AI Provider Configuration
Relevant source files
The following files were used as context for generating this wiki page:
The AI Provider Configuration system is a core component of the Enhanced Security Scanner v2.0, designed to facilitate AI-enhanced validation and multi-phase security analysis. Its primary purpose is to orchestrate communication between the scanning engine and various Large Language Model (LLM) providers to reduce false positive rates to below 5% through intelligent context analysis and intent verification.
This system manages the settings for multiple AI integrations, including OpenAI, Anthropic, and AWS Q Developer. It enables the scanner to perform complex tasks such as comparing developer comments against implementations, detecting business logic vulnerabilities, and executing multi-scan iterations to account for LLM non-determinism.
Sources: README.md:1-25, README.md:120-135
AI Architecture and Multi-Phase Strategy
The AI configuration is deeply integrated into the "3-Phase Scanning Strategy." While Phase 1 relies on traditional SAST tools like Semgrep and CodeQL, the configuration of AI providers directly impacts Phase 2 (AI-Enhanced Analysis) and Phase 3 (Targeted Deep Dives).
The following diagram illustrates how the AI configuration fits into the overall scanning lifecycle:
The multi-phase approach ensures that AI resources are used efficiently by filtering high-noise data through traditional tools before applying LLM-based validation.
Sources: README.md:28-45, README.md:70-95
Provider Configuration Elements
The scanner supports several configuration properties to define how it interacts with AI services. These are typically managed within the .securityrc.json file or the default configuration.
Core AI Settings
The aiAnalysis block in the configuration defines the primary provider and model details.
| Property | Type | Description | Default/Example |
|---|---|---|---|
enabled | Boolean | Activates Phase 2 AI-enhanced validation. | true |
provider | String | The LLM service provider (OpenAI, Anthropic, AWS). | "openai" |
model | String | The specific model version to utilize. | "gpt-4" |
apiKey | String | Environment variable reference for the service API key. | "${OPENAI_API_KEY}" |
iterations | Integer | Number of scan iterations to handle non-determinism. | 3 |
Sources: README.md:144-160, configs/default.json:1-15
Implementation Example
The configuration is structured to allow granular control over different analysis modules:
{
"phases": {
"aiEnhanced": {
"enabled": true,
"iterations": 3,
"aiProvider": "openai",
"customRules": true
},
"deepDive": {
"enabled": true,
"intentAnalysis": true
}
},
"aiAnalysis": {
"enabled": true,
"provider": "openai",
"model": "gpt-4",
"apiKey": "${OPENAI_API_KEY}"
}
}
Sources: README.md:125-165
AI Validation Logic and Prompts
The system utilizes structured prompts to interact with configured AI providers. This interaction is orchestrated by the MultiScanOrchestrator and SARIFProcessor.
Sequence of AI Validation
The following sequence diagram shows the interaction between the core scanner and the AI provider during the validation phase:
The AI provider evaluates the finding's exploitability (on a 0-1 scale) and potential impact, providing specific remediation steps in JSON format.
Sources: README.md:200-220, src/index.ts:1-12
Detection Layers
The AI configuration enables specific detection capabilities that traditional SAST cannot easily perform:
- Intent Analysis: Identifying mismatches between developer TODOs/comments and actual logic (e.g., an authentication function that always returns
true). - Business Logic Detection: Analyzing complex flows across multiple files.
- False Positive Reduction: Filtering out framework-specific security controls or known safe patterns.
Sources: README.md:47-65, README.md:222-230
Environment and Runtime Requirements
To use the configured AI providers, the system requires a Node.js 18+ environment and specific secrets.
- Runtime: Node.js >=18.0.0 is required as defined in
package.jsonandQUICK_START.md. - Credentials: API keys must be provided via environment variables (e.g.,
OPENAI_API_KEY). - Tools: Integration with AI requires the
MultiScanOrchestratorandSARIFProcessorexported from the core engine.
Sources: package.json:28-30, QUICK_START.md:25-30, src/index.ts:7-10
The AI Provider Configuration is fundamental to achieving the project's goal of high-accuracy security scanning. By combining multi-iteration LLM analysis with traditional SAST, the system effectively bridges the gap between high-noise automated tools and manual security reviews.