CodeCrucible CLI
A Go CLI that hunts for vulnerabilities in a Git repository with LLMs and saves findings as SARIF for GitHub Code Scanning.
- 120 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Source code goes to an external model provider and the run spends tokens.
Install
- Works in
Manual install
make buildBuild from a clone of `https://github.com/block/codecrucible`; Go is required. A Docker image is available through `make docker-build`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Source code goes to an external model provider and the run spends tokens.
This is third-party code. Review the repository files before installing.
What it does
CodeCrucible is a Go command-line tool that looks for exploitable vulnerabilities in source code. It reads a repository, drops tests, `vendor` directories and binaries, splits the code into model-sized chunks and runs them through three phases: feature detection, analysis and a separate audit of the findings. The output is valid SARIF 2.1.0 accepted by GitHub Code Scanning and other compatible systems. Each phase can use its own model and provider: Anthropic, OpenAI, Google, Cerebras, Ollama, Databricks or an OpenAI-compatible endpoint. The `--dry-run` flag shows input volume and a cost estimate without any API calls. The agent skill lives in `.agents/skills/codecrucible/SKILL.md`: it guides an agent through running a scan, choosing a prompt set and reading the findings.
Who it is for. Security engineers and teams that want an inexpensive first-pass code audit before manual review.
Good fit when
- A repository is scanned with a model before release and findings land in SARIF.
- A scan runs in CI and the result is uploaded to GitHub Code Scanning.
- The cost of a large monorepo is estimated first with `--dry-run`.
- Analysis and audit are given to different models to compare finding quality.
Not a fit when
- Findings would be accepted as a final verdict without reading the code.
- Source code must not be sent to external model providers.
- A deterministic scanner that spends no tokens is required.
Example request
Scan the repository `./service`, show the cost estimate with `--dry-run`, then save the result to `results.sarif`.Limitations
Findings come from a language model, so false positives and misses happen; check each finding against the source. Source code goes to the chosen provider and the run spends tokens: the `--dry-run` estimate carries a 2-3x allowance and is not a ceiling. A provider key or a Claude Code CLI login is required. Installation builds from source with `make build`, so Go must be present. Licensed Apache-2.0 and published by Block.
How to disable. Delete the `codecrucible` binary and the agent skill directory. SARIF files and phase artifacts sit beside the `--output` path and are removed manually.
FAQ
Which providers are supported?
Supported providers are `anthropic`, `openai`, `google`, `cerebras`, `ollama`, `openai-compat` and `databricks`. Without a flag the provider is detected from environment variables.
How do I learn the scan cost in advance?
Run the scan with `--dry-run`: it lists the input files and a rough token estimate without calling any API. The estimate includes a 2-3x allowance.
Where does the result go?
To the file given in `--output`, for example `results.sarif`. Phase artifacts such as `results.analysis.sarif` and `results.audit.sarif` appear beside it.
Can findings be rechecked with another model?
Yes. `codecrucible scan REPO --audit-from results.analysis.sarif` repeats only the audit on saved findings and skips analysis.
Is an API key required?
By default yes, the key of the chosen provider. The mode that reuses a Claude Code CLI login (`claude auth status`) works without an API key.
Discussion
No questions or reviews yet.
Related
CLI toolsCodex Security scans code, validates findings and fixes, saves evidence and exports results for review and CI workflows.
A local MCP server and CLI find vulnerabilities in AI-generated code and drive a scan, fix and rescan loop, no account needed
ClawScan runs several security scanners on agent skills and hands their results to a judge for a combined verdict.
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
A Datadog CLI that hunts for vulnerabilities in source code with Claude, GPT or Gemini and saves the result as SARIF
An offline scanner vets repositories, skills, plugins and MCP servers for malicious code before they reach your agent.
README in short
Each phase is configured separately: model, provider, key, base URL and parameters. If a model fails, the output stays valid SARIF with partial results.