A deterministic multi-agent compliance auditor for GitHub repositories. Security, governance, and technical debt scoring with prioritized remediation.
An audit tool that hallucinates findings is worse than no audit tool. Every rule here is pattern-based and reproducible: the same repository snapshot always produces the same findings, the same severities, and the same score.
An optional language model writes the executive summary. It never creates, removes, or reweights a finding.
uv sync
uv run audit brianpelow/orbit-platformWorks with no credentials. A GITHUB_TOKEN only raises the API rate limit. An OPENROUTER_API_KEY only enables the prose summary.
uv run audit brianpelow/orbit-platform --markdown
uv run audit brianpelow/orbit-platform --out reports/orbit.md
uv run audit brianpelow/orbit-platform --fail-under 80 # exits 1 below thresholdThe --fail-under flag makes this usable as a CI gate on your own repositories.
| Agent | What it checks | Weight |
|---|---|---|
SecurityAgent |
Committed credentials, eval/exec, shell=True, string-built SQL, disabled TLS verification, bare excepts, untracked .env |
45% |
ComplianceAgent |
CODEOWNERS, LICENSE, CI workflow, tests, README depth, CHANGELOG, CONTRIBUTING, ADRs | 35% |
DebtAgent |
TODO density, oversized files, deep nesting, unpinned dependencies, sparse type annotations | 20% |
VerdictAgent |
Weighted score, letter grade, top-five prioritized remediation | -- |
Any critical finding caps the grade at D regardless of the weighted score. A committed credential is not offset by a good CHANGELOG.
Each agent starts at 100 and subtracts a fixed weight per finding: critical 30, high 15, medium 7, low 3, info 0. Scores are clamped to 0-100 and combined using the weights above.
| Grade | Score |
|---|---|
| A | 93-100 |
| B | 85-92 |
| C | 75-84 |
| D | 65-74 |
| F | below 65 |
Compliance rules map to widely published control expectations rather than any organization's internal standards:
- Change authorization and segregation of duties -- CODEOWNERS plus CI gating provides reviewer evidence (SOX ITGC)
- Documented ownership and traceability -- CODEOWNERS, CHANGELOG, ADRs (SOC 2 CC-series)
- Secure SDLC documentation -- CONTRIBUTING, SECURITY.md, automated verification (PCI-DSS Requirement 6)
Every rule is reconstructable from public sources.
A scheduled agent audits a set of repositories every night and commits the results to reports/, including a rolled-up scorecard with average score across the portfolio.
| Repo | What it is |
|---|---|
| orbit-platform | The control plane that enforces these standards at deploy time |
| cab-automation | Change advisory automation with risk scoring |
| platform-maturity-assessment | Organization-level maturity scoring across six domains |
Apache 2.0