Checkmate

A high-performance, standalone Go CLI runner that executes security scans sequentially or in parallel. Harness the power of deep Code Property Graphs (AST, CFG, DFG) directly from raw source code with zero build dependencies, normalized findings, and optional LLM enrichment.

Get Started go build -o checkmate-go .
🚀 Parallel Performance

Core-limited worker pool built in Go for concurrent engine execution. Orchestrates OpenGrep, Trivy, Bandit, Brakeman, Gostaticcheck, and Fraunhofer CPG.

🤖 LLM Enrichment

Overlay security analysis with AI context using OpenAI-compatible endpoints to explain impact and write customized fixes directly in your reports.

📋 Unified Outputs

No more juggling tool-specific logs. Normalizes all findings into a clean, unified schema supporting JSON, SARIF, and static HTML with smart deduplication.

The Analysis Engine

Why Code Property Graphs (CPG)?

Standard SAST tools rely on shallow regex-based grepping or isolated syntax parsing (AST). They flag keyword matches but miss how data moves. Checkmate implements the Code Property Graph (CPG) framework via Fraunhofer CPG to combine code structure, control pathways, and data flows into a unified analysis model.

Grepping / Pattern Matching
Superficial matches. High noise, high false positives, zero flow tracking.
AST Parsing
Understands syntax and variables but lacks logical path analysis.
Checkmate CPG
Unifies AST, CFG, and DFG to track data end-to-end from source to sink.
UI & Dashboard

Go Self-Hosted Web Platform

Prefer a visual dashboard over the terminal? Checkmate includes **checkmate-web**, a lightweight, self-hosted web interface built to run natively in your own environment.

  • ✦ Interactive dashboard to manage and trigger scans
  • ✦ Visual historical trends and vulnerability tracking over time
  • ✦ Easy local setup using Docker with zero compilation needed
Explore checkmate-web on Codeberg →

# Run the self-hosted platform locally

docker run -d \

--name checkmate-web \

-p 8080:8080 \

-v /var/run/docker.sock:/var/run/docker.sock \

marcinguy/checkmate-web

# Web app running at:

http://localhost:8080

Usage Examples

# Run parallel scan with 8 jobs

./checkmate-go --code-dir ./src --strategy parallel --jobs 8

# Full report with LLM enrichment

./checkmate-go \ --code-dir ./project \ --llm-enrich \ --llm-model gpt-4.1-mini \ --sarif-out results.sarif \ --html-out results.html

Strategies & Tools

  • ✓ Sequential: Predictable, step-by-step scanner execution.
  • ✓ Parallel: High-speed concurrent execution using a Go worker pool.
  • ✓ Auto-Install: Automatically download and configure missing local tooling dependencies using the --install-missing flag.

Deployment Ready

Ready-to-use templates for cloud-scale automated scanning:

Cloud Run Jobs ECS/Fargate
Security First

Built with Security in Mind

Checkmate isolates every scan worker in its own hardware-enforced microVM (CubeOS / KVM), so untrusted code that attempts a container escape is confined to a single ephemeral VM rather than shared host resources.

This is defense in depth: an independent isolation layer that protects you even when the host kernel or Docker runtime is not fully patched.