# Rafter > Rafter is **security for your agents and the code they write** — an open-source CLI plus a hosted platform that pair traditional code analysis (SAST, SCA, secret scanning) with agent-first tooling so AI coding assistants can find and fix vulnerabilities themselves. Built for developers, agents, and security teams. Free to start; no API key required for local features. Rafter runs a curated stack of open-source and proprietary scanners against your code and returns a single, plain-language, prioritized, fix-oriented report. Output is structured for paste into AI coding assistants (Claude Code, Codex, Cursor, OpenClaw) for rapid remediation. The CLI is open source and exposes the same tools to any agent via stdout, exit codes, and an MCP server. ## Pick the right tier Three execution modes — pick by the question being asked. Stopping at `rafter secrets` and calling it a security review is the most common mistake. - **Local secrets** (`rafter secrets`) — offline, no account. Regex + gitleaks against files or directories. Detects API keys, tokens, credentials. **Not** a code-security scan. - **Remote scan, fast mode** (`rafter run` or `rafter run --mode fast`) — full SAST + SCA + secrets against a GitHub repo. Default. Requires `RAFTER_API_KEY`. - **Remote scan, plus mode** (`rafter run --mode plus`) — everything in fast plus agentic deep-dives. Slower, more thorough. Requires `RAFTER_API_KEY`. ## Surfaces - [Web dashboard](https://rafter.so/dashboard): One-click scanning for any public or private GitHub repo. Findings, severity, AI-ready fix suggestions. - [CLI quickstart](https://docs.rafter.so/quickstart): `rafter run` — terminal-driven remote scans, agent-first JSON or Markdown output, CI-friendly. - [REST API](https://docs.rafter.so/api-reference/introduction): Trigger scans and retrieve results programmatically. - [GitHub Action](https://github.com/Raftersecurity/rafter-cli): Drop `Raftersecurity/rafter-cli@v1` into any workflow for scans on push or PR. - [MCP server](https://docs.rafter.so/guides/agent-security/mcp-integration): `rafter mcp serve` exposes Rafter tools to any MCP-compatible agent over stdio. ## Installation - [npm](https://www.npmjs.com/package/@rafter-security/cli): `npm install -g @rafter-security/cli` (Node.js 18+) - [pip](https://pypi.org/project/rafter-cli/): `pip install rafter-cli` (Python 3.10+) - [GitHub source](https://github.com/Raftersecurity/rafter-cli): Open-source CLI repository — issues, releases, contribution guide. You're encouraged to raise issues, request features, and contribute via PRs! ## CLI command reference Verified against `rafter --help` at v0.7.7. **Scanning** - `rafter run [--mode fast|plus] [-r org/repo] [-b branch] [-f json|md]` — remote scan (SAST + SCA + secrets). Needs `RAFTER_API_KEY`. - `rafter secrets ` — local secret scanning, offline. Add `--staged` for pre-commit usage. - `rafter scan` — alias for `rafter run` for backward compat. - `rafter get [-f json|md] [--interactive]` — fetch results for a prior remote scan. - `rafter usage` — quota and API-key usage check. **Reporting and sharing** - `rafter report ` — render a standalone HTML report from scan results. - `rafter notify -w ` — post results to Slack or Discord. Auto-detects platform from URL. - `rafter issues create` — open GitHub Issues from scan findings or natural text. **Agent integration** - `rafter agent init` — wire up agent security (hooks, command interception, secret redaction) for the detected platform. - `rafter agent exec ` — run a command through the risk-tier approval layer. - `rafter agent audit` — view the audit log of agent tool/skill/extension usage. - `rafter agent baseline` — manage the findings baseline (allowlist for known issues). - `rafter agent status` / `rafter agent list` — inspect installed agent security components. - `rafter hook pretool` / `rafter hook posttool` — Claude Code hook handlers (read tool I/O on stdin, write decision/redaction on stdout). - `rafter mcp serve` — start the MCP server over stdio. **Skills, docs, policy, CI** - `rafter skill list|install|uninstall|review` — manage Rafter-authored skills; `review` audits any third-party skill, plugin, or extension before installing. - `rafter brief [topic]` — print Rafter knowledge for any agent (skills, commands, setup guides). Omit topic to list available briefs. - `rafter docs list|show` — repo-specific security docs declared in `.rafter.yml`. - `rafter policy export` — export Rafter policy for agent platforms. - `rafter ci init --platform ` — generate CI/CD pipeline config. Pass `-a` / `--agent` to any command for plain output (no colors/emoji) optimized for AI agent consumption. ## Documentation - [Technical docs](https://docs.rafter.so): Full CLI reference, guides, and API documentation. - [Quick start](https://docs.rafter.so/quickstart): First scan in under one minute. - [API reference](https://docs.rafter.so/api-reference/introduction): REST endpoints for scans and results. - [CI/CD guide](https://docs.rafter.so/guides/ci-cd): Auto-detection for GitHub Actions, GitLab CI, and CircleCI. - [Handbook](https://rafter.so/handbook): Scanner methodology, scope, and security best practices. - [Blog](https://rafter.so/blog): AI security, secret management, threat modeling, application security. - [Help center](https://rafter.so/help): Support, FAQ, contact. ## Core features - [Remote code analysis](https://docs.rafter.so/guides/basics): SAST + SCA + agentic deep-dives against any GitHub repo via CLI, API, or one-click dashboard. Returns structured JSON or Markdown reports. - [Secret scanning](https://docs.rafter.so/guides/agent-security/secret-scanning): Deterministic detection of 21+ secret patterns (API keys, tokens, credentials). Secrets redacted in all output. - [Command interception](https://docs.rafter.so/guides/agent-security/command-execution): Risk-tiered approval layer that wraps shell commands executed by AI agents (allow-all, approve-dangerous, deny-list). - [Pre-commit hooks](https://docs.rafter.so/guides/agent-security/getting-started): Native `pre-commit` integration via `rafter agent install-hook` — scans for secrets before every commit. - [Skill and extension auditing](https://docs.rafter.so/guides/agent-security/audit-log): Audit log of every tool, skill, and extension used by AI coding agents. `rafter skill review` vets third-party agent assets before installation. ## Rafter-authored skills Installable into Claude Code, Codex CLI, OpenClaw via `rafter skill install`. Inspect with `rafter skill list`. - **rafter** — entry-point skill. Routes security-relevant tasks to the right sub-skill or CLI invocation. - **rafter-secure-design** — design-time guardrail for features touching auth, payments, credentials, tokens, sessions, file upload, user data, or data deletion. - **rafter-code-review** — pre-merge security review. Walks OWASP/ASVS/MITRE questions the compiler and tests will not catch. - **rafter-skill-review** — required vet for any third-party SKILL.md, MCP manifest, Cursor rule, or agent config before installing or forwarding it. ## AI agent integrations - [Claude Code](https://docs.rafter.so/guides/agent-security/claude-code-integration): Auto-setup via `rafter agent init`. Adds `pretool`/`posttool` hooks for command interception and secret redaction. - [Codex CLI](https://docs.rafter.so/guides/agent-security/codex-integration): Command interception and secret scanning for OpenAI Codex CLI. - [OpenClaw](https://docs.rafter.so/guides/agent-security/openclaw-integration): Agent security for the OpenClaw coding environment. - [MCP](https://docs.rafter.so/guides/agent-security/mcp-integration): Model Context Protocol server (`rafter mcp serve`) for any MCP-compatible agent. - And support for many more on our docs! ## Pricing - [Pricing page](https://rafter.so/pricing): Free, Engineer, Pro, Enterprise. Paid tiers carry quotas across two scan modes — **Fast** (SAST/SCA/secrets and more) and **Plus** (Fast + agentic deep-dive); see the pricing page for the live feature list and per-mode quotas. - All CLI local features (secret scanning, command interception, pre-commit hooks, audit logging) are free and require no API key. - Free tier includes one-click web scanning of public and private repos plus site security audits (speed, SEO, accessibility, DNS). ## Security and privacy - No code leaves your machine unless you explicitly invoke the remote analysis engine. - Code submitted for remote analysis is deleted immediately after the engine completes. - Secrets are redacted in all output. Zero telemetry in local mode. - Source code available for audit at [github.com/Raftersecurity/rafter-cli](https://github.com/Raftersecurity/rafter-cli). - Report a vulnerability in Rafter itself: email **security@rafter.so** ([policy](https://github.com/Raftersecurity/rafter-cli/security/policy)). Do not open public issues for security reports. ## Optional - [About](https://rafter.so/about): Company background. Founded by Rome Thorstenson. - [Terms of service](https://rafter.so/terms) - [Privacy policy](https://rafter.so/privacy) - [California privacy](https://rafter.so/california-privacy)