nyx-scanner 0.2.0

Fast, cross-language cli vulnerability scanner.

What is Nyx?

Nyx is a lightweight, lightning-fast Rust-native command-line tool that detects security vulnerabilities across 10 programming languages. It combines tree-sitter parsing, intra-procedural control-flow graphs, and cross-file taint analysis with an optional SQLite-backed index to deliver deep, repeatable scans on projects of any size.

Key Capabilities

Why choose Nyx?

Installation

Install crate

$ cargo install nyx-scanner

Install Github release

1. Navigate to the Releases page of the repository.

2. Download the appropriate binary for your system:

   nyx-x86_64-unknown-linux-gnu.zip for Linux

   nyx-x86_64-pc-windows-msvc.zip for Windows

   nyx-x86_64-apple-darwin.zip or nyx-aarch64-apple-darwin.zip for macOS (Intel or Apple Silicon)

3. Unzip the file and move the executable to a directory in your system PATH:

   # Example for Unix systems
   unzip nyx-x86_64-unknown-linux-gnu.zip
   chmod +x nyx
   sudo mv nyx /usr/local/bin/
   

   # Example for Windows in PowerShell
   Expand-Archive -Path nyx-x86_64-pc-windows-msvc.zip -DestinationPath .
   Move-Item -Path .\nyx.exe -Destination "C:\Program Files\Nyx\"  # Add to PATH manually if needed
   

4. Verify the installation:

   nyx --version
   

Build from source

$ git clone https://github.com/ecpeter23/nyx.git
$ cd nyx
$ cargo build --release
# optional – copy the binary into PATH
$ cargo install --path .

Nyx targets stable Rust 1.85 or later.

Quick Start

# Scan the current directory (creates/uses an index automatically)
$ nyx scan

# Scan a specific path and emit JSON
$ nyx scan ./server --format json

# Perform an ad-hoc scan without touching the index
$ nyx scan --no-index

# Restrict results to high-severity findings
$ nyx scan --high-only

# AST pattern matching only (fastest, no CFG/taint)
$ nyx scan --ast-only

# CFG + taint analysis only (skip AST pattern rules)
$ nyx scan --cfg-only

Index Management

# Create or rebuild an index
$ nyx index build [PATH] [--force]

# Display index metadata (size, modified date, etc.)
$ nyx index status [PATH]

# List all indexed projects (add -v for detailed view)
$ nyx list [-v]

# Remove a single project or purge all indexes
$ nyx clean <PROJECT_NAME>
$ nyx clean --all

Analysis Modes

Nyx supports three analysis modes, selectable via the scanner.mode config option or CLI flags:

What the CFG + taint engine detects

Findings are scored and ranked by severity, proximity to entry point, path complexity, and taint confirmation.

Supported Languages

All 10 languages have full AST pattern matching and CFG/taint analysis. Resource leak detection is available where language-specific acquire/release pairs are defined.

Configuration Overview

Nyx merges a default configuration file (nyx.conf) with user overrides (nyx.local). Both live in the platform-specific configuration directory shown below.

Minimal example (nyx.local):

[scanner]
mode                = "full"       # full | ast | taint
min_severity        = "Medium"
follow_symlinks     = true
excluded_extensions = ["mp3", "mp4"]

[output]
default_format = "json"
max_results    = 200

[performance]
worker_threads     = 8  # 0 = auto-detect
batch_size         = 200
channel_multiplier = 2

A fully documented nyx.conf is generated automatically on first run.

Architecture in Brief

Nyx uses a two-pass architecture to enable cross-file analysis without sacrificing parallelism:

1. File enumeration -- A parallel walker (Rayon + ignore crate) applies gitignore rules, size limits, and user exclusions.
2. Pass 1 -- Summary extraction -- Each file is parsed via tree-sitter, an intra-procedural CFG is built (petgraph), and a FuncSummary is exported per function capturing source/sanitizer/sink capabilities (bitflags), taint propagation behavior, and callee lists. Summaries are persisted to SQLite.
3. Summary merge -- All per-file summaries are merged into a GlobalSummaries map with conservative conflict resolution (union caps, OR booleans).
4. Pass 2 -- Analysis -- Files are re-parsed and analyzed with the full cross-file context: BFS taint propagation resolves callees against local and global summaries, CFG analysis checks for auth gaps, unguarded sinks, resource leaks, and more.
5. Reporting -- Findings are scored, ranked, deduplicated, and emitted to the console or serialized as JSON.

With indexing enabled, Pass 1 skips files whose blake3 content hash is unchanged, and cached findings are served directly for AST-only results.

Roadmap

Phase 1 -- Deep Static Engine

Phase 2 -- Dynamic Capability

Phase 3 -- Intelligent Reasoning Layer

Other planned improvements

Community feedback shapes priorities -- please open an issue to discuss proposed changes.

Contributing

Pull requests are welcome. To contribute:

1. Fork the repository and create a feature branch.
2. Adhere to rustfmt and ensure cargo clippy --all -- -D warnings passes.
3. Add unit and/or integration tests where applicable (cargo test should remain green).
4. Submit a concise, well-documented pull request.

Please open an issue for any crash, panic, or suspicious result -- attach the minimal code snippet and mention the Nyx version.

See CONTRIBUTING.md for full guidelines.

License

Nyx is licensed under the GNU General Public License v3.0 (GPL-3.0).

This ensures that all modified versions of the scanner remain free and open-source, protecting the integrity and transparency of security tools.

See LICENSE for full details.