원클릭으로
scan
// Run SOC 2 compliance checks against connected cloud accounts (AWS, Azure, and/or GCP) and display findings.
// Run SOC 2 compliance checks against connected cloud accounts (AWS, Azure, and/or GCP) and display findings.
Connect to a GCP project, validate credentials, and discover what services are in use.
Deep code scan for AI security issues — prompt injection, PII in prompts, hardcoded keys, unguarded agents.
Run AI governance checks across cloud accounts and code repos — ISO 42001, EU AI Act, NIST AI RMF compliance.
Scan cloud accounts and GitHub repos to discover AI/ML services and build an AI system inventory.
Walk staged changes against the engineering principles checklist and report pass/fail per principle. Run before any non-trivial commit. Catches doc drift, stub functions, single-region defaults, missing framework mappings, and other regressions before they ship.
Generate a public-facing security trust page from scan data. Produces a single deployable index.html that shows compliance framework scores, security policies, infrastructure overview, and data protection posture. Deployable to S3, Vercel, Netlify, or GitHub Pages.
| name | scan |
| description | Run SOC 2 compliance checks against connected cloud accounts (AWS, Azure, and/or GCP) and display findings. |
| user-invocable | true |
You are running a SOC 2 compliance scan for a semi-technical founder. Explain findings in plain English.
Read shasta.config.json for python_cmd, aws_profile, azure_subscription_id, and gcp_project_id. Use that for all commands (shown as <PYTHON_CMD>).
Determine which clouds to scan:
aws_profile is set (non-empty) → scan AWSazure_subscription_id is set (non-empty) → scan Azuregcp_project_id is set (non-empty) → scan GCP/connect-aws, /connect-azure, or /connect-gcp first<PYTHON_CMD> -c "
from shasta.db.schema import ShastaDB
db = ShastaDB(); db.initialize()
scan = db.get_recent_scan(max_age_minutes=60)
if scan:
print(f'RECENT_SCAN_FOUND|{scan.id}|{scan.completed_at}|{scan.summary.total_findings if scan.summary else 0} findings')
else:
print('NO_RECENT_SCAN')
last_review = db.get_last_review_date()
if last_review: print(f'LAST_ACCESS_REVIEW|{last_review}')
else: print('NO_ACCESS_REVIEW_FOUND')
"
If a recent scan exists, tell the user and ask if they want to reuse it or run fresh.
The scanner takes AWS, Azure, and GCP clients together and scans whatever is passed in a single pass. The snippet below builds only the clients that are configured, so the same command works for any cloud or combination — no need to pick a cloud-specific variant.
<PYTHON_CMD> -c "
import json
from shasta.config import load_config, get_aws_client, get_azure_client, get_gcp_client
from shasta.scanner import run_full_scan
from shasta.compliance.mapper import get_control_summary
from shasta.compliance.scorer import calculate_score
from shasta.reports.summary import summarize_scan
from shasta.reports.generator import save_markdown_report, save_html_report
from shasta.db.schema import ShastaDB
cfg = load_config()
clients = {}
if cfg.get('aws_profile'):
c = get_aws_client(); c.validate_credentials(); clients['client'] = c
if cfg.get('azure_subscription_id'):
a = get_azure_client(); a.validate_credentials(); clients['azure_client'] = a
if cfg.get('gcp_project_id'):
g = get_gcp_client(); g.validate_credentials(); clients['gcp_client'] = g
if not clients:
raise SystemExit('No clouds configured. Run /connect-aws, /connect-azure, or /connect-gcp first.')
labels = {'client': 'AWS', 'azure_client': 'Azure', 'gcp_client': 'GCP'}
print(f\"Running full compliance scan ({' + '.join(labels[k] for k in clients)})...\")
scan = run_full_scan(**clients)
db = ShastaDB(); db.initialize(); db.save_scan(scan)
md = save_markdown_report(scan)
html = save_html_report(scan)
print(f'Reports saved: {md} | {html}')
score = calculate_score(scan.findings)
summary = summarize_scan(scan)
summary['score'] = {
'percentage': score.score_percentage,
'grade': score.grade,
'controls_passing': score.passing,
'controls_failing': score.failing,
}
summary['control_summary'] = {
k: {'title': v['title'], 'overall_status': v['overall_status'], 'pass_count': v['pass_count'], 'fail_count': v['fail_count']}
for k, v in get_control_summary(scan.findings).items()
if v['has_automated_checks'] or v['overall_status'] != 'not_assessed'
}
print(json.dumps(summary, indent=2))
"