sec-af - AI-native code security auditor on AgentField that

项目说明

<di="center">

SEC-AF

AI-Nati Auditor Built on AgentField

![Python]()
![Built with AgentField]()
![Deploy on Railway]()
![More from Agent-Field]()

<p>
<a href="#what-you-get-back">Output</a> •
<a href="#benchmark-dvga">Benchmark</a> •
<a href="#how-it-works">How It Works</a> •
<a href="#comparison">Comparison</a> •
<a href="#quick-start">Quick Start</a> •
<a href="#api">API</a>
</p>

</div>

Other tools flag patterns. SEC-AF pro: every finding ships with a , a data flow trace, and e you can act on. Free, open source, one API call. A full audit with 30 findings costs about $1.40 in LLM calls.

<p align="center">
<img src="assets/hero-b-swarm.png" alt="SEC-AF — AI-nati auditor" width="100%" />
</p>

One-Call DX

Trigger it with the af CLI (requires af ≥ 0.1.87) — it streams li and prints the result:

Prefer raw HTTP? Hit the API directly with curl:

What You Get Back

This is a real finding from SEC-AF auditing DVGA (a deliberately GraphQL app):

Every finding includes a (confirmed / likely / inconclusive / not_exploitable), a proof object with the full taint trace, and the exact code location. Not "this might be a problem." SEC-AF traces data from source to sink and pro it's actually exploitable.

> Full benchmark output (30 findings): exampl/d.json | Performance analysis: exampl/benchmark-analysis.json

Benchmark: DVGA

We run SEC-AF against Damn GraphQL Application, a deliberately app with 21 documented security scenarios.

| Metric | Value |
|---|---|
| Raw findings discovered | 106 |
| After AI deduplication | 61 |
| After ad | 28 confirmed |
| Inconclusi manual review) | 1 |
| Not exploitable (correctly rejected) | 1 |
| Noise reduction | 94% |
| DAG edges (reasoner calls) | 82 |
| Agent calls | ~166–255 |
| Strategies run | 11 |
| Wall-clock time | ~78 min |
| Estimated cost (Kimi K2.5) | ~$0.18–$0.90 |

<details>
<summary><strong>Breakdown: 30 findings by category</strong></summary>

| Category | Count | Examples |
|---|---|---|
| Missing Authentication | 8 | ImportPaste, delete_all_pastes, system_debug, CreateUser, file upload |
| Command Injection | 4 | os.popen(cmd) , system_debug, system_diagnostics |
| SQL Injection | 3 | Unsanitized filter in resol, LIKE pattern injection, login |
| Authentication Bypass | 3 | JWT signature disabled, JWT authorization bypass, broken password auth |
| Plaintext Credentials | 3 | Cleartext password storage, plaintext comparison, password in diagnostics |
| SSRF | 2 | ImportPaste mutation follows user-supplied URLs ser |
| Business Logic / URL Sanitization | 2 | Inadequate URL sanitization, unauthenticated mass deletion |
| DoS / Resource Exhaustion | 3 | Missing pagination on users/audits queries, uncontrolled simulate_load |
| Config / Secrets | 2 | Hardcoded JWT/Flask secrets, debug mode enabled in production |

</details>

<details>
<summary><strong>Design patterns: how AI-nati analysis works</strong></summary>

SEC-AF applies several architectural patterns that are uniquely enabled by composing many focused AI agents instead of running one monolithic scan. These patterns address fundamental challenges in AI-dri analysis.

1. Ad agent tension (HUNT )

Most AI security tools ask a single model "is this ?" and accept the answer. SEC-AF structurally separates the _finding_ agents from the _disproving_ agents. Hunters are incentivized to find ; provers are incentivized to disprove them. Each finding passes through a 4-agent chain — a tracer reconstructs the data flow, a sanitization analyzer looks for mitigations the hunter may ha, an exploit hypothesizer constructs a concrete attack scenario, and a agent weighs all the conflicting e. This ad tension between agents is what drives the 94% noise reduction — the architecture itself encodes skepticism.

2. Signal cascade with progressi

Instead of dumping all findings on the user, the pipeline compresses signal at every stage: 106 raw findings → 61 after AI deduplication → 30 after ad . Each phase is a filter. This mirrors how human security teams triage — broad discovery first, then progressively stricter scrutiny. The key insight is that each filter is a _different kind_ of AI reasoning: semantic similarity for dedup, taint analysis for , exploit construction for confirmation.

3. Information economy pruning

LLMs hallucinate more when gi context. SEC-AF routes only the information each agent needs: an injection hunter receives the recon context pruned to data flow maps and input entry points, while a crypto hunter recei trees and key management patterns. recei finding views with only the fields needed for their specific method. This per-strategy context pruning reduces both hallucination and cost — agents can't confuse themselves with information they never see.

4. Streaming phase o

Traditional pipelines run sequentially: finish recon, then start hunting, then start proving. SEC-AF o phases via asyncio.Queue — hunters start consuming recon output as it arrives, and dedup processes findings as each hunter completes. Provers begin the first deduplicated findings while later hunters are still running. This streaming architecture reduces wall-clock time without sacrificing the signal cascade — each finding still passes through every filter, just earlier.

5. Dynamic routing via AI gates

The pipeline adapts at runtime based on what it discovers. An AI gate examines recon output and selects which hunt strategies to activate — a Flask app with JWT auth triggers different hunters than a Go microservice with gRPC. A separate CWE expansion gate dynamically broadens the target list based on the detected technology stack. A reachability gate assesses whether dependency ha call paths before wasting resources on unreachable code.

6. Guided autonomy for coding agents

SEC-AF runs on top of coding agents (AForge, Claude Code, OpenCode, Codex) via the AgentField harness. Rather than giving the agent a single massi, each reasoner provides phase-aware guided autonomy: the agent receives a narrow task definition, a flat output schema (2-4 fields), and strategy-specific context. The agent has full autonomy within these boundaries — it can read files, trace code, and reason freely — but the harness constrains the _shape_ of its output. This prevents the common failure mode where autonomous agents go off-task or produce unstructured results.

7. Composable reasoner DAG with full obser

Every agent call flows through the AgentField control plane, creating a complete directed acyclic graph of the audit. You can see which hunter found which finding, how long each took, what e the pro, and where the pipeline spent its time. Adding a new class is one file — a new hunter. The orchestrator discovers it, routes context to it, and integrates its findings into the existing dedup → prove → remediation pipeline. The DAG is the architecture.

</details>

<details>
<summary><strong>What it missed (and why)</strong></summary>

The 9 missed scenarios are primarily GraphQL protocol-le: batch queries, deep recursion, alias abuse, field duplication, introspection exposure. These require runtime/DAST analysis. SEC-AF is currently SAST-focused. Protocol-le is on the roadmap.

</details>

How It Works

SEC-AF is built on the Composite Intelligence philosophy: instead of relying on a single monolithic LLM call, it composes many focused, guided LLM calls into a reasoner DAG where the architecture itself encodes intelligence (for a deeper dive on this pattern, see The Atomic Unit of Intelligence). Each LLM call handles a small, well-defined task with a flat Pydantic schema (2-4 attributes). The orchestrator manages context flow, parallelism, and dynamic routing.

Architecture: Reasoner Call Graph (DAG)

Every phase is a that calls sub-reasoners through the AgentField control plane totaling around ~200-300 agents working synchronously for a gi:

<p align="center">
<img src="assets/architecture.png" alt="SEC-AF Signal Cascade Pipeline — RECON → HUNT → DEDUP → PROVE → OUTPUT" width="100%" />
</p>

Signal Cascade Pipeline

Each phase narrows the signal. Raw findings are filtered through progressively stricter gates:

| Phase | Purpose | Parallelism |
|---|---|---|
| RECON | Map architecture, dependencies, data flows, security context | 3-way parallel (arch + deps + config), then 2-way (data flow + security) |
| HUNT | Run 10+ specialized strategy hunters | Semaphore-bounded parallel (default 4 concurrent) with incremental dedup |
| PROVE | Ad : try to disprove each finding | Semaphore-bounded parallel (default 3 concurrent) |
| REMEDIATION | Generate fix suggestions for confirmed/likely findings | Semaphore-bounded parallel (default 3 concurrent) |

Why Multi-Reasoner Architecture

Most AI security tools run one big prompt and hope the LLM gets it right. SEC-AF decomposes the problem into ~258 focused agent calls, each with a flat schema (2-4 fields) and a narrow task. The architecture encodes the reasoning strategy, not the prompt (see The Atomic Unit of Intelligence for why this matters).

Comparison

> Claims sourced from official docs and pricing pages. If something is wrong, open an issue.

| | SEC-AF | Nullify | Snyk Code | Semgrep | CodeQL |
|---|---|---|---|---|---|
| Approach | AI-native | AI-native | AI-assisted | Rule-based | Rule-based |
| | Multi-reasoner DAG · LLM reasons about code | Autonomous security workforce | DeepCode AI engine | Pattern + taint matching | Semantic analysis + dataflow |
| Open source | ✅ Apache 2.0 | ❌ Proprietary | ❌ Proprietary | Engine: LGPL-2.1 · Pro rules: proprietary | Queries: MIT · Engine: proprietary |
| findings | ✅ Ad PRO · + proof per finding | ✅ Proof-of-exploit generation | ❌ Priority Score (opaque) · no exploit proof | ❌ Pattern matches only | ❌ Static analysis alerts |
| E per finding | Data flow trace with taint propagation | Exploit path + reproduction steps | Source-to-sink flow shown | - | Path queries show data flow |
| Architecture | Composable reasoner DAG with full obser | Monolithic agent | Single-pass engine | Rule engine | Query engine |
| Parallelism | ✅ Parallel hunters, , remediators with incremental dedup | Not documented | Not documented | ✅ Rule parallelism | ✅ Query parallelism |
| Scoring | ✅ Published composite formula | Internal | Opaque Priority Score | Internal | - |
| SARIF | ✅ Native 2.1.0 | Not documented | ✅ | ✅ | ✅ Native |
| Compliance mapping | PCI-DSS, SOC2, OWASP, HIPAA, ISO27001 | Not documented | Platform compliance only | OWASP rules a | - |
| Languages | Any LLM-supported language | Not documented | 14+ | 35+ (parser-based) | 10 |
| Pricing | Free · open source (~$0.18–$0.90/audit in LLM costs) | $6,000/mo | $25-105/mo/de | OSS engine: free to use · Pro: $30/mo/contributor | Free for public repos · $49/mo/committer (GHAS) |

Where SEC-AF is strongest: findings with proof objects, transparent scoring, compliance mapping, composable multi-agent architecture with full DAG obser, and fully open source.

Where others are stronger: Semgrep and CodeQL ha of battle-tested rule co across 35+ languages. Snyk has deep IDE/SCA integration. Nullify adds runtime cloud context and auto-remediation campaigns. SEC-AF is newer and currently strongest on AI-dri analysis.

> Same architecture, different domain: Contract-AF applies ad HUNT→PROVE to legal contracts — agents spawn agents to find clause interactions solo LLMs miss.

Why Multi-Agent Architecture Matters

Traditional security scanners are monolithic: one engine, one pass, one set of rules. SEC-AF's multi-reasoner architecture provides structural ad:

Quick Start

Install into AgentField (af install)

Already running an AgentField control plane? Install SEC-AF straight from GitHub — no clone, no local setup:

af install follows the repository manifest to the maintained Go package and registers it as the sec-af node with your control plane. If an older Python sec-af is installed, it is replaced in place, retaining the same node id, triggers, and node-scoped secrets. On first af run you're prompted for the required OPENROUTER_API_KEY — stored encrypted and reused across every node, so you enter it only once. Then run an audit:

New to AgentField? Install the control plane first with curl -fsSL | bash, or use the Docker / Railway options below.

To install the Python node deliberately, clone this repository and install the
checkout as a local path. Local-path installs do not follow superseded_by:

Go implementation

The maintained node li go/, and installing the bare
repository URL gives you this implementation as sec-af on its default port
8013 — no Python en is pro on that path. It registers the
same reasoners under the same names and draws the same control-plane DAG. The
Python implementation remains a through python -m sec_af.app, the root
Docker Compose stack, or the local-path install escape hatch (git clone then
af install ./sec-af). The Go add-on Compose file
(docker-compose.go.yml) uses the node id sec-af-go only so both
implementations can run against one control plane during a changeover. Build,
run, and Docker/compose docs live in go/README.md.

One-Click Deploy (Railway)

![Deploy on Railway]()

Deploys the AgentField control plane + SEC-AF agent. You'll need an OPENROUTER_API_KEY.

Local (Docker Compose)

Starts AgentField control plane () + SEC-AF agent.

Trigger an audit:

Poll for results:

Running Locally (Without Docker)

Prerequisites: Python 3.11+, Git, an OpenRouter API key

Step 1 — Clone the repo

Step 2 — Create and activate a en

Step 3 — Install the package

Step 4 — Configure en

Open .env and fill in your key:

Optional — set a custom workspace directory to avoid permission issues:

Step 5 — Start the AgentField control plane (in a separate terminal)

This runs on by default.

Step 6 — Start the SEC-AF agent (in another terminal, with the ven)

The agent registers itself with the control plane and is ready to accept requests.

Step 7 — Trigger an audit

API

<details>
<summary><strong>Full request options</strong></summary>

</details>

<details>
<summary><strong>Depth profiles</strong></summary>

| Profile | Strategies | | Typical time | Typical cost |
|---|---|---|---|---|
| quick | 5 core strategies | Top findings only | 2-5 min | ~$0.10-0.40 |
| standard | 11 strategies (core + extended) | Top 30 findings | 15-80 min | ~$0.18-0.90 |
| thorough | Full strategy set | All findings | 30-120 min | ~$2-8 |

Costs based on Kimi K2.5 ($0.22/M input, $0.88/M output). The D (standard depth, 30 findings, ~166-255 estimated LLM calls, 82 DAG edges) cost an estimated $0.18–$0.90. Full analysis: exampl/benchmark-analysis.json. Any OpenRouter-compatible model works — set HARNESS_MODEL and AI_MODEL to switch.

</details>

<details>
<summary><strong> model</strong></summary>

| | Meaning |
|---|---|
| confirmed | Exploitability demonstrated with concrete e |
| likely | Strong indicators, partial |
| inconclusive | Insufficient e, requires manual review |
| not_exploitable | E indicates no practical exploit path |

</details>

<details>
<summary><strong>Output formats</strong></summary>

| Format | Consumer | Description |
|---|---|---|
| sarif | GitHub Code Scanning, security tooling | SARIF 2.1.0 with se and locations |
| json | Pipelines, APIs | Full structured result with , proofs, costs |
| markdown | Security teams | Narrati with findings and remediation |

</details>

GitHub Actions

<details>
<summary><strong>CI integration</strong></summary>

</details>

Configuration

<details>
<summary><strong>En </strong></summary>

| | Required | Default | Description |
|---|---|---|---|
| AGENTFIELD_SERVER | Yes | | Control plane URL |
| OPENROUTER_API_KEY | Yes | - | LLM provider credential |
| HARNESS_MODEL | No | deepseek/deepseek- | Model for deep .harness() analysis |
| AI_MODEL | No | deepseek/deepseek- | Model for fast .ai() gates and |
| SEC_AF_MAX_TURNS | No | 50 | Max harness turns per call |
| AGENTFIELD_API_KEY | No | unset | API key for secured en |
| SEC_AF_WORKSPACES_DIR | No | /workspaces | Directory for cloned repos (falls back to ~/.sec-af/workspaces if not writable) |
| HARNESS_PROVIDER | No | aforge | Harness backend provider; set opencode for rollback |
| AGENTFIELD_AFORGE_COMMAND | No | exec | AForge headless command the SDK runs: exec (default) or do. Read by agentfield>=0.1.130 |
| SEC_AF_AFORGE_BIN | No | aforge | Path to an AForge binary for the aforge provider (also honours AFORGE_BIN) |
| SEC_AF_AI_MAX_RETRIES | No | 3 | Retry count for model calls |

</details>

<details>
<summary><strong>Build arguments</strong></summary>

The image downloads the released AForge CLI at build time and its
SHA-256 against the release checksums.txt before installing it.

| Build arg | Default | Description |
|---|---|---|
| AFORGE_BASE_URL | | Root of the AForge download host |
| AFORGE_ | v0.1.0 | Released AForge to install |

</details>

De Setup

Harness selection

The container ships the AForge CLI at /usr/local/bin/aforge and drives it
through aforge exec by default. To temporarily roll back without changing
code, set HARNESS_PROVIDER=opencode. Running outside the container requires
an aforge binary on PATH (or SEC_AF_AFORGE_BIN pointing at one).

---

Also built on AgentField

> SWE-AF — Autonomous engineering team. One API call ships planned, coded, tested, re code. Scored 95/100.
>
> Contract-AF — Legal contract risk analyzer. Agents spawn agents at runtime. Ad review catches what solo LLMs miss.

All repos →

---

<di="center">

SEC-AF is built on AgentField, open infrastructure for production-grade autonomous agents. See what else we're building →

Apache-2.0

</div>

项目信息

开发语言：Go

Star 数：198

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。