CodeRabbit Secure

An AI-powered code-review platform that automatically analyzes pull requests in repositories hosted on platforms such as GitHub and GitLab, producing review comments, summaries, and suggestions within source-control and code-hosting workflows.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.

Semgrep is an application security platform for static application security testing, open-source dependency analysis, secrets detection, and malware protection. Its analysis combines deterministic, rule-based scanning with AI reasoning about code context, naming, structure, and developer intent; findings can be surfaced and remediated through the CLI, CI/CD systems, IDEs, pull-request checks, APIs, webhooks, and supported AI-tool integrations. In the described workflow, Semgrep is used as a local verification gate alongside repository rules and pull-request review before a code change is considered complete.

Evo by Snyk is a security and governance platform for AI-native applications, agentic development, and AI systems. It provides continuous visibility, governance, testing, and real-time control across the AI software lifecycle. Its Agentic Development Security capability discovers models, agents, MCP servers, datasets, plugins, tools, and services used by agents across repositories; generates an AI bill of materials; applies policy and guardrails to agent actions; and validates AI-generated code before it reaches repositories, pipelines, or production. Its Continuous Offensive Security capability autonomously stress-tests applications and AI systems like an adversary, with agents coordinating reconnaissance, vulnerability hunting, exploit validation, remediation, and reporting, and an independent validation model intended to confirm exploitability before reporting findings. Testing is intended to run on code changes and pull requests.

security-audit is a Cloudflare coding-agent skill that orchestrates multi-phase security audits of codebases. It uses reconnaissance to map architecture, trust boundaries, input surfaces, prior evidence, and deterministic coverage; assigns isolated agents to coverage-led hunting; sends each unique candidate to a fresh verifier; and records confirmed, needs_validation, and rejected results in machine-readable findings.json validated against a report schema. Independent agents verify final source claims, after which the skill derives target-neutral reports and coverage records. It can be installed with the Skills CLI and requires a tool-using coding agent with parallel sub-agent support, Node.js for its validators, and an OS-enforced sandbox for target-controlled execution. The repository is licensed under MIT.