sechelix

Optional execution runtime for the SecHelix AppSec Agent Skill.

The Agent Skill is the product and works without this package. Install sechelix when you want the workflow orchestrated by code instead of by an agent reading SKILL.md.

pipx install sechelix     # or: uv tool install sechelix
sechelix doctor
sechelix audit .

What it does

a deterministic reasoner DAG over 18 node roles, with cycle rejection
per-node telemetry: model, provider, tokens, cost, duration, context digest
a budget governor that fails closed — running out before a required verification produces INCOMPLETE, never a clean gate
least-context specialist views, so a dependency reasoner never sees the whole repository narrative
a coverage ledger that records what previous runs did not examine
replayable run workspaces with tamper detection

The first run will say INCOMPLETE

That is correct. The runner orchestrates; it does not reason about code. With no reasoning executor configured every specialist lane is BLOCKED and the run reports No security claim can be made from this run.

A stub returning "no findings" would be indistinguishable from a genuine clean audit, and a fail-closed gate would hand out a PASS for a run that examined nothing. To actually analyse code, select an already-authenticated supported CLI on PATH:

sechelix audit . --executor claude-code
sechelix audit . --executor gemini-cli

SecHelix invokes the official CLIs; it does not read or reuse their OAuth/API credentials. Each node is isolated, and provider quota/errors remain fail-closed.

No dependencies

The runner uses the standard library only, and a test asserts it. A security tool that drags in a dependency tree has widened the attack surface of the thing it was installed to protect.

Status

Alpha. Nothing here has been measured against another tool, and no comparative claim is made. See the repository for what is measured and what is not.

Repository: https://github.com/omarmohelal/SecHelix
Quickstart: https://github.com/omarmohelal/SecHelix/blob/main/docs/v4-quickstart.md
Licence: Apache-2.0

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sechelix-0.2.0.tar.gz (397.4 kB view details)

Uploaded Sep 4, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

sechelix-0.2.0-py3-none-any.whl (406.9 kB view details)

Uploaded Sep 4, 2026 Python 3

File details

Details for the file sechelix-0.2.0.tar.gz.

File metadata

Download URL: sechelix-0.2.0.tar.gz
Upload date: Sep 4, 2026
Size: 397.4 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for sechelix-0.2.0.tar.gz
Algorithm	Hash digest
SHA256	`9649355947ae9be8bbb3912b6dfa24c3f6467e14613b779efbf1cd2f96296f9e`
MD5	`72d3f3a8f1614a61678d4e4714d0a78b`
BLAKE2b-256	`d479cd2f6d07ad28dac0284607d35063649bf41e94d33757e8d650e04906c04f`

See more details on using hashes here.

Provenance

The following attestation bundles were made for sechelix-0.2.0.tar.gz:

Publisher: publish-pypi.yml on omarmohelal/SecHelix

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: sechelix-0.2.0.tar.gz
- Subject digest: 9649355947ae9be8bbb3912b6dfa24c3f6467e14613b779efbf1cd2f96296f9e
- Sigstore transparency entry: 2708833568
- Sigstore integration time: Sep 4, 2026
Source repository:
- Permalink: omarmohelal/SecHelix@dce1dae7ffe8c84b5da7616f2b7d5b614684f017
- Branch / Tag: refs/heads/main
- Owner: https://github.com/omarmohelal
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish-pypi.yml@dce1dae7ffe8c84b5da7616f2b7d5b614684f017
- Trigger Event: push