SEC-AF
An AI-native code security auditor built on AgentField that proves exploitability with verdicts, taint traces, and actionable evidence — not just flagged patterns.
- Source repo
- Agent-Field/sec-af
- Stars
- ★ 199
- Last updated
- 1mo ago
- License
- Apache-2.0
- Primary language
- Go
- FA score
- 58/100 · Major gaps
At a glance
- Works with
- Universal · cross-platformCodex · Claude Code
- You'll need
- Typical use
- Development teams running verified SAST audits on GitHub repos before merge, wired into GitHub Actions with SARIF upload to Code Scanning to cut false positives from traditional scanners.
- Main limitation
- Strong ecosystem lock-in: requires a running AgentField control plane, the af CLI, and an OPENROUTER_API_KEY; default models point at specific OpenRouter-hosted models.
- Source review
- 58/100 · Major gaps 1 safety controls not found
What does this agent do, and when should you use it?
SEC-AF (repository Agent-Field/sec-af, Apache-2.0) is an AI-native security auditor that runs as an agent on the AgentField control plane. A single API call (sec-af.audit) audits a GitHub repository by composing roughly 200–300 focused LLM reasoners into a directed acyclic call graph spanning RECON, HUNT, DEDUP, PROVE, and REMEDIATION phases. Every finding ships with a verdict (confirmed / likely / inconclusive / not_exploitable), a full taint data-flow trace, and an exact code location, with SARIF 2.1.0, JSON, and Markdown outputs plus mappings to PCI-DSS, SOC2, OWASP, HIPAA, and ISO27001. On the DVGA benchmark it compresses 106 raw findings into 28–30 verified ones — 94% noise reduction — at an estimated $0.18–$0.90 per standard audit on Kimi K2.5 via OpenRouter. It is SAST-focused and does not cover runtime/protocol-level attacks such as GraphQL batch queries or deep recursion. Deployment options include Docker Compose, one-click Railway, or af install; the maintained implementation is Go, with a Python implementation still available.
SEC-AF takes a repo_url (plus optional parameters), clones the target repository, and runs a five-phase pipeline. RECON maps architecture, dependencies, data flows, and security context in parallel. HUNT runs 10+ specialized strategy hunters (injection, crypto, auth, etc.), activated by AI gates that read recon output. DEDUP fingerprints and then semantically deduplicates findings. PROVE runs a 4-agent adversarial chain per finding — a tracer reconstructs the data flow, a sanitization analyzer looks for missed mitigations, an exploit hypothesizer builds a concrete attack, and a verdict agent weighs the evidence. REMEDIATION generates fix suggestions for confirmed/likely findings. Invocation is via af call sec-af.audit --in '{"repo_url": ...}' or POST http://localhost:8080/api/v1/execute/async/sec-af.audit, with options for depth (quick/standard/thorough), scan_types, severity_threshold, max_cost_usd, max_provers, include/exclude_paths, output_formats, and compliance_frameworks. Results include verdict, proof (with data_flow_trace), location, and SARIF/JSON/Markdown reports.
- Development teams running verified SAST audits on GitHub repos before merge, wired into GitHub Actions with SARIF upload to Code Scanning to cut false positives from traditional scanners.
- Security engineers auditing GraphQL applications (DVGA-style), receiving confirmed findings for command injection, SQL injection, SSRF, and auth bypass with taint-trace evidence.
- DevSecOps teams needing compliance-mapped reports using the pci-dss, soc2, owasp, or hipaa framework options.
- Open-source maintainers running a cheap quick-depth health check (~$0.10–$0.40, 2–5 minutes) on their projects.
- AgentField users with a running control plane installing SEC-AF as a node via af install https://github.com/Agent-Field/sec-af to fold auditing into their agent orchestration.
- Security researchers extending coverage with a new vulnerability class by adding a single hunter file, which the orchestrator auto-discovers and routes into the dedup → prove → remediation pipeline.
How do you install or deploy this agent?
Option 1 (existing AgentField): af install https://github.com/Agent-Field/sec-af && af run sec-af; the first run prompts for OPENROUTER_API_KEY (stored encrypted). Option 2 (Docker Compose): git clone https://github.com/Agent-Field/sec-af.git && cd sec-af && cp .env.example .env (add OPENROUTER_API_KEY) && docker compose up --build. Option 3 (Railway): use the one-click deploy button in the README; requires OPENROUTER_API_KEY. Option 4 (local Python): with Python 3.11+, clone the repo, run python3 -m venv .venv && source .venv/bin/activate && pip install -e ., copy .env.example to .env and add OPENROUTER_API_KEY, then run af server in one terminal and python3 main.py in another. Note: the maintained implementation is the Go node under go/ (default port 8013); the Python version is available via python -m sec_af.app or a local-path install.
How do you use this agent?
Simplest invocation: af call sec-af.audit --in '{"repo_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application"}' (requires af ≥ 0.1.87), or curl -X POST http://localhost:8080/api/v1/execute/async/sec-af.audit -H 'Content-Type: application/' -d '{"input": {"repo_url": ...}}', then poll GET /api/v1/executions/<execution_id>. Optional parameters: branch, depth (quick/standard/thorough), severity_threshold, scan_types (sast/sca/secrets/config), output_formats (sarif//markdown), compliance_frameworks, max_cost_usd, max_provers, max_duration_seconds, include_paths, exclude_paths. Key environment variables: AGENTFIELD_SERVER (default http://localhost:8080), OPENROUTER_API_KEY (required), HARNESS_MODEL and AI_MODEL (default deepseek/deepseek-v4-flash-0731; any OpenRouter-compatible model works), HARNESS_PROVIDER (default aforge). In CI, trigger audits from GitHub Actions and upload the SARIF result to GitHub Code Scanning.
What are this agent's strengths and limitations?
- Adversarial verification architecture: HUNT and PROVE are structurally separate, and every finding passes a 4-agent verification chain (tracer, sanitization analyzer, exploit hypothesizer, verdict agent), delivering 94% noise reduction on DVGA.
- Actionable evidence per finding: verdict, full taint data-flow trace, and exact code location — not vague 'might be a problem' alerts.
- Transparent, low cost: a standard audit with 30 verified findings costs about $0.18–$0.90 (Kimi K2.5), with a published composite scoring formula and documented depth-based pricing.
- Composable and observable: a new vulnerability class is one hunter file; every reasoner call flows through the control plane as a complete DAG you can audit for timing and reasoning.
- Native SARIF 2.1.0 output with a documented GitHub Actions integration path and multi-framework compliance mapping.
- Strong ecosystem lock-in: requires a running AgentField control plane, the af CLI, and an OPENROUTER_API_KEY; default models point at specific OpenRouter-hosted models.
- SAST only: cannot detect the GraphQL protocol-level attacks the README itself lists (batch queries, deep recursion, alias abuse, introspection exposure); protocol-level detection is still on the roadmap.
- Slow audits: standard depth took ~78 minutes with ~166–255 agent calls and 82 DAG edges on DVGA; thorough runs 30–120 minutes.
- Inconclusive verdicts still require manual review, and the benchmark (1 correctly rejected, 1 inconclusive) shows the verification chain is not infallible.
- Dual implementations (Go primary, Python secondary) create migration considerations: a bare-URL af install installs the Go version and replaces any older Python node, while local-path installs do not follow superseded_by.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| SEC-AF This agent | 58 · Major gaps | ★ 199 | 1mo ago | Go | Codex · Claude Code |
| ControlKeel | 59 · Major gaps | ★ 11 | today | Elixir | Codex |
| AWS Agent Toolkit | 58 · Major gaps | ★ 2.7k | today | Python | Codex · Claude Code |
| Cloudflare Security Audit Skill | 52 · Major gaps | ★ 21k | 10d ago | JavaScript | — |
How does FollowAgents rate this agent?
Why each dimension lost points
README shows the tool clones user-specified repos and sends code to third-party LLMs (OpenRouter), yet the provided files contain no least-privilege, sandboxing, user-confirmation, or data-flow documentation; encrypted key storage is only an assertion in install notes. No rollback mechanism is documented. Scores: most trust criteria get 1 (behaviour inferable but unsupported by files), rollback 0 (no evidence at all). source_attribution 2: LICENSE and author info present, but publisher is unverified.
Internal inconsistency in README: benchmark table says '28 confirmed' while later sections repeatedly say '30 verified findings' — deducted to 1. Dependencies are few and CI builds/tests the Go implementation, so dependency_availability 2. failure_messages only defines 'inconclusive' in the verdict model; error/failure-path documentation is missing, 1.
Capability boundaries are the standout: README explicitly states the tool is SAST-only, lists the 9 missed scenarios and why — 3. Audience/scenarios clear but narrow (GraphQL/Python examples); trigger precision and multi-environment support (Docker/Railway/Go/af) are well described but unverified by execution — 2 each.
Information architecture and install notes are exceptionally complete (af install, Docker, local steps, Go implementation); known_limitations has a dedicated section; full Apache-2.0 LICENSE — all 3. naming_stability 2: superseded_by and node-id handling are explicit but implementation-level. versioning_changelog 1: only 0.1.0, no CHANGELOG. maintenance_responsibility 1: unverified publisher, no governance or maintenance-commitment files.
Output usability is strong: verdicts, proof objects, taint traces, SARIF 2.1.0, and compliance mappings are backed by schemas and examples — 3. marginal_value and cost_benefit 2 each: the comparison honestly concedes where rivals are stronger and cost estimates are grounded, but all claims are static assertions, not independently verified, and the 28/30 counting contradiction weakens them.
claim_traceability 2: benchmark and performance claims point to exampl/ files (note the 'exampl' directory name appears to be a typo). cross_source_corroboration 1: all performance/effectiveness claims come from a self-reported benchmark with no third-party corroboration. fact_inference_separation 2: costs are labelled estimates and the comparison table carries a sourcing disclaimer, but some claims still mix inference with fact.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Weak trust-dimension evidence: no sandboxing, least-privilege, or data-handling documentation covering sending target-repo code to third-party LLMs; assess exfiltration risk yourself before use.
- README contradicts itself ('28 confirmed' vs '30 verified findings'), and all effectiveness claims come from a self-reported benchmark with no independent verification (static review, low confidence).
- No changelog and an unverified publisher make the upgrade and maintenance path uncertain.
- Rollback is entirely undocumented; prepare your own recovery plan if deploying to production.