nephilex

Nephilex is an open-source AI Security Engineer that analyzes repositories, detects vulnerabilities, validates risks, explains findings, generates fixes, and helps developers build secure software

A new way for AI to search for data

View on GitHub

13GitHub stars

331commits on main

1forks

v0.11.0latest release, 2026-10-23

Python 98.1%, TypeScript 0.8%, JavaScript 0.5%, HTML 0.3% · created 2026-07-03 · last push 2026-10-30

What XERJ indexed

Snapshot

356 files · 1.5 MB

The whole repository at commit 96b374a463 (2026-10-22). main is 215 commits ahead.

Selected work

Haseeb Farooq
@hasipfaruk

“run every git call through one hardened runner”. 6 files, 762 lines in src/argus, tests.

Licence

The repository

Apache-2.0

LICENSE file checked at the pinned commit; the author agreed to inclusion.

The XERJ corpus

Apache-2.0, with credit

The author agreed by email on 2026-10-24. Same terms as the repository. Answers name the repo, the commit and the file:line.

selected for the XERJ Corpus Hublicence clearedsuggested use: adapt with attribution

devsecopsllm-securitypythonsastsbomsecuritystatic-analysis

Example questions

How does nephilex implement devsecops?
Where does nephilex handle “run every git call through one hardened runner”?
What does src/argus do in nephilex?

Inside the indexed corpus

356 files, 1.5 MB in total, about 4.4 KB per file.
The selected commit changed 6 of those files (1.7%).
Languages by size: Python 98.1%, TypeScript 0.8%, JavaScript 0.5%, HTML 0.3%, CSS 0.2%.
On GitHub since 2026-07-03, last push 2026-10-30, 331 commits on main.
The pin is 215 commits behind main; the corpus answers from the pinned code, not the newest.

Licence on GitHub and in the corpus

GitHub reported Apache-2.0 for Nephilex/nephilex on 2026-10-31, and the LICENSE file at commit 96b374a463 was reviewed as Apache-2.0. They match, so answers from this corpus carry the same terms as the live repository.

Contributors

Haseeb Farooq (@hasipfaruk) has 1 selected repository on the hub.

Using XERJ with nephilex

Batch lookup CVE and GHSA IDs offline in one query nephilex is tagged security on GitHub.
How do I run syntax-aware code search? nephilex is tagged static-analysis on GitHub.
XERJ vs ast-grep: syntax search and an index
ripgrep vs a code index for coding agents: 30 tasks

The prompt

Paste it into your AI agent. It clones Nephilex/nephilex at the pinned commit and indexes it on your machine.

Search the GitHub repository Nephilex/nephilex with XERJ (https://hub.xerj.org/corpus/nephilex--nephilex).
Run these in a shell, in order, and check each result before the next:
1. xerj --help  (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh
2. git clone https://github.com/Argus-CodeSecurity/Argus-appsec Argus-appsec && git -C Argus-appsec checkout 96b374a463757eb9e0ef19ef88d45582237b98b5
3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data
4. xerj autoindex ./Argus-appsec --url http://127.0.0.1:9200 --prefix argus-appsec --progress plain
5. xerj autoindex map --url http://127.0.0.1:9200
Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt
Licence: Apache-2.0. Keep the copyright notice and credit the authors.

Haseeb Farooq Security and vulnerabilities corpora bandit-plugins gosec-rules garak Actenon/actenon-scan bastyn-labs/bastyn-scan argus-code-scanning/argus-codescan-mcp

Stats: GitHub API, fetched 2026-10-31. Snapshot: the git tree at the pinned commit. Selected work and consent: the XERJ registry.