Iac Secopilot

iac-security-copilot

Ask natural-language questions about a Terraform plan and get cited, evaluated answers grounded in the **CIS AWS Foundations Benchmark** and **OWASP Top 10 CI/CD Security Risks**. Run it as a CLI, hit it over HTTP, or expose it to Claude Code / Cursor as an MCP server — same retriever, same scan agent, same citations.

What's in the box:

• RAG over a security corpus — hybrid retrieval (BM25 + dense + RRF + cross-encoder rerank) over Postgres + pgvector.
• LangGraph scan agent — parses a Terraform plan JSON, fans out one branch per resource, retrieves matching guidance, asks an LLM (Anthropic / OpenAI / Ollama / a deterministic stub) for a structured finding with citations.
• MCP stdio server — search_corpus, scan_terraform_plan, list_sources exposed as tools so editor agents can ground their answers in the same corpus.
• FastAPI service — POST /v1/search, POST /v1/scan, GET /v1/sources; same business logic as the CLI and MCP server.
• Eval harness — 22 hand-curated golden cases (17 Terraform plan JSON + 5 CloudFormation templates), scored with custom resource-centric matching + severity tolerance + keyword grounding + citation correctness. Committed regression reports for every supported LLM.
• Local Kubernetes demo — ./k8s/up.sh brings up a kind cluster with Postgres + the FastAPI app behind ingress-nginx + a real HPA in one command.

Latest eval reports

Two reports live side-by-side, each answering a different question:

• `evals/qwen3-baseline.md` — real-quality measurement against ollama:qwen3:latest (8B). The headline number when you want to know what the product actually does.
• `evals/stub-baseline.md` — deterministic regression check using the stub LLM. F1=1.00 by construction — this baseline gates the framework, not the product. Runs in <1s.

Top-line against the 17 Terraform cases of the 22-case golden set (CFN cases are e