Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings
Use this GitHub action with your project
Add this Action to an existing workflow or create a new one
View on Marketplace
Open more actions menu

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

42 Commits
42 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Audison

Two AIs argue. One verdict.

PyPI Python 3.9+ License


Real numbers, not benchmarks. Audison audited httpx v0.28.1 (14,000+ Stars) across 10 security-critical functions using EmpiricalVerifier (AST static analysis — a utility distinct from Audison's multi-model adversarial audit).

CONFIRMED REFUTED False Positive
4 4

¹ _get_client_nonce was an AST false positive (indirect variable assignment untraceable), excluded after manual review. One UNCERTAIN excluded: _build_auth_header same-name ambiguity, a tool limitation, not code uncertainty. Full report →

pip install audison && audison scan .
Example output: scanning Audison itself → 0 CONFIRMED, 43 REFUTED [full output →](docs/terminal_output.txt)
 Audison Scan — 维度4 数据完整性实证验证
 扫描目录  D:\HANAKO\audison
 发现文件  104 个源文件 / 审查函数  83 个
 CONFIRMED     0  (真阳性)
 REFUTED      43  (假阳性)
 UNCERTAIN    40  (需人工复核)

The Problem

A single model can't discover its own blind spots. Same training data, same biases — one person grading their own homework. Audison makes two models argue: one audits, another attacks from 5 adversary perspectives, a third cross-validates. Consensus comes from surviving attack, not from agreeing to agree.


What Audison Catches That Others Miss

Same AI-generated auth code, four reviewers:

Finding Standard AI Review CodeQL Shannon Audison
SQL injection in login Missed Missed Missed Found
Hardcoded JWT secret Warning Missed Missed Found
Missing rate limiting Missed Missed Missed Found
CSRF token bypass Missed Missed Missed Found

How It Works

Input Code
    │
    ▼
[ Brain One ]  ──── Primary audit (security, correctness, logic)
  (GPT-4o)
    │
    ▼
[ Opponent Brain ] ──── 5 adversarial perspectives attack findings
  (Claude Sonnet)
    │
    ▼
[ Brain Two ]  ──── Cross-verification: consensus → confirmed,
                     disagreement → UNCERTAIN (not hidden)
    │
    ▼
[ TrustReport ]  ──── Verdict + Confidence + Findings + SHA-256 chain

Quick Start

pip install audison
audison scan .              # EmpiricalVerifier: AST static analysis
audison audit .             # Full multi-model adversarial audit

# Set API keys (two providers recommended for cross-arbitration):
export OPENAI_API_KEY="sk-..."
export ANTHROPIC_API_KEY="sk-ant-..."

Comparison

Feature Audison Standard AI Review CodeQL Shannon
Open Source Yes Yes No
Multi-model Arbitration Yes No No Yes
Adversarial Review Yes No No No
Uncertainty Transparency Yes No No No
Verifiable Evidence Chain Yes No No No
Cost Free; your API keys Free Free Subscription

Project Structure

audison/
├── src/audison/
│   ├── engine/              # TrustEngine — standalone audit layer
│   ├── brains/              # Brain One, Brain Two, Opponent Brain
│   ├── core/                # Caching, context, session management
│   └── utils/               # LLM client (8 providers), token counter
├── tests/unit/              # 186 unit tests
├── reports/                 # Audit reports
├── docs/                    # API, integrations, getting started
├── pyproject.toml
└── LICENSE

License

Apache License 2.0 — Copyright 2026 盛鑫


AI proposes. AI challenges. You decide.

Try it live: playground.html  |  GitHub Pages


详细文档见 docs/ — API 详解、MCP Server 配置、GitHub Action、LangChain/CrewAI 集成等。

Morty Proxy This is a proxified and sanitized view of the page, visit original site.