Secfoo - Everyone's a security professional.

Secfoo turns any AI coding agent into a disciplined security reviewer — same standards, same report, every run. Context-based security architectural assessment orchestrator: pick skills, targets, and an agent CLI to run them.

Website · Getting Started · CLI Reference · Documentation

Pick one or more security activities (see the catalog below), point them at a target (a public GitHub URL, a local directory, plus optional Confluence links for extra context), choose which coding-agent CLI runs them (Claude Code, Cursor, Antigravity, Gemini CLI, or Codex CLI), and browse every assessment ever run, across every project, in a local web dashboard.

This repository is the open-source CLI and local dashboard. secfoo's enterprise portal (multi-tenant cloud sync, admin console) is closed-source and lives in a separate private repository — secfoo cloud login connects this CLI to it, but nothing about the portal itself is in this repo.

Quick Start

Requires Python 3.10+ for pip install — or skip Python entirely with npm, a standalone binary, or Docker (see Install below).

pip install secfoo
secfoo run --skill security-architecture-review --agent claude

You'll need an agent CLI already installed and authenticated — Claude Code, Cursor, Antigravity, Gemini CLI, or Codex CLI (--agent claude|agent|agy|gemini|codex) — or just a model API key with the built-in api agent (below). On a real terminal, that first run prompts for a project name and application ID, then browse every result in the dashboard:

secfoo run --skill sast --skill threat-modeling \
  --target https://github.com/org/repo --agent claude
secfoo serve

No agent CLI? Use an API key

The built-in api agent is a LangGraph workflow that sends the target's source to OpenAI, Anthropic or Gemini through LiteLLM — no coding-agent CLI needed, which suits CI. Keys are read from the environment only and never stored:

pip install "secfoo[api]"
export OPENAI_API_KEY=...            # or ANTHROPIC_API_KEY / GEMINI_API_KEY
export SECFOO_API_MODEL=openai/gpt-4.1-mini   # optional; any LiteLLM model id
secfoo run --skill sast --agent api --target https://github.com/org/repo

It suits small and medium repositories: the whole target has to fit in one request, and larger ones are rejected with a message suggesting --exclude.

Tracking AI spend

Every run records tokens and cost where the agent reports them (api, claude; gemini reports tokens only). See it per run in secfoo run, secfoo list and the dashboard, or summarised:

secfoo cost                          # by agent
secfoo cost --by skill --since 2026-09-01
secfoo cost --project checkout

Secfoo also includes a built-in LangGraph agent whose model calls are routed through LiteLLM. Configure the provider key and model in the environment; credentials are never stored in the repository:

$env:OPENAI_API_KEY = "your-key"
$env:SECFOO_MODEL = "openai/gpt-4o-mini"
secfoo run --skill security-architecture-review --agent secfoo

LiteLLM-reported spend is stored per run and can be reviewed from the dashboard or queried from the CLI:

secfoo cost
secfoo cost --project "Checkout Service"

See Getting Started or the CLI reference for more.

What can you do with secfoo?

• Review architecture and threat-model a system against secure design principles, STRIDE/LINDDUN, and CSA CCM v4 domain conformance
• Find code and dependency vulnerabilities — SAST and SCA reachability triage, tracked as an Open/Closed Findings register across rescans, not just a one-off report
• Catch exposed credentials across source, config, git history, and linked Confluence pages
• Review LLM prompts and agent tool definitions for injection and over-permissioning risk
• Track third-party/vendor risk with AI-BOM inventories and a dedicated third-party review workflow
• Run it in CI, non-interactively, with the same commands you'd use locally
• Browse every assessment across every project in a local dashboard, or sync to your org's enterprise portal

Why secfoo?

• Agent-native, not another parser: a skill is a structured prompt, not a bespoke rules engine — secfoo hands your existing coding-agent CLI a brief and a target and lets it actually read the code, the way a human reviewer would.
• Local-first: secfoo serve and every run stay on your machine unless you explicitly connect secfoo cloud login to your org's portal.
• One case file per system: assessments consolidate repeat runs under the same application ID instead of fragmenting into a new record every rescan.
• Concurrent by default: multiple --skill flags run at the same time, not one after another.
• Bring your own agent: Claude Code, Cursor, Antigravity, Gemini CLI, or Codex CLI — pick whichever you already use and trust.
• Open source CLI: MIT licensed.

Activity catalog

Run one, or several together — multiple --skill flags execute concurrently against the same target. Each has its own report shape and program-level dashboard; see docs/REFERENCE.md for what each one actually produces, plus assessments, configuration, and install/distribution details.

Install

pip install secfoo               # PyPI, needs Python 3.10+
npm install -g @rakfortltd/secfoo    # npm, no Python needed
docker run --rm ghcr.io/rakfortltd/secfoo --help

Also available via a universal install script (macOS/Linux/Windows) and as standalone platform binaries — see docs/REFERENCE.md#install for every channel. Developing on this repo instead? pip install -e ".[dev]".

Learn More

• docs/REFERENCE.md — full activity catalog, dashboards, assessments, configuration, distribution
• Getting Started
• Full Documentation
• CLI Reference
• Running an assessment
• Excluding paths from a scan
• Rendering architecture diagrams
• Connecting agent CLIs (MCP)
• Editions & pricing

Contributing

We welcome contributions — see CONTRIBUTING.md to get started, and CODE_OF_CONDUCT.md for community expectations. Found a security issue? See SECURITY.md instead of opening a public issue.