Gauntlet - Secure Code Assistant

Your AI-powered secure code assistant with adversarial verification. Chat about security concepts or generate verified code directly in VS Code.

✨ Features

• 💬 Chat Mode: Ask questions about security best practices, vulnerabilities, and secure coding
• ⚡ Generate Mode: Create secure, verified code using adversarial testing
• 🛡️ Adversarial Verification: Code is tested against security attacks before delivery
• 🎯 Abort Requests: Cancel long-running requests anytime
• 📊 Security Reports: Detailed analysis with confidence scores
• ☁️ Cloud-Hosted: No local setup required - backend runs on Azure

🚀 Quick Start

1. Install the extension from the VS Code Marketplace
2. Click the 🛡️ shield icon in the status bar
3. Choose your mode:
   • Chat: Ask security questions, get guidance
   • Generate: Create verified secure code
4. Start coding securely!

Optional: Configure Your Own API Keys

By default, Gauntlet uses the hosted backend with shared API keys. For better performance and higher rate limits, add your own:

1. Open VS Code Settings (Ctrl+, or Cmd+,)
2. Search for "Secure LLM"
3. Choose your AI provider (OpenRouter, OpenAI, Claude, or Gemini)
4. Enter your API key

💬 Chat Mode

Ask anything about secure coding:

• "What are common SQL injection vulnerabilities?"
• "How do I securely handle user passwords?"
• "Explain CSRF attacks and prevention"
• "Best practices for API authentication"

⚡ Generate Mode

Request secure code implementations:

• "Create a secure password validation function"
• "Write a function to sanitize user input"
• "Generate a secure file upload handler"
• "Build an SQL query sanitizer"

🔒 How Adversarial Verification Works

When you generate code, Gauntlet runs it through multiple security layers:

1. Blue Agent: Generates code using advanced LLMs
2. Static Analysis: Scans for security issues (Bandit, Semgrep, Pylint)
3. Red Agent: Creates adversarial test cases and exploits
4. Dynamic Testing: Executes code in sandboxed environment
5. Adjudicator: Makes final security verdict (PASS/WARN/FAIL)

📊 What You Get

For each code generation:

• ✅ Verified Code: Secure implementation ready to use
• 📄 Security Report: Detailed analysis with:
  • Verification status (PASS/WARN/FAIL)
  • Confidence score (0-100%)
  • Security violations found
  • Evidence and recommendations

⚙️ Configuration

🎨 Modern Design

• Clean, neutral interface that adapts to your VS Code theme
• Animated loading states to keep you engaged
• Abort button for long-running requests
• Centered, modern typography

🛠️ Troubleshooting

"Request timeout"

• Click the Abort button to cancel
• Try a simpler prompt
• Or increase timeout in settings

Slow responses

• Add your own API key for better performance
• The shared backend may have rate limits

Connection issues

• Check your internet connection
• The Azure backend should be accessible at all times
• Report issues on GitHub if problems persist

📚 Documentation

• GitHub Repository
• Architecture Guide
• Security Methodology

🆕 What's New in v0.0.5

• ✅ Abort request feature - cancel anytime
• ✅ Animated loading messages
• ✅ Modern neutral design
• ✅ Cleaner, centered UI
• ✅ Better typography and spacing

🤝 Contributing

Contributions welcome! Visit the main repository for details.

📄 License

MIT License - see LICENSE for details.

🔗 Links

• GitHub Repository
• Report Issues
• VS Code Marketplace

Gauntlet - Generate secure code with confidence. Powered by adversarial AI testing.