🛡️ OWASP 2025 Standard • ⚡ Token-Optimized CLI

Continuous Whitebox Security
& AI Agent Acceleration

The developer toolkit that combines sub-second local Git sensitivity diffs with high-reasoning AI Agent skills. Catch vulnerabilities early across every milestone of software delivery.

Get Started (npx) Explore Agent Skills
bash — security-review diff --staged
$ npx security-review diff --staged
### 🔒 Changed Files Security Classification
- Mode: Staged Changes (git add)
- Total Files: 4 | 🔴 Critical: 1 | 🟠 High: 1 | 🟡 Medium: 1 | 🟢 Low: 1

| Severity | File Path | Focus Area |
|---|---|---|
| 🔴 CRITICAL | .env.production | secret-or-payment |
| 🟠 HIGH | src/auth/jwt.strategy.ts | auth-or-persistence |
| 🟡 MEDIUM | src/api/checkout.controller.ts | api-or-business-logic |
| 🟢 LOW | README.md | documentation |

✨ Context formatted with 8,000 token budget for AI Agent reasoning.

Engineered for High-Velocity Teams

A dual-engine architecture designed for developers, security engineers, and AI agents.

⚡

Local CLI Accelerator

Instantly extracts staged and branch diffs, categorizing files into sensitivity tiers without wasting LLM tokens on irrelevant changes.

🤖

AI Agent Reasoning Brain

Pre-engineered prompt contracts for Antigravity, Claude Code, Cursor, and OpenCode that perform threat modeling and code auditing.

🛡️

OWASP 2025 Standard

Automatically flags vulnerabilities against OWASP Top 10 categories, assigning standard CWE identifiers and actionable remediation.

🔌

Spec-Kit Compatible

100% backward compatible with Spec-Kit workflows. Seamlessly hooks into after_plan, after_tasks, and after_implement.

AI Agent Slash Commands

Execute structured security reviews at each phase of your development cycle.

Command Phase Description
/sr-audit Milestone / Release Full-system whitebox security review and OWASP assessment.
/sr-staged Pre-commit Focused review of changes currently staged in Git (git diff --cached).
/sr-branch Feature / PR Reviews security risks introduced by feature branch diffs against base.
/sr-plan Design Phase Audits technical plans for missing trust boundaries and attack vectors.
/sr-tasks Strategy Phase Ensures security requirements are sequenced properly in implementation tasks.
/sr-followup Triage Transforms security findings into structured remediation tasks.
/sr-apply Remediation Applies approved security refactors directly to tasks.md and plan.md.
/sr-export Compliance Generates formal Executive and Technical Pentest Reports.
/sr-verify Verification & PoC Re-verifies findings, tests exploitability, and generates safe PoC reproductions.
/sr-init Initialization Initializes or refines the project security constitution.

Ready to Secure Your Codebase?

Run instantly with zero installation or add as a global developer CLI.

npx security-review diff --staged