Skip to content

Back to the catalog

OASIS
github.comrepo

OASIS

OASIS (Open Automated Security Intelligence Scanner) is an AI-powered SAST tool that runs local LLMs via Ollama or any OpenAI-compatible backend (vLLM, LiteLLM, LM Studio, llama.cpp) to detect vulnerabilities like SQLi and XSS in source code. It uses a two-phase scan (lightweight scan model + deep analysis model) orchestrated by a LangGraph pipeline (discover→scan→expand→deep→verify→report), adds a deterministic finding-validation agent that computes exploitability verdicts with confidence, and exports canonical JSON/SARIF/HTML/PDF reports with a web dashboard, RAG-backed chat assistant, --fail-on CI gating, and suppression/inline-ignore support.

TL;DR Local-LLM-powered SAST scanner (OASIS) with LangGraph orchestration, deterministic exploitability validation, SARIF export, and CI gating.
Open original ↗
Document

What it is

OASIS is a self-hosted AppSec scanner that runs LLM-driven static analysis entirely against local model backends. The existing summary frames it as an Ollama tool, but the page is explicit that it targets any OpenAI-compatible server — vLLM, LiteLLM, LM Studio, llama.cpp server, LocalAI — via --provider openai --api-base URL, not just Ollama. That is the main thing the summary understates.

How it works

The pipeline is a single LangGraph graph: discover → scan → expand → deep → verify → report, with an optional PoC-assist step and bounded context-expand retries. Lightweight models handle the initial scan; heavier models do deep analysis. The finding-validation agent is deterministic and code-driven (entry points, call chains, taint flows, on-path mitigations) and embeds an exploitability verdict + confidence in every report; the dashboard's LLM narrative re-validation (POST /api/assistant/investigate) is constrained to stay consistent with that deterministic result.

Preconditions / Affected

This is a resource-heavy tool — worth checking before you commit:

  • Python 3.9+
  • Ollama running (or another OpenAI-compatible backend), with models pulled beforehand
  • CPU: 4+ cores; RAM: 16 GB minimum, 32 GB recommended; Storage: 100 GB+ for models plus caching

What to do

Recommended install via pipx from source:

git clone https://github.com/psyray/oasis.git
cd oasis
pipx install -e .
oasis --input test_files/

Reports land under security_reports/ beside the analyzed path.

Docker, with Ollama on the host:

docker compose build
docker compose run --rm oasis -i /work/test_files -ol http://host.docker.internal:11434

Code is mounted at /work; all -i paths must be under /work.

Update handling (only stable GitHub releases; pre-releases are ignored):

oasis --check-update
oasis --self-update

Set OASIS_NO_UPDATE_CHECK=1 to suppress the stderr update line; OASIS_DEBUG_UPDATE=1 for update diagnostics.

Useful flags: --project-name/-pn for per-project report layout and dashboard filtering; --web-ollama-url, --web-embed-model, --web-assistant-rag to point the dashboard assistant at a specific backend/embedding cache.

Caveats

Feature branches (feat/vX.X) are called out as possibly unstable. For editable installs, pipx upgrade oasis after git pull is optional and only needed to align pixp's recorded version. The dashboard assistant's RAG over the local embedding cache is optional, not on by default.

Technologies named here

Techniques named here

  • Two-Phase Scanning
  • LangGraph pipeline orchestration
  • Deterministic finding validation
  • Embedding-based distribution/audit mode
  • Content chunking
  • Consolidated multi-model reporting
  • RAG
  • Scan diff

Related in AI Security