Usage Examples

Practical examples using Cadence with AI analysis (OpenAI and Anthropic)

AI Examples

Practical examples for using Cadence with AI analysis via OpenAI or Anthropic.

Basic Usage

Simple Repository Analysis

Bash
# Set up API key
export CADENCE_AI_ENABLED=true
export CADENCE_AI_PROVIDER=openai
export CADENCE_AI_KEY=sk-proj-your-key-here

# Run analysis with AI
cadence analyze ./my-project -o report.txt --config .cadence.yaml

Without AI

Bash
# Disable AI analysis
export CADENCE_AI_ENABLED=false
cadence analyze ./my-project -o report.txt --config .cadence.yaml

Model Selection

OpenAI (Default: gpt-4o-mini)

Bash
export CADENCE_AI_ENABLED=true
export CADENCE_AI_PROVIDER=openai
export CADENCE_AI_KEY=sk-proj-...

# Uses gpt-4o-mini by default
cadence analyze ./repo -o report.txt

# Or use GPT-4 for critical code
export CADENCE_AI_MODEL=gpt-4
cadence analyze ./security-critical-code -o critical-report.txt

Anthropic (Default: claude-sonnet-4-20250514)

Bash
export CADENCE_AI_ENABLED=true
export CADENCE_AI_PROVIDER=anthropic
export CADENCE_AI_KEY=sk-ant-...

# Uses claude-sonnet-4-20250514 by default
cadence analyze ./repo -o report.txt

Output Formats

JSON Report with AI Insights

Bash
export CADENCE_AI_ENABLED=true
export CADENCE_AI_KEY=sk-proj-...

cadence analyze ./repo -o report.json --config .cadence.yaml

Text Report

Bash
cadence analyze ./repo -o report.txt --config .cadence.yaml

Includes AI findings in the HIGH/MEDIUM/LOW SEVERITY sections for each flagged detection.

Multiple Repositories

Batch Analysis

Bash
#!/bin/bash
export CADENCE_AI_ENABLED=true
export CADENCE_AI_KEY=sk-proj-...

repos=("repo1" "repo2" "repo3")

for repo in "${repos[@]}"; do
  echo "Analyzing $repo..."
  cadence analyze "./$repo" -o "report-$repo.json" --config .cadence.yaml
done

Analyze Changed Files Only

Bash
export CADENCE_AI_KEY=sk-proj-...

for repo in $(find . -maxdepth 2 -name ".git" -type d); do
  repo_dir=$(dirname "$repo")
  echo "Analyzing $repo_dir..."
  cadence analyze "$repo_dir" -o "report-$(basename $repo_dir).txt" --config .cadence.yaml
done

CI/CD Integration

GitHub Actions

YAML
name: Cadence AI Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  cadence:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0  # Full history for analysis

      - name: Install Go
        uses: actions/setup-go@v4
        with:
          go-version: '1.24'

      - name: Install Cadence
        run: go install github.com/TryCadence/Cadence/cmd/cadence@latest

      - name: Create config
        run: cadence config init

      - name: Run Cadence Analysis
        env:
          CADENCE_AI_ENABLED: true
          CADENCE_AI_PROVIDER: openai  # or "anthropic"
          CADENCE_AI_KEY: ${{ secrets.CADENCE_AI_KEY }}
          CADENCE_AI_MODEL: gpt-4o-mini
        run: |
          cadence analyze . \
            --output report.json \
            --config .cadence.yaml \
            --suspicious-additions 500 \
            --max-additions-pm 100

      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: cadence-report
          path: reports/report.json

      - name: Comment on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v6
        with:
          script: |
            const fs = require('fs');
            const report = JSON.parse(fs.readFileSync('reports/report.json', 'utf8'));
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `🔍 Cadence Analysis: Score ${report.overallScore.toFixed(1)} — ${report.assessment}`
            });

GitLab CI

YAML
cadence_analysis:
  image: golang:1.24
  script:
    - go install github.com/TryCadence/Cadence/cmd/cadence@latest
    - cadence analyze ./src --output report.json --config .cadence.yaml
  artifacts:
    paths:
      - reports/report.json
    expire_in: 30 days
  only:
    - merge_requests
    - main
  variables:
    CADENCE_AI_ENABLED: "true"
    CADENCE_AI_PROVIDER: "openai"  # or "anthropic"
    CADENCE_AI_KEY: $CADENCE_AI_KEY

Webhook Integration

With Cadence Webhook Server

Bash
# Start webhook server with AI enabled
export CADENCE_AI_ENABLED=true
export CADENCE_AI_KEY=sk-proj-...

cadence webhook --port 8000 --secret your-webhook-secret

The webhook server automatically applies AI analysis to all received push events when AI is enabled. Results are also available via SSE streaming at /api/stream/repository and /api/stream/website.

Configuration Files

.cadence.yaml with AI

YAML
thresholds:
  suspicious_additions: 500
  suspicious_deletions: 1000
  max_additions_per_min: 100
  max_deletions_per_min: 500
  min_time_delta_seconds: 60

ai:
  enabled: true
  provider: "openai"            # or "anthropic"
  model: ""                     # Leave empty for provider default

webhook:
  enabled: true
  port: 8000
  secret: your-webhook-secret

Run with Config File

Bash
export CADENCE_AI_KEY=sk-proj-...
cadence analyze ./repo -o report.json --config .cadence.yaml

Cost-Effective Workflows

Two-Tier Analysis

Combine models for efficiency:

Bash
#!/bin/bash
export CADENCE_AI_KEY=sk-proj-...

# Phase 1: Quick scan with cheaper model
echo "Phase 1: Quick scan..."
export CADENCE_AI_MODEL=gpt-4o-mini
cadence analyze ./repo --output quick-scan.json --config .cadence.yaml

# Phase 2: Deep dive on flagged areas with better model
echo "Phase 2: Deep analysis..."
export CADENCE_AI_MODEL=gpt-4
cadence analyze ./flagged-sections --output detailed-scan.json --config .cadence.yaml

Disable AI for Known-Good Code

Bash
# Skip AI on vendor/dependencies
export CADENCE_AI_ENABLED=false
cadence analyze ./node_modules -o report.txt --config .cadence.yaml

# Enable for source code
export CADENCE_AI_ENABLED=true
export CADENCE_AI_KEY=sk-proj-...
cadence analyze ./src -o report.txt --config .cadence.yaml

Troubleshooting

Verify Configuration

Bash
# Check if keys are set
echo $CADENCE_AI_KEY
echo $CADENCE_AI_PROVIDER

Test API Connection

Bash
# OpenAI test
curl -X POST https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer $CADENCE_AI_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [{"role": "user", "content": "Hello"}],
    "max_tokens": 10
  }' | jq .

# Anthropic test
curl -X POST https://api.anthropic.com/v1/messages \
  -H "x-api-key: $CADENCE_AI_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-4-20250514",
    "max_tokens": 10,
    "messages": [{"role": "user", "content": "Hello"}]
  }' | jq .

Handle Rate Limiting

Bash
#!/bin/bash
retry_with_backoff() {
  local max_attempts=3
  local timeout=1
  local attempt=1

  while [ $attempt -le $max_attempts ]; do
    if cadence analyze ./repo -o report.json --config .cadence.yaml 2>/dev/null; then
      return 0
    fi
    echo "Attempt $attempt failed, retrying in ${timeout}s..."
    sleep $timeout
    timeout=$((timeout * 2))
    attempt=$((attempt + 1))
  done

  return 1
}

retry_with_backoff

Next Steps