Qryon

# Install in 10 seconds
npm install -g qryon

# Find vulnerabilities instantly
qryon scan .

Why Qryon?

Qryon is 10x faster because it compiles Semgrep rules to native Rust matchers at build time - no interpreter overhead.

Quick Start

# Scan your project
qryon scan .

# Interactive TUI - browse findings with vim keys
qryon scan . --interactive

# CI/CD mode - SARIF output for GitHub Security tab
qryon scan . --output sarif -f results.sarif

# Watch mode - re-scan on file changes
qryon watch .

# AI-powered finding triage (triages static findings with AI)
export ANTHROPIC_API_KEY=sk-ant-...
qryon scan . --ai

# Use OpenAI instead
export OPENAI_API_KEY=sk-...
qryon scan . --ai --ai-provider openai

# Use local Ollama (free, no API key)
qryon scan . --ai --ai-provider local

brew tap bumahkib7/tap && brew install qryon

cargo install qryon

docker run -v $(pwd):/workspace ghcr.io/bumahkib7/qryon scan /workspace

curl -fsSL https://raw.githubusercontent.com/bumahkib7/qryon/master/install.sh | bash

- uses: bumahkib7/qryon@v0.19.1
  with:
    path: '.'
    upload-sarif: true

What It Finds

critical[QRYON-S005]: SQL query built with format! - use parameterized queries
  --> src/database.rs:42:9
40 │     let user_input = get_input();
41 │
42 │     format!(
   │     ^^^^^^^^ SQL query built from untrusted input
43 │         "SELECT * FROM users WHERE name = '{}'",
44 │         user_input
   = note: rule: rust/sql-injection

Security Detection

• Injection attacks - SQL, command, XSS, LDAP, template injection
• Server-side vulnerabilities - SSRF, path traversal, deserialization
• Hardcoded secrets - API keys, passwords, tokens
• Cryptographic issues - Weak algorithms (MD5, SHA-1, DES), insecure modes
• Dependency CVEs - Real-time OSV.dev integration for Cargo, npm, PyPI, Go, Maven

Supported Languages

Plus 23 more languages with parsing and metrics support.

Interactive TUI

Browse findings, call graphs, and taint flows with keyboard navigation:

qryon scan . --interactive

Keyboard shortcuts: j/k navigate, Tab switch tabs, s filter severity, / search, q quit

GitHub Actions

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write

    steps:
      - uses: actions/checkout@v4
      - uses: bumahkib7/qryon@v0.19.1
        with:
          path: '.'
          upload-sarif: true

Findings appear in the GitHub Security tab automatically.

Qryon Dashboard - Team Features

Love the CLI? Qryon Dashboard adds powerful team features:

Try Qryon Dashboard free →

Advanced Features

qryon flows . --evidence --group-by sink-type

qryon security .

qryon daemon --port 9876

qryon plugin install ./my-plugin.wasm

How It Works

Qryon compiles Semgrep community rules at build time into optimized native matchers:

┌─────────────────────────────────────────────────────────┐
│                     BUILD TIME                          │
│  semgrep-rules/*.yaml  →  build.rs  →  compiled_rules  │
│                                           (embedded)    │
└─────────────────────────────────────────────────────────┘
                            ↓
┌─────────────────────────────────────────────────────────┐
│                      RUNTIME                            │
│  source.rs  →  tree-sitter  →  AST  →  pattern match  │
│                                               ↓         │
│                                           Findings      │
└─────────────────────────────────────────────────────────┘

Result: No interpreter overhead. No Semgrep dependency. Single binary.

Configuration

qryon init  # Creates qryon.toml

[scan]
include = ["src/**"]
exclude = ["node_modules/**", "target/**"]

[rules]
enable = ["*"]
disable = ["js/console-log"]

[profiles.strict]
max_function_lines = 50
max_complexity = 10

Inline suppression:

// qryon-ignore-next-line js/xss-sink reason="content is sanitized"
element.textContent = processedContent;

Benchmarks

hyperfine 'qryon scan /path/to/repo' 'semgrep --config auto /path/to/repo'

On a 500K LOC monorepo:

• Qryon: 23 seconds
• Semgrep: 4 minutes 12 seconds

Contributing

Contributions welcome! See CONTRIBUTING.md.

make build    # Build all crates
make test     # Run tests
make lint     # Run lints

License

MIT or Apache-2.0, at your option.

lib.rs:

Code analysis and security scanning for Qryon

This crate provides metrics computation, vulnerability detection, and pattern-based analysis on parsed ASTs.

NOTE: This crate DETECTS security vulnerabilities - it does not contain them. The security rules detect dangerous patterns like unsafe code, code injection, etc.

Modules

• flow: Control flow and data flow analysis (CFG, taint tracking)
• knowledge: Framework-specific security knowledge base
• metrics: Code metrics computation (complexity, LOC, etc.)
• providers: External analysis tool integrations (PMD, Oxlint, etc.)
• rules: Analysis rule trait and implementations
• security: Security rules organized by language
• semantics: Language adapter layer for tree-sitter AST mapping