I’ve been using AI coding agents heavily.
They make it ridiculously easy to go from:
“I have an idea”
to:
“I have a working application”
But while preparing for a cybersecurity interview, I realized I had a problem.
I was getting faster at building software.
I wasn’t getting equally systematic at checking the software I was building.
So I built something.
Meet J.A.R.V.I.S. Framework.
GitHub: https://github.com/SREEGEETHES/J.A.R.V.I.S-framework
What is JARVIS?
JARVIS is a universal audit and diagnostic framework for AI coding agents.
The idea is to make an AI agent follow a structured engineering protocol instead of casually reviewing a project and saying:
“Looks good.”
The current framework has 158 checks.
70 security checks
The House Party Protocol covers things like:
Secrets
Authentication
Authorization
SQL injection
XSS
SSRF
IDOR
CSRF
CORS
Secure cookies
AI security
CI/CD security
46 web launch checks
Drop My Needle looks at:
Performance
Accessibility
Legal requirements
UX
Asset optimization
Forms
Error pages
Launch configuration
42 deployment checks
Prepare for Landing checks:
Git hygiene
Environment files
Dependencies
Build readiness
Health checks
Logging
Rollback preparation
Operational readiness
The important part: No Fake Pass
This is probably my favorite part of the framework.
AI can be very confident.
That doesn’t mean it is correct.
So I created a simple rule:
No evidence = No PASS
If JARVIS can’t prove that a security control exists in the code, it shouldn’t mark the check as passed.
The audit uses:
PASS
FAIL
WAITING_AUTH
This makes the agent focus on evidence instead of assumptions.
Four phases
Every major protocol follows:
Discovery
↓
Audit
↓
Remediation
↓
Reporting
Discovery
Inspect the repository and identify relevant code and configuration.
Audit
Run the defined controls and collect evidence.
Remediation
Safe code issues can be fixed automatically.
High-impact changes require human approval.
Reporting
Results are persisted in:
.jarvis/STATE.md
So the audit doesn’t disappear when the AI session ends.
Why human authorization?
I don’t want an AI agent to interpret:
“Fix everything”
as permission to modify production infrastructure.
Some changes are fundamentally different from editing a source file.
Changing:
Cloud infrastructure
Production credentials
Databases
Billing configuration
External services
should have a human checkpoint.
That’s why JARVIS has a separate human authorization mode.
And yes, the name is from Iron Man
I’m a huge Iron Man fan.
When I started this project, I wanted the experience to feel like having a technical co-pilot beside me.
So JARVIS became the perfect name.
But underneath the theme, the idea is pretty simple:
Build fast with AI, but don’t skip the engineering checks.
Supported environments
The framework is designed to work across multiple AI coding environments, including:
Antigravity
OpenCode
Claude Code
Cursor
Windsurf
Cline / Roo Code
The repository includes both global and project-level installation options.
What I’m hoping to learn
This is still an evolving project.
I’m particularly interested in where this idea goes as AI coding agents become more capable.
Can structured protocols make agents more reliable?
Can persistent audit state make AI-assisted development easier to review?
Can we automate more security checks without giving agents too much authority?
That’s what I’m experimenting with.
If you’re building with AI coding agents, I’d love to know how you’re handling security in your workflow.
GitHub: https://github.com/SREEGEETHES/J.A.R.V.I.S-framework
Top comments (0)