Rafter CLI
Multi-language CLI for Rafter — the security toolkit built for AI coding agents and the developers who use them.
Free forever for individuals and open source. No account required. No telemetry.
All local security features work with zero setup — no API key, no sign-up, no usage limits.
Enterprise teams that need advanced analysis and policy management can upgrade later.
Rafter is a security primitive that any developer or agent can call and trust. Stable contracts, deterministic results, and structured output mean you can pipe findings to jq, feed them to an orchestrator, or read them yourself. AI agents are first-class users — every command is designed for programmatic consumption, and the entire codebase welcomes agent-assisted contributions.
Two capabilities in one package:
-
Local Security Toolkit (free, no account) — Fast secret scanning (21+ built-in patterns, deterministic for a given version), policy enforcement with risk-tiered rules, pre-commit hooks, extension auditing, custom rule authoring, and full audit logging. Works offline. No API key. No telemetry. No data leaves your machine. Supports Claude Code, Codex CLI, OpenClaw, Gemini CLI, Cursor, Windsurf, Continue.dev, Aider, Hermes, and OpenCode.
-
Remote Code Analysis — Deep security audits that combine agentic analysis with a full SAST/SCA toolchain. Rafter's engine examines your codebase the way a professional penetration tester would — tracing data flows, reasoning about business logic, and surfacing vulnerabilities that static rules alone miss — then cross-references findings with industry-standard SAST, SCA, and secret-detection tools. Structured reports in JSON or Markdown. Pipe to any tool, feed to any workflow.
The CLI follows UNIX principles and provides a stable output contract: scan results to stdout as JSON, status to stderr, documented exit codes. No code leaves your machine unless you explicitly use the remote API, and is deleted immediately after analysis completes. Any developer can classify outcomes (clean / findings / retryable error / fatal error) and act without reading prose.
90-Second Quickstart
See what Rafter does before reading another word.
1. Scan a directory for leaked credentials
# Drop a .env file with credentials in a test repo
echo 'AWS_ACCESS_KEY_ID=AKIAIOSFODNN7ABCDEFG' > .env
rafter secrets .
# → CRITICAL .env:1 aws-access-key-id AKIA***DEFG
# → exit 1
2. Install the pre-commit hook
rafter agent install-hook
# → Writes .git/hooks/pre-commit in the current repo
# → Add --global to apply it to every repo via core.hooksPath
rafter agent init --all is a separate step: it wires up every detected agent (hooks, skills, MCP) and downloads Betterleaks.
It does not install a git hook.
3. Try to commit—hook blocks it
git add . && git commit -m 'add config'
# → Rafter: Scanning staged files for secrets...
# → CRITICAL AWS Access Key ID (.env, line 1)
# → Commit blocked. Remove secrets before committing.
# → To bypass (NOT recommended): git commit --no-verify
4. Review the audit log
rafter agent audit --last 3
# → 2026-02-27T... secret_detected .env aws-access-key-id
That's the core loop: scan → protect → audit. Everything works offline, no API key needed.
What's Free?
| Feature | Free (individuals & OSS) | Enterprise |
|---|
| Secret scanning (21+ patterns) | Yes | Yes |
| Pre-commit hooks | Yes | Yes |
| Command interception | Yes | Yes |
| Skill/extension auditing | Yes | Yes |
| Audit logging | Yes | Yes |
| MCP server | Yes | Yes |
| CI/CD integration | Yes | Yes |
| Remote SAST/SCA/Agentic analysis (API) | Free tier | Higher limits |
| Dashboards (rafter.so) | Yes | Yes |
No account. No telemetry. No data collection. The CLI is MIT-licensed and all local features work without network access.
Installation
Node.js (full features: local security + remote analysis)
npm install -g @rafter-security/cli
# or
pnpm add -g @rafter-security/cli
Python (full features)
pip install rafter-cli
Requires Python 3.11+. Full feature parity with Node.js including local security toolkit and MCP server.
Upgrading
After upgrading the CLI, run rafter agent update to refresh the skills, rules, instructions, hooks and MCP entries of every integration you installed. It keeps files you edited (the new version is written beside them as .rafter-new) and never adds a platform you did not install. rafter agent status tells you when an update is due.
Remote Code Analysis
Agentic security audits backed by a full SAST/SCA toolchain, via the Rafter API. The analysis engine examines your codebase the way a professional cybersecurity auditor would — following data flows across files, reasoning about authentication and authorization logic, and identifying vulnerabilities that pattern-matching alone cannot catch — then validates and enriches findings with industry-standard static analysis, dependency scanning, and secret detection. Runs against the remote repository on GitHub, not local files. Your code is deleted immediately after analysis completes. Auto-detection uses your local Git config to determine which repo and branch to analyze.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
