We built SecFoo so your AI coding agent can do a proper security review

Описание и применение

SecFoo стандартизирует проверки безопасности с помощью AI‑агентов, обеспечивая единый формат отчётов, отслеживание уязвимостей и интеграцию с CI.

Задача

AI coding agents lack consistent security review discipline, producing variable results and formats.

Результат

SecFoo delivers consistent, repeatable security reviews from AI agents, tracks findings, records cost, and integrates with CI, improving reliability and auditability of security checks.

Рабочий процесс

• 1. Install SecFoo via pip.
• 2. Run SecFoo specifying skills (e.g., sast, secret‑scanning), agent (e.g., claude), and target (local folder or GitHub URL).
• 3. SecFoo executes the chosen AI agent in read‑only mode, collects the report.
• 4. SecFoo parses the report into findings, severities, CWE/CVSS scores, and tracks them by code location.
• 5. Results are displayed in a local dashboard and can be used to gate CI with flags like --fail-on high or --max-cost 2.00.
• 6. SecFoo records cost, tracks findings over time, and allows risk decisions to be logged with approver and expiry.

Доказательства

Ask one to "check this repo for security issues" twice and you'll get two different answers, in two different formats, with no idea what was actually checked.

Источник

SecFoo is a command-line tool plus a local dashboard. You pick three things: What to check, What to check it on, Which agent does the work.

Источник

Each skill is a carefully written brief, not a rules engine. It tells the agent exactly what to look for, how to rate severity, and the precise report format to return: an executive summary, a findings register, detailed findings with evidence, and a remediation plan.

Источник

SecFoo's job is everything around that: Running the agent safely and non-interactively. Agents run in read-only mode where they support it, because a review should never change your code.

Источник

A real CI gate. --fail-on high and --max-cost 2.00 turn a scan into a pipeline check, and separate exit codes tell you whether the scan broke or the policy failed.

Источник

Wrapping AI agents in security tooling taught us one lesson above all: a scanner must never report "clean" when it couldn't actually look.

Источник