Show HN: Secfoo – Turn your AI coding agent into a repeatable security reviewer (github.com)

Hi HN, I'm an intern at Rakfort, Dublin, Ireland and I've been working on Secfoo with the team.

AI coding agents can review code for security issues, but every run gives you a different format, depth, and set of standards. Secfoo is a CLI that hands your existing agent CLI (Claude Code, Cursor, Antigravity, or Gemini CLI) a structured brief and a target, so it reads the code the way a human reviewer would, with the same standards and report shape each time.

There's no custom rules engine. A "skill" is a structured prompt, and the agent does the actual reading. Activities include security architecture review, threat modeling (STRIDE/LINDDUN), SAST and SCA reachability triage, secret scanning (code, git history, Confluence), prompt review for LLM prompts and agent tool definitions, and deployment readiness. Multiple skills run concurrently, and results go into a local dashboard. Repeat scans of the same system consolidate into one Open/Closed findings register.

Try it:

  pip install secfoo
  secfoo run --skill sast --skill threat-modeling --target https://github.com/org/repo --agent claude
  secfoo serve

It needs an agent CLI already installed and authenticated. It's also on npm and Docker. Everything runs locally unless you explicitly connect to a cloud portal.

It's MIT licensed. To be upfront: this repo is the open-source CLI and dashboard. There is a separate closed-source enterprise portal that isn't in the repo.

Findings depend on the agent and model you use, so we see them as input for a human reviewer, not a final verdict. We'd really like feedback on what's missing or unclear.

Docs: https://secfoo.com/docs/index.html