Skip to content

HOW_TO_USE.md

Latest commit

 

History

History
53 lines (41 loc) · 3.94 KB

HOW_TO_USE.md

File metadata and controls

53 lines (41 loc) · 3.94 KB
Raw

CosmoGrepperAI: Complete Usage Guide

Welcome to CosmoGrepperAI! This guide will walk you through maximizing your rule coverage and efficiently utilizing the LLM intelligence layer to build unparalleled context-aware security scans.

1. Maximizing Your Scanning Rules

CosmoGrepperAI acts as an advanced GUI and decision engine layered directly on top of raw Semgrep processes. By default, it uses high-noise community rules, but you can explicitly dial this up to completely maximize its coverage footprint.

To maximize the rule engine coverage:

  • Open your CosmosGrepperAI Dashboard.
  • Under the Active Ruleset dropdown, select p/default (All Community Rules - High Noise).
  • What this does: The p/default profile aggressively instructs the Semgrep engine to download and fire theoretically thousands of discrete rule combinations sourced from the global registry across all languages. This explicitly ignores efficiency in favor of catching absolutely everything (hence the "High Noise").
  • Targeted Maximizing: If you are auditing a highly specific language, selecting p/javascript or p/python guarantees the engine applies all aggressive specific checks dedicated to that technology stack.

2. Using the LLM Intelligence Layer Properly

Maximizing rules in step one generates massive amounts of False Positives. This is exactly where the LLM integration saves you incredible amounts of time.

Local Execution (Zero-Cost, High Privacy)

  1. Download Ollama or LM Studio.
  2. Pull a coding-optimized LLM (ollama run llama3 or mistral).
  3. In CosmoGrepperAI, select Ollama from the Provider dropdown.
  4. Leave the API Key entirely blank (this defaults to localhost port 11434).
  5. Click 🔌 Test to dynamically fetch your models and verify the hook.
  6. The UI will dynamically scan every single medium, high, and critical alert generated by the system and mathematically compute if they are actually a threat!

Auto-Mitigation Injection

Once the AI determines a finding is severely vulnerable, CosmoGrepperAI dynamically parses the AI's data stream to isolate contextually aware code mitigations.

  • You do not need to prompt the AI manually.
  • Click any active row on the Dashboard.
  • The UI drops down to reveal the AI Mitigation Strategy alongside your raw evidence snippet. This will directly instruct you step-by-step on how to inject remediation strings into your specific file path to remove the vulnerability!

3. Open Source Dependency Scanning (SCA)

CosmoGrepperAI integrates directly with Sonatype OSS Index to audit your supply chain for known vulnerabilities in third-party packages.

Getting Started

  1. Launch the Engine: Open your terminal and run python app.py. On macOS, ensure you have run brew install semgrep beforehand.
  2. Access the Dashboard: Navigate to http://127.0.0.1:8000 in any modern browser.
  3. Select Your Target: Use the 📁 Browse button to select a local source code directory.
    • Windows: Launches a system folder picker.
    • macOS: Launches an AppleScript dialog. You may need to grant "Terminal" permission to control "System Events" on first run.
    • package.json (Node.js/NPM)
    • requirements.txt (Python/PyPi)
  4. Authentication (Highly Recommended):
    • Unauthenticated requests are limited to 64 per hour.
    • For large projects, obtain a free token at OSS Index.
    • Enter your credentials in the dashboard as username:token.

Interpreting SCA Results

Findings from the OSS Index appear with an [SCA] prefix.

  • Transitive Dependencies: If a vulnerability is found in a sub-dependency, CosmoGrepperAI provides specific override instructions (e.g., using resolutions in NPM or dependencyManagement in Maven) to force a secure version without breaking your build.
  • Remediation: Every SCA finding includes the specific version update required to resolve the CVE.