Add pre-commit hook and in-memory scanning support

Introduced a .pre-commit-config.yaml for pre-commit integration and added 'pre-commit' as a dev dependency. Enhanced SecretScanner and TechDebtScanner with scan_content methods for in-memory scanning, and updated MCP's check_file to support scanning file content directly without requiring disk writes. Updated documentation to reflect these changes and mark related roadmap items as complete.

Author: Tuntii

.gitignore

@@ -170,3 +170,4 @@ memory_bank.md
 openaudit.egg-info/PKG-INFO
 openaudit.egg-info/requires.txt
 /openaudit.egg-info
+memory_bank.md

.pre-commit-config.yaml

@@ -0,0 +1,18 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+
+  - repo: local
+    hooks:
+      - id: openaudit-scan
+        name: OpenAuditKit Scan
+        entry: openaudit scan --fail-on high
+        language: system
+        types: [python]
+        pass_filenames: false
+        description: "Runs OpenAuditKit scan on the repository before commit."

README.md

@@ -95,6 +95,22 @@ Turn your favorite AI Editor (Cursor, Claude Desktop) into a security expert. Op
 
 The AI will invoke OpenAuditKit locally and report back findings instantly!
 
+## 🪝 Git Hooks (Pre-commit)
+
+Prevent security issues from being committed by using our pre-configured git hooks.
+
+1.  **Install pre-commit**:
+    ```bash
+    pip install pre-commit
+    ```
+
+2.  **Install the hooks**:
+    ```bash
+    pre-commit install
+    ```
+
+Now, `openaudit` will automatically scan your code before every commit!
+
 ## 🛡️ VibeGuard (Tech Debt Scanner)
 
 We know "vibecodin" happens. OpenAuditKit now includes **VibeGuard**, a scanner designed to catch non-engineering practices before they hit production:

openaudit/features/debt/scanner.py

@@ -68,34 +68,41 @@ def scan(self, context: ScanContext) -> List[Finding]:
         for file_path in self._iterate_files(context):
             try:
                 content = Path(file_path).read_text(encoding="utf-8", errors="ignore")
-                lines = content.splitlines()
-                
-                # Line-by-line scanning
-                for i, line in enumerate(lines, 1):
-                    for key, rule in self.patterns.items():
-                        match = rule["pattern"].search(line)
-                        if match:
-                            # Skip if specific ignore comment is present
-                            if "noqa" in line or "@ignore" in line:
-                                continue
-
-                            detail = match.group(0).strip()[:50] # truncated
-                            if key == "ANNOTATION":
-                                detail = match.group(2).strip() or "Untitled Task"
-
-                            findings.append(Finding(
-                                rule_id=f"DEBT-{key}",
-                                description=f"{rule['desc']}: {detail}",
-                                file_path=str(Path(file_path).relative_to(context.target_path)),
-                                line_number=i,
-                                secret_hash=match.group(0).strip()[:20],
-                                severity=rule["severity"],
-                                confidence=Confidence.HIGH,
-                                category="technical_debt",
-                                remediation="Review and clean up code."
-                            ))
-                            
+                # Calculate relative path for reporting
+                rel_path = str(Path(file_path).relative_to(context.target_path))
+                findings.extend(self.scan_content(content, rel_path))
             except Exception:
                 continue
+        return findings
+
+    def scan_content(self, content: str, file_path: str) -> List[Finding]:
+        findings = []
+        lines = content.splitlines()
+        
+        # Line-by-line scanning
+        for i, line in enumerate(lines, 1):
+            for key, rule in self.patterns.items():
+                match = rule["pattern"].search(line)
+                if match:
+                    # Skip if specific ignore comment is present
+                    if "noqa" in line or "@ignore" in line:
+                        continue
+
+                    detail = match.group(0).strip()[:50] # truncated
+                    if key == "ANNOTATION":
+                        detail = match.group(2).strip() or "Untitled Task"
+
+                    findings.append(Finding(
+                        rule_id=f"DEBT-{key}",
+                        description=f"{rule['desc']}: {detail}",
+                        file_path=file_path,
+                        line_number=i,
+                        secret_hash=match.group(0).strip()[:20],
+                        severity=rule["severity"],
+                        confidence=Confidence.HIGH,
+                        category="technical_debt",
+                        remediation="Review and clean up code."
+                    ))
+        return findings
 
         return findings

openaudit/features/secrets/scanner.py

@@ -60,35 +60,39 @@ def _scan_file(self, file_path: Path) -> List[Finding]:
                 return findings
 
             content = file_path.read_text(encoding='utf-8', errors='ignore')
-            
-            for rule, regex in self.compiled_rules:
-                for line_num, line in enumerate(content.splitlines(), start=1):
-                    for match in regex.finditer(line):
-                        if match.lastindex and match.lastindex >= 1:
-                            secret_candidate = match.group(1)
-                        else:
-                            secret_candidate = match.group(0)
-                        
-                        if rule.entropy_check:
-                            if self._calculate_entropy(secret_candidate) < 4.5: # Threshold
-                                continue
-                        
-                        findings.append(Finding(
-                            rule_id=rule.id,
-                            description=rule.description,
-                            file_path=str(file_path),
-                            line_number=line_num,
-                            secret_hash=self._mask_secret(secret_candidate),
-                            severity=rule.severity,
-                            confidence=rule.confidence,
-                            category="secret"
-                        ))
+            return self.scan_content(content, str(file_path))
         except Exception as e:
             # log or ignore
             pass
 
         return findings
 
+    def scan_content(self, content: str, file_path: str) -> List[Finding]:
+        findings = []
+        for rule, regex in self.compiled_rules:
+            for line_num, line in enumerate(content.splitlines(), start=1):
+                for match in regex.finditer(line):
+                    if match.lastindex and match.lastindex >= 1:
+                        secret_candidate = match.group(1)
+                    else:
+                        secret_candidate = match.group(0)
+                    
+                    if rule.entropy_check:
+                        if self._calculate_entropy(secret_candidate) < 4.5: # Threshold
+                            continue
+                    
+                    findings.append(Finding(
+                        rule_id=rule.id,
+                        description=rule.description,
+                        file_path=file_path,
+                        line_number=line_num,
+                        secret_hash=self._mask_secret(secret_candidate),
+                        severity=rule.severity,
+                        confidence=rule.confidence,
+                        category="secret"
+                    ))
+        return findings
+
     def _calculate_entropy(self, data: str) -> float:
         if not data:
             return 0

openaudit/mcp/server.py

@@ -67,37 +67,53 @@ def scan_workspace(path: str, checks: List[str] = ["secrets", "config", "debt"])
     return report
 
 @mcp.tool()
-def check_file(file_path: str, content: str) -> str:
+def check_file(file_path: str, content: str = None) -> str:
     """
     Checks a single file content for security issues immediately (useful for pre-save checks).
-    This function creates a temporary file to run the scan if needed, or uses regex directly 
-    depending on scanner implementation. For consistency, we'll try to scan the file path 
-    assuming it's on disk, or warn if it requires disk presence.
-    """
-    # For now, we assume the file exists on disk at file_path since scanners read from disk.
-    # In a real "vibecoding" stream, we might want to scan 'content' directly.
-    # OpenAudit scanners currently take a Context which iterates files.
-    # We will fallback to calling scan_workspace on the parent folder but filtering for this file
-    # Or simplified: Just reuse scan_workspace logic but strictly for one file.
+    If 'content' is provided, it scans that content directly without reading from disk.
+    If 'content' is NOT provided, it reads the file from disk.
     
-    path_obj = Path(file_path).absolute()
-    if not path_obj.exists():
-        # Note: We currently require file to exist on disk.
-        # Future improvement: Support verifying in-memory content.
-        return f"Error: File {file_path} must exist on disk to be scanned."
-        
+    Args:
+        file_path: The path of the file (used for reporting and rule matching).
+        content: Optional. The actual content of the file.
+    """
     rules = _get_rules()
-    ignore_manager = IgnoreManager(root_path=path_obj.parent)
-    context = ScanContext(target_path=str(path_obj.parent), ignore_manager=ignore_manager)
 
-    # We manually override context iteration or just initialize scanners that handle single files well.
-    # SecretScanner detects file vs dir.
+    # Initialize scanners
+    secret_scanner = SecretScanner(rules=rules)
+    debt_scanner = TechDebtScanner()
+    
+    file_content = content
+    
+    # If content is not provided, try to read from disk
+    if file_content is None:
+        path_obj = Path(file_path).absolute()
+        if not path_obj.exists():
+            return f"Error: File {file_path} does not exist on disk and no content provided."
+        try:
+            file_content = path_obj.read_text(encoding='utf-8', errors='ignore')
+        except Exception as e:
+            return f"Error reading file: {str(e)}"
+            
+    all_findings = []
+    
+    # Run scans on content
+    all_findings.extend(secret_scanner.scan_content(file_content, file_path))
+    all_findings.extend(debt_scanner.scan_content(file_content, file_path))
 
-    # Let's create a tailored context scan
-    scanners = [
-        SecretScanner(rules=rules),
-        TechDebtScanner() # Code quality is important for single files too
-    ]
+    if not all_findings:
+        return "✅ OpenAuditKit: File looks clean!"
+
+    # Format output
+    report = f"🚨 Issues Found in {file_path}:\n\n"
+    for f in all_findings:
+        report += f"- [{f.severity.value.upper()}] {f.category.upper()} at line {f.line_number}\n"
+        report += f"  Details: {f.description}\n"
+        if f.remediation:
+             report += f"  Fix: {f.remediation}\n"
+        report += "\n"
+        
+    return report
 
     # The scanners expect context.target_path to be the root. 
     # Whatever, let's just use the SecretScanner internal _scan_file if we could exposed it, 

pyproject.toml

@@ -31,7 +31,8 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "pytest>=7.0.0",
-    "pytest-cov>=4.0.0"
+    "pytest-cov>=4.0.0",
+    "pre-commit>=3.5.0"
 ]
 
 [project.scripts]