Most AI security tools lock you into one agent. We didn't.

Description and use

SecFoo enables consistent security reviews across multiple AI agents by normalizing output contracts and using adapters for agent integration.

Problem

Security reviews with AI coding agents produce inconsistent outputs across agents, making comparison and tracking difficult.

Outcome

SecFoo enables consistent, agent-agnostic security reviews by normalizing output contracts and handling diverse agent integrations through adapters.

Workflow

• Resolve the target (local path or shallow GitHub clone)
• Detect the stack (languages and frameworks)
• Render the prompt (safety preamble, skill instructions, output contract)
• Run the agent via an adapter (CLI or API) with timeout and process-tree kill
• Capture report, prompt, logs, and token/cost figures
• Parse findings using the fixed contract and compute CVSS scores

Evidence

Most agentic security tools deal with this by picking one agent and building around it.

Source

SecFoo handles this with an adapter layer.

Source

Every skill has a fixed output contract: a required "Overall risk rating:" line, and "### [SEVERITY] ID: title" headings for every finding.

Source