falcoraxyz/mincode-vuln-arch

mincode-vuln-arch is a Python toolkit built to help write small, clean codebases, check them for security problems, and remember what it finds over time, without needing any third party libraries installed to run its core features. The goal stated in the project is to ship the least code needed for a task while keeping things modular and reviewed for safety. It bundles several tools together. One scaffolds a new minimal project structure with source, test, and documentation folders and automatically sets up version control. Another scans a project for security vulnerabilities, tagging findings with standard vulnerability classification codes, assigning a letter grade to the codebase, and optionally checking third party dependencies for known issues. A third tool can look at an existing repository, written by a person or generated by AI, and extract clean, reusable patterns from its structure. There is also a test generator that reads a function's type information and produces basic automated tests for it. A distinctive feature is what the project calls a hash chain vault: a local, tamper evident record of audit findings and notes, signed so that past entries cannot be silently altered without detection, with no data sent over a network. This can optionally integrate with Obsidian, a personal note taking app, to browse findings as linked notes. The toolkit is designed to be used in several different ways depending on preference: as a command line tool after cloning the repository, as a pip installable package, as a single self contained file that runs on any compatible Python version, as a server following the Model Context Protocol so AI coding assistants like Claude Desktop or Cursor can call it directly, or as a drop in skill for AI agent frameworks. An optional connection to a language model can add a deeper logic flaw review on top of the standard checks, and this step is simply skipped if no such connection is configured. The project is released under the Apache 2.0 license.