Spectra代码分析助手

1. Verify SLSA build provenance

Confirms the artifact was built by leocder07/spectra's publish workflow on the expected tag commit — defeats the tag-move attack class.

```bash

Install once

brew install gh # or: see https://cli.github.com/

Install once

pip install "sigstore>=3.0,<4.0"

Clone and install

git clone https://github.com/leocder07/spectra.git cd spectra pip install -e ".[dev]"

Built for the Anthropic Build with Claude Hackathon

Built with Claude Opus 4.7 and Claude Code.

MIT License · Repository

</div>

Quickstart

Three lines, under a minute:

pip install spectra-ai
export ANTHROPIC_API_KEY=sk-ant-...
spectra analyze https://github.com/your/repo

Open spectra-report.html when it finishes. Requires Python 3.12+ and an Anthropic API key.

At-rest cache encryption (optional). The local SQLite cache always carries per-row HMAC integrity. To also encrypt cache contents at rest, install the opt-in extra: pip install "spectra-ai[encryption]". This pulls pysqlcipher3, which source-builds against libsqlcipher — macOS users need brew install sqlcipher first; Debian/Ubuntu apt-get install libsqlcipher-dev. Without the extra, Spectra runs with plain SQLite + HMAC and emits a single WARN at startup.

See sample reports

GitHub displays .html files as raw source when clicked. Use the "View rendered" links to see the actual reports in your browser.

• Sample reports — real Spectra runs against the Anthropic SDK, FastAPI, HTTPX, Aider, Simon Willison's LLM, and the Spectra repo itself
• Quickstart demo reports — Django, Express, FastAPI, Flask + a multi-repo leaderboard
• v0.6.0 self-scan — Spectra grading itself, with prompt-injection isolation, encrypted cache, signed receipts, and the audit log all active

---

CLI Reference

Two top-level commands: spectra analyze and spectra cache.

Generated client SDKs we don't author

clients/generated/

CI Integration

The official GitHub Action installs Spectra from PyPI and runs spectra analyze on every PR — no Python setup, no extra steps. See docs/github-action.md for the full reference.

```yaml

.github/workflows/spectra-analyze.yml

name: Spectra Analysis on: pull_request: branches: [main] jobs: analyze: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: spectra-ai/spectra@v1 with: min-score: 70 env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} ```

The Action also writes SARIF, which GitHub picks up under the Security tab — findings show inline on the PR.

How Spectra Compares

Honest tradeoffs. Spectra is built for full-repo audits — not for inline PR comments or IDE feedback. Use it alongside, not instead of, the tools your team already runs.

If you need inline PR comments while reviewing diffs, run CodeRabbit. If you need an architecture-level audit with security and compliance scoring before a release or due-diligence review, run Spectra. They complement each other.

---