IAC Audit Pack

Audits infrastructure configurations (Dockerfiles, GitHub Actions, Kubernetes, Terraform/Compose) against 14 deterministic security rules, returning BLOCK/REVIEW/PASS verdicts and signing attestations. Helps agents verify deployment configs before applying them.

Enables MCP-compatible agents to audit an entire repository through one question, detecting stacks and running parallel checks for dead code, dependencies, security, CVEs, complexity, and lint across Laravel/PHP, Python, TypeScript/React, and Flutter/Dart. It returns normalized, severity-sorted findings with false positives flagged and secret values kept out of the output.

Provides deterministic, 100%-file-coverage security findings by running Semgrep, gitleaks, and osv-scanner on code repositories, enabling thorough security assessment of every file.

Exposes a Dockerfile auditing engine to AI assistants, letting them scan a Dockerfile for the 32 deterministic layer-aware rules, print a stage/layer map showing what each layer adds or deletes, explain any rule's rationale and fix, and list available rules. Findings include file:line evidence so agents can surface and triage image-safety issues directly in Claude Code, Cursor, or Cline.