Most scanners guess.
frapAST proves it.

A security and performance scanner built specifically for Frappe and ERPNext. It indexes DocType JSON schemas, understands whitelisted RPC decorators, and verifies candidate findings through a two-tier active proof engine before alerting your team.

$ pip install frapast
Read the Docs
india_payroll — frapast
frapast scan ./india_payroll
25 candidates across 73 files in 0.12s — 25 medium
frapast prove --all
Proving findings · FR-PERM-001 in get_ecr_file
Findings verified: 25
PROVEN 1 (4%)
REFUTED 24 (96%)
Top proven finding:
 FR-HOOK-003 tax_regime_selector.py:214 (Tier 1)

Why not just use Bandit or SonarQube?

Generic Python SAST tools analyze Frappe apps as generic scripts. Frappe applications are metadata-driven: DocType JSON schemas, hooks.py event registrations, and whitelist decorators cannot be understood by plain AST linters without producing heavy false-positive noise.

Generic SAST Scanners

seesa decorator named @frappe.whitelist() without recognizing public HTTP endpoint exposure
seesa function calling frappe.db.sql() without checking parameter binding contexts
reportshundreds of unverified alerts, with no way to distinguish true risk from framework noise

frapAST Engine

knowsthat decorator exposes a live HTTP endpoint and traces parameter dispatch
knowswhich DocType fields and child tables actually exist directly from schema JSON files
proveseach candidate finding by synthesizing standalone reproducers or executing live against a bench

Documentation & Guides

Everything you need to audit, verify, and remediate Frappe and ERPNext security candidates.

Getting Started

Install frapAST, run your first static codebase scan, and verify candidate findings.

Rule Taxonomy (28)

Searchable reference of all active rule detectors with vulnerable vs. patched code patterns.

CLI Reference

Full reference of all CLI commands, exit codes, filtering flags, and output formats.

GitHub Action CI/CD

Automate security scanning in GitHub Actions with native OASIS SARIF 2.1.0 code scanning.

Documentation FAQ

Answers to common questions regarding local privacy, bench setups, and rule authoring.

Community & Source

Contributing guidelines, roadmap, security vulnerability disclosure policy, and licenses.

Two Tiers of Proof, Not One Guess

A candidate vulnerability only escalates to a confirmed alert if frapAST can synthesize an executable reproducer that proves exploitability.

1

Tier 1: Standalone AST Direct Reproductions

For logic-level defects — missing rollback reversal handlers (FR-HOOK-001), bare exception swallowing (FR-HOOK-006), mutable default arguments (FR-HOOK-007), and N+1 query bottlenecks (FR-PERF-001) — frapAST synthesizes a standalone program that exercises the code path and confirms the defect fires locally without needing a live server.

2

Tier 2: Live HTTP / RPC Verification

For network and authentication vulnerabilities — mutating whitelisted endpoints without permission checks (FR-PERM-001), SQL injection (FR-SQLI-001), SSRF (FR-SSRF-001), and path traversal (FR-PATH-001) — frapAST dispatches authenticated HTTP requests to your local or staging Frappe bench to confirm live exploitability.

Performance & Scale

Audited against open-source Frappe and ERPNext enterprise codebases.

~0.95s Frappe HRMS (670 files, 155k LOC)
~5.82s ERPNext Core (3,842 files, 980k LOC)
100% Local & Air-Gapped (Zero data egress)
MIT Open source, free, zero telemetry

Why frapAST was Built

Building production applications on Frappe and ERPNext revealed a persistent challenge: standard security scanners flooded development teams with false positives on framework idioms, while missing genuine framework vulnerabilities like mutating whitelisted RPC endpoints and broken submittable DocType state machines. frapAST was built from the ground up to understand the Frappe framework layer natively — indexing schemas, resolving hook dispatch trees, and actively proving exploitability before reporting findings.

Frequently Asked Questions

Everything you need to know about scanning, verification, and privacy.

No. A standard static security audit (frapast scan /path/to/app) runs 100% locally by parsing Python ASTs, DocType JSON schemas, and hooks.py files. A running Frappe bench is only required if you invoke Tier 2 HTTP proof verification (frapast scan --prove or frapast prove).

Never. frapAST is 100% local, air-gapped, and collects zero telemetry. The local web dashboard binds strictly to 127.0.0.1 and enforces cross-origin request protection. No code or metadata leaves your workstation or CI runner.

Generic scanners treat Python files as standalone scripts without understanding that @frappe.whitelist() exposes a public HTTP RPC endpoint, that DocType JSONs declare column schemas and permissions, or that hooks.py registers lifecycle dispatches. frapAST models these framework-specific constructs to identify vulnerabilities that generic tools miss, while eliminating false-positive noise.

Yes. Version 0.1.0 includes 28 active detectors, automated AST autofixes, OASIS SARIF 2.1.0 output, and an automated regression test suite covering all rules and parser subsystems.

Yes. frapAST has a modular rule architecture. Detectors are pure Python functions that receive the indexed SchemaIndex, HookIndex, PythonSymbolIndex, and static CallGraph. Review our Contributing Guide for step-by-step instructions on authoring new detectors.

Get Started in Seconds

Run audits locally or integrate automated SARIF code scanning into your GitHub Actions workflow.

1. Install pip install frapast
2. Static Scan frapast scan /path/to/frappe-app
3. Automated Fixes frapast fix /path/to/frappe-app --apply
4. GitHub Action uses: pratheep-bit/frapast@v0.1.0