Most AI security tools lock you into one agent. We didn't.

说明与用途

SecFoo 通过统一输出合同和适配器，支持多 AI 代理的一致安全评估。

问题

Security reviews with AI coding agents produce inconsistent outputs across agents, making comparison and tracking difficult.

结果

SecFoo enables consistent, agent-agnostic security reviews by normalizing output contracts and handling diverse agent integrations through adapters.

工作流

• Resolve the target (local path or shallow GitHub clone)
• Detect the stack (languages and frameworks)
• Render the prompt (safety preamble, skill instructions, output contract)
• Run the agent via an adapter (CLI or API) with timeout and process-tree kill
• Capture report, prompt, logs, and token/cost figures
• Parse findings using the fixed contract and compute CVSS scores

证据

Most agentic security tools deal with this by picking one agent and building around it.

来源

SecFoo handles this with an adapter layer.

来源

Every skill has a fixed output contract: a required "Overall risk rating:" line, and "### [SEVERITY] ID: title" headings for every finding.

来源