Your AI coding agent is a security reviewer. It just needs a brief.

Srikanth Vuppala — Wed, 23 Sep 2026 20:59:24 +0000

Ask Claude Code, Cursor or Gemini CLI to "review this repo for security issues" twice, and you'll get two different answers in two different shapes. The review itself can be good. But you can't compare runs, track a finding across releases, or show an auditor what "passed" means.

We built secfoo (MIT) to fix that. It doesn't replace your agent. It gives the agent a disciplined brief and holds the output to a fixed contract.

The idea: skills, not rules

Most security scanners are rules engines. secfoo takes a different approach. A skill is a structured prompt that defines the activity, the method, and the exact shape of the report. secfoo gives the skill and a target to the coding-agent CLI you already have on your PATH, and the agent reads the code the way a human reviewer would.

Supported agents: Claude Code, Cursor, Antigravity, Gemini CLI and Codex CLI (--agent claude|agent|agy|gemini|codex).

Quick start

pip install secfoo
secfoo run --skill security-architecture-review --agent claude

Run several activities at once. They execute concurrently:

secfoo run --skill sast --skill threat-modeling \
  --target https://github.com/org/repo --agent claude

Then browse every assessment, across every project, locally:

secfoo serve

Prefer not to use Python? npm install -g @rakfortltd/secfoo or docker run --rm ghcr.io/rakfortltd/secfoo --help.

What's in the catalog

Activity	Skill ID
Security Architecture Review	`security-architecture-review`
Threat Modeling (STRIDE + LINDDUN)	`threat-modeling`
SAST	`sast`
SCA reachability & upgrade triage	`sca-reachability`
Secret scanning (code, git history, Confluence)	`secret-scanning`
Prompt review (LLM prompts & agent tools)	`prompt-review`
Deployment readiness	`deployment-readiness`
Responsible AI compliance	`responsible-ai-compliance`

Three design choices we'd make again

1. One case file per system. Repeat runs are grouped under the same application ID. Findings move between Open and Closed as you rescan, so they don't pile up in a new report each time.

2. Local-first. Runs, reports and the dashboard stay on your machine. You don't need an account for your first scan.

3. Honest about what a report can support. If a report can't back up a number, the dashboard shows zeros or hatching rather than guessing.

No agent CLI? Use an API key (good for CI)

pip install "secfoo[api]"
export ANTHROPIC_API_KEY=...   # or OPENAI_API_KEY / GEMINI_API_KEY
secfoo run --skill sast --agent api --target https://github.com/org/repo

The built-in api agent is a LangGraph workflow routed through LiteLLM. Keys are read from the environment and never stored. It works best on small and medium repos, because the whole target goes in one request.

Know what the AI review cost

secfoo cost                 # by agent

secfoo cost --by skill --since 2026-09-01

Try it and tell us what breaks

GitHub: https://github.com/secfoo-com/secfoo
Docs & install: https://www.secfoo.com
Contributing: see CONTRIBUTING.md. Security issues go through SECURITY.md.

We'd especially value feedback on the skill format. If you write a skill for an activity we don't cover yet, open a PR.

DEV Community: Srikanth Vuppala