secfoo

Turn any AI coding agent into a disciplined security reviewer.
Same standards, same report, every run.

Website · Getting started · CLI · Docs

Point Claude Code, Cursor, Antigravity, Gemini CLI, or Codex at a target. Pick architecture review, threat modeling, SAST, and the rest of the catalog. Browse every result in a local dashboard — secfoo serve, on your machine.

pip install secfoo
secfoo run --skill sast --target https://github.com/org/repo --agent claude
secfoo serve

You need an agent CLI already installed and authenticated (--agent claude|agent|agy|gemini|codex), or an API key with the built-in api agent — see Install.

A 30-second look at the dashboard

Watch as MP4

Screenshots are from a real local secfoo serve against public vulnerable-app targets.

What you get

• A skill is a brief, not a parser. secfoo hands your coding agent a structured prompt and a target, then collects a report in a fixed shape.
• One dashboard for the program. Coverage, dispositions, STRIDE, design verdicts, and findings across every project you have scanned.
• Local first. Runs and secfoo serve stay on your machine. Optional secfoo cloud login syncs to an org portal that is not in this repo.
• Concurrent by default. Several --skill flags run at the same time.
• CI-ready. --fail-on high, --max-cost 2.00, --json, and distinct exit codes for "the scan broke" vs "policy failed". Details in docs/REFERENCE.md.

Activity catalog

Run one, or several together. What each report actually contains is in docs/REFERENCE.md.

Install

pip install secfoo                    # PyPI, Python 3.10+
npm install -g @rakfortltd/secfoo     # npm, no Python needed
docker run --rm ghcr.io/rakfortltd/secfoo --help

No agent CLI? Use an API key:

pip install "secfoo[api]"
export OPENAI_API_KEY=...             # or ANTHROPIC_API_KEY / GEMINI_API_KEY
secfoo run --skill sast --agent api --target https://github.com/org/repo

Universal install scripts, standalone binaries, CI flags, spend tracking, and configuration live in docs/REFERENCE.md. Developing this repo: pip install -e ".[dev]".

Learn more

• docs/REFERENCE.md — catalog, dashboards, assessments, config, distribution
• Getting started
• CLI reference
• Running an assessment
• Editions

Contributing

PRs welcome — see CONTRIBUTING.md and CODE_OF_CONDUCT.md. Security issues go through SECURITY.md, not a public issue.