AI-Shim: Compliance Scanner for AI-Generated Code

A modular API shim that automatically scans AI-generated source code for open source compliance using SCANOSS.

Overview

AI-Shim sits between your application and AI code generation APIs (Claude, OpenAI, DeepSeek), intercepting generated code and scanning it for potential open source matches before passing it back to your application. It adds compliance information as code comments, helping maintain transparency and proper attribution in AI-assisted development.

Features

• Transparent API passthrough for Claude, OpenAI, and DeepSeek
• Automatic SCANOSS scanning of generated code
• Open source compliance information added as code comments
• Modular design for easy addition of new AI providers
• Configuration-based provider selection

Installation

git clone <repository-url>
cd ai-shim
npm install

Required dependencies:

• Node.js (v18 or higher)
• npm
• @anthropic-ai/sdk
• node-fetch
• openai
• express
• body-parser
• SCANOSS API access (defaults to free OSSKB.org API by Software Transparency Foundation)

Configuration

Copy the provided config.example.json to config.json in the root directory and update it with your settings:

cp config.example.json config.json

The configuration file structure:

{
  "server": {
    "port": 11000,
    "host": "localhost"
  },
  "activeProvider": "deepseek",
  "providers": {
    "deepseek": {
      "url": "http://localhost:11434/api/generate"
    },
    "claude": {
      "url": "https://api.anthropic.com/v1/messages"
    },
    "openai": {
      "url": "https://api.openai.com/v1/chat/completions"
    }
  },
  "scanoss": {
    "url": "https://osskb.org/api/scan/direct",
    "userAgent": "SCANOSS_AI_Shim/0.0.1",
    "apiKey": "YOUR_SCANOSS_API_KEY"
  }
}

Usage

1. Start the server:

node shim-api.js

2. Direct your API calls to the shim instead of the AI provider directly. The shim maintains the same API interface as the original provider.

Example using curl with Claude:

curl -X POST http://localhost:11000/api/generate \
  -H "Content-Type: application/json" \
  -H "anthropic-version: 2023-06-01" \
  -H "x-api-key: YOUR_API_KEY" \
  -d '{
    "model": "claude-3-opus-20240229",
    "messages": [
      { "role": "user", "content": "Write a function that calculates fibonacci numbers" }
    ]
  }'

The response will include the generated code with SCANOSS compliance information as comments:

/* STARTS autogenerated code for which
   SCANOSS found no Open Source matches */
def fibonacci(n):
    if n <= 0:
        return 0
    elif n == 1:
        return 1
    
    fib = [0] * (n + 1)
    fib[1] = 1
    
    for i in range(2, n + 1):
        fib[i] = fib[i-1] + fib[i-2]
    return fib[n]
/* END of autogenerated code */

Adding New Providers

Create a new provider module in the providers directory. Each provider must implement the following interface:

async function generate(config, headers, body) {
  // Implementation
  return {
    raw: originalResponse,
    extractedCode: codeString
  };
}

module.exports = { generate };

Security Considerations

• Store API keys securely and never commit them to version control
• Use appropriate authentication and rate limiting in production
• Consider network security when deploying in production environments
• Review SCANOSS scan results for potential license compliance implications or incompatibilities with your code license.

License

MIT License

Copyright (c) 2024 SCANOSS.com

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.