Classguard

pip install cognis-classguard
classguard scan .            # → prioritized findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ classguard-emit --version
classguard 0.1.0

$ classguard-emit --help
usage: classguard [-h] [--version] {check} ...

Validate classification banner & portion markings in documents (ISOO-style
compliance).

positional arguments:
  {check}
    check     Check one or more documents for marking compliance.

options:
  -h, --help  show this help message and exit
  --version   show program's version number and exit

Blocks above are real classguard output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
"timestamp": "2023-02-15T14:30:00Z",
"findings": [
  {
    "id": "1234567890",
    "title": "Suspicious Network Traffic",
    "description": "Potential malicious activity detected on network interface eth0.",
    "severity": "high",
    "mitre_attack_ids": ["T1006"],
    "cve_ids": ["CVE-2022-1234"],
    "created_by": "classguard",
    "modified_by": "classguard"
  }
]
}

Usage — step by step

1. Install:

   pip install -e .
   

2. Check one or more documents for classification banner & portion-marking compliance with the check subcommand:

   classguard check report.txt
   

3. Check several files at once (the files argument is variadic):

   classguard check doc1.txt doc2.txt doc3.txt
   

4. Read the result. Each document prints [PASS]/[FAIL], the top/bottom banner, banner level, highest portion, unmarked-paragraph count, and per-finding ERROR/WARN/INFO lines with codes. Use --format json for piping. The process exits 1 when any document has marking errors (and with --strict, when any warnings exist); 2 on IO error:

   classguard check report.txt --format json
   

5. Use it in CI — gate document releases on clean markings (treat warnings as failures):

   classguard check docs/*.txt --strict --format json || {
     echo "Classification marking errors found"; exit 1; }
   

Contents

• Why classguard? · Features · Quick start · Example · Demos · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why classguard?

Validate classification banner markings (CUI/CONFIDENTIAL/SECRET) in documents per portion-marking rules. — without standing up heavyweight infrastructure.

classguard is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Banner detection (top/bottom must match) & banner-level canonicalization
• ✅ Portion-marking checks — paragraph-aware, so multi-line portions aren't false-flagged
• ✅ ISOO-style rule "highest portion must equal the banner" (over/under-marking)
• ✅ CUI structural sanity (banner must carry a control marking block)
• ✅ Output as table, JSON, or SARIF 2.1.0 (GitHub code scanning)
• ✅ CI gate via exit codes + --strict
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, Go, and Rust (ports/)

Quick start

pip install cognis-classguard
classguard --version
classguard check report.txt                 # validate one document
classguard check docs/*.txt --format json    # machine-readable
classguard check docs/*.txt --format sarif   # SARIF 2.1.0 for code scanning
classguard check docs/*.txt --strict         # CI gate: warnings fail too

Example

$ classguard check report.txt
================================================================
[FAIL] report.txt
  banner(top):    CONFIDENTIAL
  banner(bottom): <none>
  banner level:   C
  highest portion:S
  portions:       3   unmarked paras: 1
  errors: 2   warnings: 1
    ERROR L11    BANNER_BOTTOM_MISSING  No classification banner on the last content line.
    WARN  L8     PORTION_UNMARKED       Content paragraph lacks a portion marking.
    ERROR --     PORTION_EXCEEDS_BANNER Highest portion (S) is more sensitive than banner (C).

Demos — real-use scenarios

Each folder under demos/ is a runnable scenario: a document in the tool's real input format plus a SCENARIO.md (where the data came from, the exact run command, and how to act on the result).

Demo	Situation	Key finding
01-basic	Good vs. defective memo, side by side	PORTION_EXCEEDS_BANNER
02-cui-control-block	CUI banner missing its control block	CUI_NO_CATEGORY
03-secret-noforn-clean	Correctly marked SECRET//NOFORN product	COMPLIANT
04-banner-mismatch	Top/bottom banners disagree	BANNER_MISMATCH
05-portions-absent	Classified doc with no portion markings	PORTIONS_ABSENT
06-banner-overmarked	Banner higher than any portion	BANNER_OVERMARKED
07-ci-batch-gate	Batch CI gate with --strict	exit-code gating
08-sarif-code-scanning	SARIF 2.1.0 → GitHub code scanning	inline PR annotations

Architecture

flowchart LR
  IN[capture / scan] --> P[classguard<br/>parse + map]
  P --> OUT[report]

Use it from any AI stack

classguard is interoperable with every popular way of using AI:

• MCP server — classguard mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)
• OpenAI-compatible / JSON — pipe classguard scan . --format json into any agent or LLM
• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line
• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

	Cognis classguard	typical tools
Self-hostable, no account	✅	varies
Single command, zero config	✅	⚠️
JSON + SARIF for CI	✅	varies
MCP-native (AI agents)	✅	❌
Polyglot ports (JS/Go/Rust)	✅	❌
Open license	✅ COCL	varies

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (classguard mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/classguard.git"    # pip (works today)
pipx install "git+https://github.com/cognis-digital/classguard.git"   # isolated CLI
uv tool install "git+https://github.com/cognis-digital/classguard.git" # uv
pip install cognis-classguard                                          # PyPI (when published)
docker run --rm ghcr.io/cognis-digital/classguard:latest --help        # Docker
brew install cognis-digital/tap/classguard                             # Homebrew tap
curl -fsSL https://raw.githubusercontent.com/cognis-digital/classguard/main/install.sh | sh

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/classguard	DEPLOY.md (AWS/Azure/GCP/k8s)

Related Cognis tools

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If classguard saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---