opencomplai
EU AI Act compliance checks for local repos and CI
TLDR
SYNOPSIS
opencomplai command [options]
DESCRIPTION
opencomplai is the command-line front end of OpenComplAI, an open-core toolkit that turns EU AI Act obligations into machine-readable, CI-gateable checks. pip install opencomplai installs the meta-package (CLI + opencomplai-core + Python SDK). The console script is also provided by opencomplai-cli. Python 3.11+ is required. There is no --version flag; use opencomplai --help.Typical flow: scan --quick to see whether the tree looks like it touches AI, init to write system-manifest.json and create ~/.opencomplai/ (Ed25519 signing keypair + config.yaml on first run), then check to evaluate controls and write compliance-artifact.json. The scanner corroborates a declared intended_purpose against code signals; it never auto-classifies risk. Finding no AI is not a pass.check is the contractual CI gate. Exit codes: 0 PASS, 1 CONTROLFAIL, **2** VALIDATIONFAIL, 3 POLICYBLOCK, **4** TRAPDETECTED. TRAP_DETECTED is raised only in service-backed mode (Docker stack / OPENCOMPLAI_API_URL), not by the local engine. Optional --sample-set runs lexical safety, bias, and data-leakage evaluators on an EvalSampleSet JSON whose system_id matches the manifest.Classification in the core engine is deterministic and rule-based. Optional opencomplai scan --ai-intent (plugin opencomplai-ai) adds a local model pass over extracted callsites. A GitHub/GitLab pre-commit hook and .ocignore scan config are supported. Community Edition is AGPL-3.0.
PARAMETERS
-m, --manifest file
Manifest path (default system-manifest.json) on scan/check.--scan-mode local|ci|airgap
How check runs. Default local.--fail-on policy
scan CI gating. Default none. Non-empty scan_errors fail when this is not none.--sign / --no-sign
Sign the check artifact with ~/.opencomplai/signing.key. Default --no-sign.
CONFIGURATION
~/.opencomplai/
Install id, config.yaml, and Ed25519 signing key created by init..ocignore
Per-repo scan limits and ignore rules (bootstrapped on first scan unless disabled). Defaults refuse symlinks, cap files at 1 MiB / 20 000 files / 200 MiB total.OPENCOMPLAI_API_URL
When set, check talks to the gateway (service-backed mode) instead of the local engine.OPENCOMPLAI_DOCS_URL
Override the URL opened by opencomplai checker --web.
COMMANDS
init --system-id id --intended-purpose text [options]
Write system-manifest.json (override with -o). --interactive runs the applicability checker first. First run also creates ~/.opencomplai/.scan [--quick path] [--manifest file] [--repo-root dir] [--fail-on none|new-major|major|critical] [--output human|json] [--ai-intent]
Corroborate the manifest against the tree, or run discovery-only with --quick (always exit 0, no artifact). JSON output is a versioned envelope, not the signed check artifact.check [-m manifest] [--commit-ref ref] [--scan-mode local|ci|airgap] [--sample-set file] [--sign] [-o human|json]
Full compliance gate. Always writes compliance-artifact.json in the current directory.checker [--web] [--local] [--answers file] [-o human|json] [--export-json|--export-md|--export-pdf|--export-all path] [--write-manifest file]
EU AI Act applicability wizard (checker version documented upstream). --web opens the hosted docs page; --web --local serves an offline copy.dashboard
Premium dashboard enrollment and sync (Enterprise). See opencomplai dashboard --help.
CAVEATS
Results are informational, not legal advice; OpenComplAI is not affiliated with the European Union. The scanner treats the manifest as authoritative. scan --quick cannot fail a build. scan --output json is not the signed ScanStatusArtifact. --ai-intent needs opencomplai-ai and a downloaded local model. Hostile-repo defaults skip symlinks and oversized files.
SEE ALSO
pip(1), pre-commit(1)
