TRVChek Technical Manual

TRVChek is a local CLI code immunity layer that scans code generated by any AI coding assistant — including Cursor, GitHub Copilot, Windsurf, and similar tools. It ships 56 AI-specific detection rules. Deterministic scanning and fixes run entirely on your machine and never upload your code; license checks, and the opt-in cloud-assisted lane, use the network.

Installation

TRVChek downloads are temporarily unavailable while the current release is being validated.

This one command also finishes activation: it reuses a valid license already on the machine, or asks for your license key in the terminal (hidden as you type) and verifies it is active before reporting that you are ready.

Activation (manual recovery)

$ trvchek activate <your-license-key>

Only needed if the installer had no interactive terminal, or activation did not complete — the engine stays installed and the installer says so. Need a key? See Activate.

Quick Start

$ trvchek check ./src
$ trvchek check ./src --json       # CI/CD output
$ trvchek check ./src -r           # recursive

Commands

trvchek activate <license-key>	Activate your license on this machine
trvchek check <file-or-dir>	Scan a file or directory, human-readable report
trvchek check <file-or-dir> --json	Machine-readable JSON output (for CI)
trvchek status	Show license status and rule-engine version
trvchek backup	Back up current config and custom settings
trvchek deactivate	Deactivate the license on this machine

Flags

--json	Machine-readable output for CI/CD pipelines
--threshold <n>	Exit non-zero when the immunity score drops below n
-r	Recurse into subdirectories
-v	Verbose output with per-rule detail

Full command and flag list lives in the CLI reference.

Core Rules

56 AI-specific detectors run on every check. The catalog below documents 30 of them, grouped by severity: 9 critical · 12 high · 6 medium · 3 low. Each finding reports the rule ID, file, line number and rule name. Python is fully covered, with JavaScript/TypeScript support for the cross-language rules tagged NEW.

Critical9 rules

early_return_auth

Hardcoded admin username comparison, classic AI auth shortcut

auth_bypass

Auth function returns bare True/False, possible authentication bypass

dangerous_eval_exec

eval()/exec() on dynamic input, arbitrary code execution

command_injection

os.system() call, shell command injection risk

json_load_vulnerability

json.load on unvalidated input without size/schema limits

subprocess_injection

subprocess call, verifies shell=False and no input interpolation

pickle_deserialization

pickle on untrusted data, arbitrary code execution

insecure_yaml_load

yaml.load() without SafeLoader, arbitrary object instantiation

os_popen_injection

os.popen() call, shell command injection risk

High12 rules

hardcoded_secret

Hardcoded secret or credential in source

sql_injection_risk

cursor.execute() without parameterized queries

path_traversal

File operation on a potentially user-controlled path

weak_hash

Weak hash (MD5/SHA1) in Python or JS crypto

missing_null_check

Direct property access on a possibly-null object

insecure_temp_file

tempfile.mktemp(), race-condition-prone temp files

insecure_http_request

TLS verification disabled (verify=False)

weak_crypto_hash

MD5 usage, cryptographically broken

xml_bomb_vulnerability

Untrusted XML parsed with stdlib etree, entity-expansion risk

dangerous_file_deletion

Recursive deletion on a potentially user-influenced path

sql_string_concatnew

SQL built by string concatenation or template literals, any language

open_redirect_jsnew

Redirect target taken from request input, phishing risk

Medium6 rules

silent_exception

Bare or swallowed exception, errors disappear silently

race_condition_async

Async function with unprotected shared state

mutable_default

Mutable default argument, state leaks between calls

off_by_one_loop

range(len(...)) index loop, classic off-by-one source

missing_input_validationnew

Handler takes user input with no validation nearby

silent_exception_jsnew

Empty catch block, errors disappear silently

Low3 rules

insecure_random

Python random module is not cryptographically secure

hallucinated_import

Import not found in stdlib or known packages, possible AI-hallucinated module

insecure_random_jsnew

Math.random() is not cryptographically secure

Immunity Score

S	95–100%	Immune
A	85–94%	Protected
B	70–84%	Vulnerable
C	50–69%	Exposed
D	30–49%	Compromised
F	0–29%	Critical

Privacy

✓No telemetry
✓No cloud processing for deterministic checks
✓No data collection
✓Deterministic checks run locally
✓Licence checks and opt-in cloud lanes use the network

Configuration

Create trvchek.yaml in your project root for custom settings.

Support

Email support@trvchek.com — support replies within 12 hours.