Coverage01 / 04
—
Awaiting intake
Find every cryptographic artefact in a codebase, score its quantum risk, export a conformant CBOM.
ASTRA statically scans source, dependency manifests, TLS/SSH config, X.509 certificates, binaries and Dockerfiles. Nothing is executed, nothing leaves the host. Delivered as a CLI, a FastAPI service and this dashboard.
357+ automated tests
6 languages
MIT open source
0 external requests
Scope · what is verified today
Every SIH26164 surface, and exactly where this build stands on it.
| SIH26164 surface | Status | What this build actually does |
|---|---|---|
| Algorithms in source | Verified | Python AST + multi-language regex across Python, Java, JavaScript/TypeScript, Go, C/C++ and Rust. Comment and docstring stripping removes false positives. |
| Libraries & manifests | Verified | Parses package.json, pom.xml, requirements.txt, pyproject.toml, go.mod, Cargo.toml — and labels declared dependencies distinctly from confirmed runtime calls. |
| Protocols in config | Verified | TLS and SSH protocol versions and cipher suites across .yaml, .conf, .ini, .properties. |
| Keys & certificates | Verified | X.509 metadata — subject, issuer, key algorithm, bit length, validity. Private key material is automatically redacted to [REDACTED_PRIVATE_KEY_MATERIAL]. |
| Binaries | CLI only | ELF, PE/COFF and Mach-O header symbols plus ASN.1 OIDs, on direct scans. Web uploads deliberately filter executables at intake. |
| Containers | Verified | Dockerfile instructions, base OS crypto packages and certificate environment variables. |
| Coverage honesty | Verified | Reports an honest denominator N_assessed / N_total. Unsupported formats raise a coverage warning instead of a misleading "100% clean". |
| Quantum risk | Verified | Mosca inequality X + Y > Z with interactive scenario sliders and a ranked migration backlog. |
| CBOM output | Verified | Schema-validated CycloneDX 1.6 CBOM with multi-scanner reconciliation. |
| Hardware modules | Roadmap | PKCS#11 tokens, smartcards and physical HSM discovery are not in this build. |
| Cloud services | Roadmap | AWS KMS, Azure Key Vault and GCP Cloud KMS fleet scanning are not in this build. |
The last two rows are required by SIH26164 and are honestly marked as not yet implemented. Everything above them is verified and covered by the test suite.
Run it
Three ways to start it.
Quickstart — from the repository root
# A. One-click on Windows — launches server and browser launch.bat # B. CLI, no server — air-gapped friendly pip install -r requirements.txt && pip install -e . astra scan ./examples/synthetic_sample --format table # C. FastAPI service + this dashboard, or Docker astra serve → http://localhost:8000 docker compose up --build
Intake
Point ASTRA at an archive.
Drop an archive, or browse.
Extraction runs in an ephemeral read-only sandbox. Uploaded code is never executed, installed or evaluated.
.zip.tar.tar.gz.tar.bz2
Zip-bomb guarded · 100:1
Traversal guarded
Symlink guarded
Executables filtered
01 Intake→
02 Discover→
03 Coverage→
04 Risk→
05 CBOM
Offline · nothing leaves this machine
Analyzing…0%
Results
Posture at a glance.
Artefacts02 / 04
—
Multi-modal observations
Mosca violations03 / 04
—
X + Y > Z
CBOM04 / 04
1.6
CycloneDX profile
01 / Inventory
Discovered artefacts, with file and line provenance.
| Algorithm | Category | Key size | Location | Confidence | Urgency | Candidate PQC |
|---|
02 / Mosca risk
Store-Now-Decrypt-Later exposure, per artefact.
X shelf-life + Y migration > Z threat horizon
⇒ information is already at risk of deferred decryption
Threat horizon and shelf-life are scenario simulation assumptions, not predictive forecasts. Adjust them to model your own planning position.
X + Y10.0 yrs
vs
Z horizon8.0 yrs
SNDL exposure
3D PARAMETER SPACE
Interactive Mosca Horizon Geometry (X × Y × Z)
Visualizing the Store-Now-Decrypt-Later boundary hypersurface X + Y = Z. Drag to rotate in 3D · Scroll to zoom · Hover over nodes to inspect assets.
X-AXIS: Shelf-Life (0–25y)
Y-AXIS: Migration (0–10y)
Z-AXIS: Threat Horizon (0–15y)
CURRENT SCENARIO: X=7.0y, Y=3.0y, Z=8.0y
STATUS: EXPOSED (+2.0y)
X shelf-life
Y migration
safe slack
past Z
Z marker
| Asset | Algorithm | Purpose | X + Y vs Z | Slack | Condition | Urgency |
|---|
03 / Migration roadmap
Dependency-ordered waves — Foundation, Platform, Edge.
Call-site dependencies are sorted topologically, so a library is never scheduled before whatever it depends on. This is what prevents impossible migration timelines.
04 / Temporal DNA
One SHA-256 fingerprint of the whole posture. Drift in O(1).
Compare two releases without re-parsing either. A single algorithm downgrade changes the digest, so regression is caught at the gate rather than at the audit.
Current release DNA hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
O(1) parity verified
Cryptographic strength tier, per commit
rev-131 · downgrade blockedrev-118rev-124rev-131rev-133
| Tier transition | Severity | Action required | Enforcement |
|---|---|---|---|
| Tier 4 (AES-256) → Tier 1 (DES) | Critical | Block build, revert the regression | FAIL-CLOSED |
| Tier 3 (RSA-2048) → Tier 2 (RSA-1024) | High | Require security review sign-off | BLOCK-MERGE |
| Tier 4 (ECDSA P-256) → Tier 3 (RSA-2048) | Medium | Flag for the next architecture review | WARN-MERGE |
05 / CBOM export
CycloneDX 1.6 cryptographic bill of materials.
Schema-validated and spec-conformant, with multi-scanner reconciliation. Feeds SBOM consumers, policy engines and national registries — no proprietary schema.
astra-cbom.json
Loading…
06 / Audit log
Tamper-evident review trail.
Every discovery, assessment and export links to the previous record's SHA-256 digest, so modification or truncation of the log is detectable.
| Seq | Timestamp | Action | Actor | Previous hash | Event digest |
|---|
07 / CLI guide
The whole pipeline from a terminal, with no server running.
The CLI is a first-class entry point, not a wrapper around the web UI. It registers as astra from the app.cli:main entry point, and every command runs entirely on the host — no licence check, no telemetry, no egress. This is the path used on air-gapped machines.
Install
# Python 3.10 or newer pip install -r requirements.txt pip install -e . → registers the astra command astra version → confirms the install # optional dev extras: pytest, httpx, black, ruff pip install -e ".[dev]"
Command reference
Seven commands.
| Command | What it does | Flags |
|---|---|---|
| astra scan <path or archive> | Runs static discovery across source, manifests, TLS/SSH configs, X.509 certificates and Dockerfiles, then reports honest coverage. Use table for a readable summary or json for machine consumption. | --format table|json --output <file> |
| astra show <scan-id> | Prints the scan record: target, timestamp, coverage fraction, clean-state label and the SHA-256 Cryptographic DNA hash. | — |
| astra risk <scan-id> | Re-evaluates the Mosca inequality against a new scenario without rescanning. Prints per-algorithm risk score, urgency tier and slack. | --horizon <years> --shelf-life <years> --migration <years> |
| astra export <scan-id> | Writes the CycloneDX 1.6 CBOM projection to disk, ready for any SBOM consumer. | --output <file> |
| astra validate <scan-id> | Checks the emitted CBOM against the CycloneDX 1.6 schema and reports the component count. This is the step that backs the conformance claim. | — |
| astra serve | Starts the FastAPI service and this dashboard. Interactive API documentation lands at /docs. | --host <addr> --port <port> |
| astra version | Prints the installed version so a run can be traced to a build. | — |
Worked example
Scan, inspect, re-price the risk, export, validate.
1 · Scan and keep the report
astra scan ./codebase.zip --format json --output scan_report.json
2 · Inspect the record — note the coverage and the clean-state label
astra show scan-d6f0cb73 Scan ID: scan-d6f0cb73 Target: codebase_bundle.zip Created At: 2026-10-03T12:00:00+00:00 Coverage: 87.5% (7/8 files assessed) Clean State Label: FINDINGS_PRESENT Cryptographic DNA: a1b2c3d4e5f6…
3 · Re-price the Mosca scenario without rescanning
astra risk scan-d6f0cb73 --horizon 8.0 --shelf-life 5.0 --migration 2.0 Active Scenario: Quantum Horizon Z = 8.0 yrs (Assumption) | Shelf-Life X = 5.0 yrs | Migration Y = 2.0 yrs Mosca Inequality: X (5.0) + Y (2.0) = 7.0 yrs vs Z (8.0 yrs) -> SATISFIED (X + Y <= Z) Algorithm Risk Score Urgency Tier Mosca Urgency Status --------------------------------------------------------------- RSA-2048 58.0 HIGH No (Slack: +1.0y) AES-256 12.0 LOW No (Slack: +1.0y)
4 · Export a standards-conformant CBOM, then prove it
astra export scan-d6f0cb73 --output cbom_cyclonedx.json astra validate scan-d6f0cb73 [SUCCESS] CBOM for scan scan-d6f0cb73 is VALID under CycloneDX 1.6. Cryptographic Components: 7
Behaviour worth knowing
Four things the CLI will not do.
| Behaviour | Why it matters |
|---|---|
| Never reports a false "safe" | A repository with no cryptography in the supported scope is labelled NO_FINDINGS_IN_SUPPORTED_SCOPE next to a coverage caveat — never as clean or safe. |
| Never executes the target | Uploaded code is parsed, not run. No installs, no imports, no evaluation of scanned content. |
| Never returns a bare percentage | Coverage is always the fraction N_assessed / N_total, so an unsupported file format shows up as a blind spot rather than as coverage. |
| Never leaks private key material | Detected key material is redacted to [REDACTED_PRIVATE_KEY_MATERIAL] before it reaches any report or export. |
One scope note: direct astra scan runs against a directory are the path that reaches static binary headers (ELF, PE/COFF, Mach-O). Archive uploads through the web intake filter executables, so use the CLI when binaries are in scope.