SecureVibes Scanner
AI-native security platform that detects vulnerabilities using Claude AI. Multi-subagent pipeline: assessment → threat modeling → code review → report generation → optional DAST.
Prerequisites
- Install the CLI:
pip install securevibes
- Set your Anthropic API key:
export ANTHROPIC_API_KEY=your-key-here
Security Notes
- Always use the
scripts/scan.sh wrapper — it validates paths and rejects shell metacharacters before invoking securevibes.
- Never interpolate unsanitized user input into shell commands. The wrapper uses
realpath to resolve paths safely and rejects any path containing ;, |, &, $, backticks, or other metacharacters.
- Scan targets must be local directories. Clone remote repos to a known safe location first, then pass the resolved path to the wrapper.
- DAST scans make network requests to the
--target-url you provide. Only use against apps you own or have permission to test.
Execution Model
Scans take 10-30 minutes across 4 phases. Run them as background jobs (cron or subagent), not inline.
Running a Scan
- Clone the target repo to a local directory
- Run the wrapper script:
bash scripts/scan.sh /path/to/repo --force --debug
- Results appear in
/path/to/repo/.securevibes/
Background Execution (Recommended)
For OpenClaw users, schedule scans as cron jobs:
- Use
sessionTarget: "isolated" with payload.kind: "agentTurn"
- Set
payload.timeoutSeconds: 2700 (45 minutes) to allow all phases to complete
- Use
delivery.mode: "announce" to get notified when done
The agentTurn message should instruct the subagent to:
cd into the repo and git pull for latest code- Clean previous
.securevibes/ artifacts
- Run
securevibes scan . --force via the wrapper script
- Read and summarize the results from
.securevibes/scan_report.md
Where to store results, how to diff against previous runs, and notification routing are left to your agent's configuration.
Commands Reference
Scan
securevibes scan <path> [options]
| Option |
Description |
-f, --format |
markdown (default), json, text, table |
-o, --output |
Custom output path |
-s, --severity |
Filter: critical, high, medium, low |
-m, --model |
Claude model (e.g., sonnet, haiku for cheaper/faster) |
--subagent |
Run one phase only: assessment, threat-modeling, code-review, report-generator, dast |
--resume-from |
Resume from a specific phase onwards |
--dast |
Enable dynamic testing (requires --target-url) |
--target-url |
URL for DAST (e.g., http://localhost:3000) |
--force |
Skip prompts, overwrite existing artifacts |
--quiet |
Minimal output |
--debug |
Verbose diagnostics |
Report
securevibes report <path>
Display a previously saved scan report.
Mapping Requests to Scan Args
| User Says |
Scan Args |
| "Scan this for security issues" |
--force |
| "Quick security check" |
-m haiku --force |
| "Threat model this project" |
--subagent threat-modeling --force |
| "Just review the code" |
--subagent code-review --force |
| "Show only critical/high findings" |
-s high --force |
| "Full audit with DAST" |
--dast --target-url <url> --force |
| "Output as JSON" |
-f json -o results.json --force |
| "Resume from code review" |
--resume-from code-review --force |
| "Show last scan results" |
Use securevibes report <path> (no cron needed) |
Subagent Pipeline
Runs sequentially. Each phase builds on the previous:
- assessment → Architecture & attack surface mapping →
.securevibes/SECURITY.md
- threat-modeling → STRIDE-based threat analysis →
.securevibes/THREAT_MODEL.json
- code-review → Line-by-line vulnerability detection →
.securevibes/VULNERABILITIES.json
- report-generator → Consolidated findings report →
.securevibes/scan_report.md
- dast (optional) → Dynamic validation against running app
Presenting Results
After a scan completes:
- Read
.securevibes/scan_report.md (or .securevibes/scan_results.json for structured data)
- Summarize: total findings by severity (Critical > High > Medium > Low)
- Highlight top 3 most critical with file locations and remediation
- Offer next steps: run DAST, fix specific issues, re-scan after changes
Links
1---2name: securevibes-scanner3description: Run AI-powered application security scans on codebases. Use when asked to scan code for security vulnerabilities, generate threat models, review code for security issues, validate findings, suggest fixes, or verify remediations. Triggers on security scan, threat model, security review, vulnerability assessment, code audit, or AppSec-related requests targeting a project or repository.4---56# SecureVibes Scanner78AI-native security platform that detects vulnerabilities using Claude AI. Multi-subagent pipeline: assessment → threat modeling → code review → report generation → optional DAST.910## Prerequisites11121. Install the CLI:13 ```bash14 pip install securevibes15 ```162. Set your Anthropic API key:17 ```bash18 export ANTHROPIC_API_KEY=your-key-here19 ```2021## Security Notes2223- **Always use the `scripts/scan.sh` wrapper** — it validates paths and rejects shell metacharacters before invoking `securevibes`.24- **Never interpolate unsanitized user input into shell commands.** The wrapper uses `realpath` to resolve paths safely and rejects any path containing `;`, `|`, `&`, `$`, backticks, or other metacharacters.25- **Scan targets must be local directories.** Clone remote repos to a known safe location first, then pass the resolved path to the wrapper.26- **DAST scans make network requests** to the `--target-url` you provide. Only use against apps you own or have permission to test.2728## Execution Model2930**Scans take 10-30 minutes across 4 phases.** Run them as background jobs (cron or subagent), not inline.3132### Running a Scan33341. **Clone the target repo** to a local directory352. **Run the wrapper script:**36 ```bash37 bash scripts/scan.sh /path/to/repo --force --debug38 ```393. **Results appear in** `/path/to/repo/.securevibes/`4041### Background Execution (Recommended)4243For OpenClaw users, schedule scans as cron jobs:44- Use `sessionTarget: "isolated"` with `payload.kind: "agentTurn"`45- Set `payload.timeoutSeconds: 2700` (45 minutes) to allow all phases to complete46- Use `delivery.mode: "announce"` to get notified when done4748The agentTurn message should instruct the subagent to:491. `cd` into the repo and `git pull` for latest code502. Clean previous `.securevibes/` artifacts513. Run `securevibes scan . --force` via the wrapper script524. Read and summarize the results from `.securevibes/scan_report.md`5354Where to store results, how to diff against previous runs, and notification routing are left to your agent's configuration.5556## Commands Reference5758### Scan59```bash60securevibes scan <path> [options]61```6263| Option | Description |64|--------|-------------|65| `-f, --format` | `markdown` (default), `json`, `text`, `table` |66| `-o, --output` | Custom output path |67| `-s, --severity` | Filter: `critical`, `high`, `medium`, `low` |68| `-m, --model` | Claude model (e.g., `sonnet`, `haiku` for cheaper/faster) |69| `--subagent` | Run one phase only: `assessment`, `threat-modeling`, `code-review`, `report-generator`, `dast` |70| `--resume-from` | Resume from a specific phase onwards |71| `--dast` | Enable dynamic testing (requires `--target-url`) |72| `--target-url` | URL for DAST (e.g., `http://localhost:3000`) |73| `--force` | Skip prompts, overwrite existing artifacts |74| `--quiet` | Minimal output |75| `--debug` | Verbose diagnostics |7677### Report78```bash79securevibes report <path>80```81Display a previously saved scan report.8283## Mapping Requests to Scan Args8485| User Says | Scan Args |86|-----------|-----------|87| "Scan this for security issues" | `--force` |88| "Quick security check" | `-m haiku --force` |89| "Threat model this project" | `--subagent threat-modeling --force` |90| "Just review the code" | `--subagent code-review --force` |91| "Show only critical/high findings" | `-s high --force` |92| "Full audit with DAST" | `--dast --target-url <url> --force` |93| "Output as JSON" | `-f json -o results.json --force` |94| "Resume from code review" | `--resume-from code-review --force` |95| "Show last scan results" | Use `securevibes report <path>` (no cron needed) |9697## Subagent Pipeline9899Runs sequentially. Each phase builds on the previous:1001011. **assessment** → Architecture & attack surface mapping → `.securevibes/SECURITY.md`1022. **threat-modeling** → STRIDE-based threat analysis → `.securevibes/THREAT_MODEL.json`1033. **code-review** → Line-by-line vulnerability detection → `.securevibes/VULNERABILITIES.json`1044. **report-generator** → Consolidated findings report → `.securevibes/scan_report.md`1055. **dast** (optional) → Dynamic validation against running app106107## Presenting Results108109After a scan completes:1101. Read `.securevibes/scan_report.md` (or `.securevibes/scan_results.json` for structured data)1112. Summarize: total findings by severity (Critical > High > Medium > Low)1123. Highlight top 3 most critical with file locations and remediation1134. Offer next steps: run DAST, fix specific issues, re-scan after changes114115## Links116117- **Website**: https://securevibes.ai118- **PyPI**: https://pypi.org/project/securevibes/119- **GitHub**: https://github.com/anshumanbh/securevibes
nordeim