Semgrep: multi-language code scanning
Runs Semgrep over the target directory with metrics turned off. Rules come from Semgrep's registry (the auto configuration) unless a scan supplies its own. Pinned local rule snapshots are Coming.
Application security for the Renkara fleet
Seven scanners, one record of findings.
Aegis runs Semgrep, Bandit, pip-audit, Safety, detect-secrets, Checkov, and Trivy over a repository and keeps what they report as one normalized, deduplicated list. It is early: the scanning engine and its API work today, and you use it through the API, because there is no dashboard.
- Accessibility documented
- Internal to Renkara
- Early: engine and API only
Internal to Renkara. Aegis is a tool Renkara Media Group builds and runs for itself. It is not offered for sale, and there is nothing to buy or join. This site shows what it does and how it is built.
Features
Seven scanners. One findings record. Your own infrastructure.
Aegis wraps Semgrep, Bandit, pip-audit, Safety, detect-secrets, Checkov, and Trivy behind one FastAPI service. Each scanner's output is normalized into a single finding with a severity, a location, fix guidance where the scanner gives it, and a content hash, so scanning the same code twice never creates a second row. Findings live in Aegis's own Postgres database and are read and updated through its API.
Scanner stack
Seven open-source scanners, one API
Bandit: Python code scanning
Scans Python source recursively. Aegis pins a few per-rule corrections where Bandit understates the risk: subprocess with shell=True and eval() are both raised to CRITICAL, with their CWE tags.
pip-audit and Safety: Python dependencies
Both read a repository's requirements.txt and report known-vulnerable packages. pip-audit findings carry an Upgrade to package >= version remediation when a fixed version exists.
detect-secrets: hardcoded secrets
Scans every file. A finding records the file, the line, and the kind of secret it matched. The secret itself is not stored in the finding.
Checkov: infrastructure as code
Scans a directory and lets Checkov detect the frameworks it finds, such as Terraform, CloudFormation, Kubernetes manifests, and Dockerfiles, then maps each failed check into the unified finding.
Trivy: filesystem scan
Runs trivy fs over the directory. Trivy is the one Go binary in the stack; the Dockerfile installs a pinned release tarball rather than the floating package repository. Container image scanning is Coming.
Time limits and honest failures
Every scanner has a time limit: five minutes, or two for Safety. A scanner that is missing, crashes, or runs out of time is recorded as a failed or timed-out result for that scan. The other scanners still run.
Findings record
One finding, one row
One schema for every scanner
Each finding stores the scanner, rule ID, CWE list, CVE where there is one, severity, file path, start and end line, a code excerpt, a message, remediation, reference links, status, and when it was first seen, last seen, and fixed.
Content-addressed deduplication
A finding's identity is sha256(scanner | rule_id | file_path | normalized_code_context | severity). Whitespace in the code excerpt is normalized first, so reformatting alone never creates a duplicate.
A lifecycle that follows the code
Findings are open, accepted, suppressed, or fixed. When a later scan no longer sees an open finding, it becomes fixed. If a fixed finding comes back, it reopens. Accepted and suppressed findings stay as they are.
An audit trail on status changes
Changing a finding's status through the API writes a finding event with the old status, the new status, and the time. Recording who made the change waits on the fleet authentication wiring and is Coming.
Five severities, mapped per scanner
CRITICAL, HIGH, MEDIUM, LOW, and INFO. Each scanner's native severity maps onto that scale through a per-scanner mapping file, which can also override a rule's severity and attach CWE tags.
Scans and API
Scan on demand, read the results over HTTP
Register a repository, start a scan
Register a repository by name, default branch, and local directory, then start a scan on all seven scanners or a chosen subset. Each scan records a status, per-scanner results with durations, and counts of new, reopened, fixed, and total findings by severity and scanner.
A findings API with filters
List findings up to 200 at a time, filtered by severity, scanner, repository, or status, newest first. Fetch one finding in full, or set its status.
Inline or queued
By default a scan runs its scanners one after another inside the request. In queue mode, Aegis publishes one request per scanner to a message bus (in memory or NATS JetStream); a separate worker runs the scanner and posts the result back to an internal endpoint, which finalizes the scan.
Scan events
A scan announces itself as started, reports each scanner as it finishes, and announces completion. Those events go out on an event bus (in memory or Valkey) and stream to any client connected to Aegis's WebSocket endpoint.
Fleet foundation
Built like the rest of the Renkara fleet
Shared fleet services
Postgres (a dedicated aegis database), Valkey, and NATS come from the shared fleet stack. Schema changes go through Alembic migrations.
Logs to Chronicle
Aegis ships its logs to Chronicle through the fleet's SDK, and says so in its own log if the SDK is missing rather than running uninstrumented in silence.
How it works
From a repository to a triaged record
Register
Add a repository with its name, default branch, and the local directory to scan.
Scan
Start a scan. Each chosen scanner runs over the directory under its own time limit and returns JSON.
Normalize
A per-scanner normalizer turns the raw output into unified findings: severity, CWE, location, fix guidance, and a dedup hash.
Persist and close out
New findings are inserted, repeats are touched, fixed findings reopen, and open findings the scan no longer sees become fixed. The scan's summary is written and a completion event goes out.
Read and triage
List and filter findings through the API, open one for its code excerpt and remediation, and set its status.
Accessibility
Built so everyone can use Aegis.
Aegis does not have a finished interface yet: its web app is an authentication screen and one placeholder page, and its dashboard is not built. So there is nothing to claim about the product today, and this page says so category by category. Its API, where Aegis does its work, has no visual interface at all.
Keyboard operation Not yet tested
The placeholder page has a skip link to its main content. No one has walked the web app with a keyboard, and the dashboard that would need it does not exist yet.
Screen reader landmarks and labels Not yet tested
The placeholder page is built from a single main landmark and one page heading, but it has not been scanned with axe-core or tried with a screen reader.
Contrast in light and dark Not yet tested
Aegis uses the Renkara design system's color tokens and a red accent in light and dark. Its own contrast has not been measured.
Reduced motion Not yet tested
The web app has no animation of its own yet, and its tests do not check the reduced-motion setting.
Text resize and zoom Not yet tested
Resizing text to 200 percent has not been tested in the Aegis web app.
Mobile and touch Not yet tested
The Aegis web app has not been checked at a 375 by 667 phone screen. The dashboard it would apply to does not exist yet.
Tech specs
Under the hood
| Backend |
|
|---|---|
| Scanners |
|
| Frontend |
|
| Ports and data |
|
Replaces
What it stands in for
- Snyk
- Mend
- GitHub Advanced Security
Works with
Part of the Renkara fleet
- Chronicle
Aegis ships its logs to Chronicle through the fleet's logging SDK. Nothing else in the fleet is wired to Aegis yet.
FAQ
Questions people ask
Is Aegis something I can buy or use?
No. Aegis is internal to Renkara. It scans Renkara's own repositories and is not offered for sale, and there is nothing to join. This site shows what it does today and how it is built.
Is there a dashboard?
Not yet. Today you start scans and read findings through Aegis's HTTP API. The web app is an authentication screen and one placeholder page. There is no dashboard.
Does it scan GitHub repositories automatically?
No. A scan reads a local directory that a repository is registered with. Scanning on push and pull request is not part of Aegis today.
What does fixed mean?
A finding becomes fixed when a later scan no longer sees it, and only if the scanner that reported it completed in that scan. If that scanner failed or timed out, the finding stays open. A fixed finding that comes back reopens.
Does it replace Snyk, Mend, or GitHub Advanced Security?
Replacing them is the goal in Aegis's requirements. It does not do that yet: it has no dashboard, no pull request integration, and no local copy of the advisory databases.
Contact
Questions about this tool?
Write to Renkara Media Group and a person will answer.