druk /usr/local/bin/

# Check dependencies
druk setup

Requirements: Druk relies on standard scanners under the hood. You should have syft and semgrep installed in your path. The druk setup command will provide installation instructions if they are missing.

Usage

1. The Interactive TUI

To scan a local repository using the terminal UI:

druk analyze . 

To run all scanners and let the AI Synthesizer summarize the findings (requires DRUK_GROQ_API_KEY):

druk analyze --all --narrate .

To let the Planner Agent automatically determine which scanners to run based on repository size:

druk analyze --auto .

2. CI/CD Mode (Headless)

To run Druk in a CI pipeline and fail the build if reachable vulnerabilities are found:

druk ci --fail-on reachable-critical .

3. Data Exports

Export the final report to JSON or SARIF (for GitHub Advanced Security):

druk analyze --output sarif > results.sarif

License

MIT License.