# OASIS

An AI-powered security auditing tool that uses local LLMs through Ollama or any OpenAI-compatible server to detect and analyze potential security vulnerabilities in source code.

OASIS (Open Automated Security Intelligence Scanner) scans source code for security vulnerabilities using local large language models served through Ollama, or any OpenAI-compatible backend such as vLLM, LiteLLM or LM Studio. It produces canonical JSON security reports under a per-project output directory, and a dashboard with a chat assistant that can triage a single finding or a whole scan using retrieval-augmented generation over a local embedding cache.

Its finding-validation approach uses a deterministic verdict process with scope anchoring and narrative guardrails, and it supports multi-model scans that merge results from several models into one consolidated report with fingerprint-grouped findings. Other features include a pre-scan audit mode, a suppression registry with SARIF suppressions, inline ignore markers in source comments, diffing a scan against a baseline, and a fail-on gate for CI pipelines with example GitHub Actions integration.

It installs with pipx or Docker, including a Compose setup, and can run its web interface from a container.

Website: https://github.com/psyray/oasis