en

Inside ojo: How ColibriSec’s Scanner Finds Vulnerabilities, Secrets, and Misconfigurations

Under the hood of ojo's zero-dependency engine: manifest parsing, Tree-sitter SAST queries, OS package diffing, and offline vulnerability databases.

James Luther

James Luther

— 1 min read
Inside ojo: How ColibriSec’s Scanner Finds Vulnerabilities, Secrets, and Misconfigurations
Photo by Krzysztof Kowalik / Unsplash

A deep dive into the engineering architecture behind ojo: how our zero-dependency engine parses manifests across 10 package ecosystems, executes Tree-sitter AST queries, and performs offline vulnerability matching from a single static Go binary.

🛠️
Architecture Principles: Native Implementations: Hand-crafted manifest parsers and secret engines rather than wrapping third-party CLI wrappers. Embedded Tree-sitter & go/ast: High-speed semantic AST traversal across Go, Python, JavaScript, TypeScript, PHP, Ruby, and Java. Offline-First Database: Embedded vulnerability advisory snapshots with optional air-gapped updates.

Core Architecture

ojo is built as a single, self-contained Go binary with no runtime dependencies. Rather than invoking external daemons or wrapping Node/Python runtimes, it owns its entire scanning pipeline:

┌───────────────────────────────────────────────────────────┐
│                     ojo CLI Runner                        │
│            ojo fs <path>    │    ojo image <ref>          │
└─────────────┬───────────────────────────────┬─────────────┘
              ▼                               ▼
┌─────────────────────────────┐ ┌───────────────────────────┐
│   Source & Manifest Engine   │ │     OCI Registry Client   │
│ • 10 Ecosystem Parsers      │ │ • Direct Layer Streaming  │
│ • Tree-sitter SAST Rules    │ │ • apk / dpkg DB Extractor │
│ • Secret Entropy Heuristics │ └─────────────┬─────────────┘
│ • IaC Policy Engine         │               │
└─────────────┬───────────────┘               │
              ▼                               ▼
┌───────────────────────────────────────────────────────────┐
│                 Vulnerability Matching Core               │
│         Advisory Graph + Semantic Version Resolution      │
└───────────────────────────────────────────────────────────┘

AST-Based SAST Engine

Unlike simple regex linters that generate massive false positives, ojo compiles syntax trees directly:

  • For Go: Uses Go's native standard library go/ast and go/parser for zero-overhead structural code inspection.
  • For Python, JS/TS, Java, PHP, Ruby: Embeds Tree-sitter C grammar bindings to construct concrete syntax trees and evaluate security query patterns.

Get Started with ojo

ojo is open source and available under the Apache 2.0 license. Visit colibrisec.dev for documentation, installation guides, and CI/CD GitHub Action integration examples.

Read more