RAPTOR workflow
A security research framework on Claude Code: static analysis, LLM validation of findings, exploits and patches
- 3,951 ★ on the repository
- Last commit
Broad access
Why this level
- Executes model-generated code and exploits
- Processes untrusted repositories and binaries
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add workflows/raptorDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Executes model-generated code and exploits
- Processes untrusted repositories and binaries
This is third-party code. Review the repository files before installing.
What it does
RAPTOR turns Claude Code into an agent for finding and validating vulnerabilities. /scan runs Semgrep, plus Coccinelle and CodeQL when available, deduplicates and writes a SARIF report. /agentic adds multi-stage LLM validation of each finding, exploitability assessment, exploit and patch generation with a per-run cost cap. Skills cover crash analysis with rr, gcov and function tracing, Frida, and open source forensics from GitHub archives. Untrusted code runs in a sandbox using Linux namespaces, Landlock and seccomp.
Who it is for. For application security engineers and vulnerability researchers auditing their own or authorized code.
Good fit when
- You need static analysis with LLM triage of false positives
- You need to assess whether a finding is exploitable and draft a patch
- You need to analyze a binary crash or investigate GitHub history
Not a fit when
- You lack authorization to analyze the target code or system
- You need a polished product rather than a research tool
Example request
/agentic /path/to/codeLimitations
The authors describe it as unpolished. Requires Claude Code with a subscription or Anthropic API key, Python 3.10+, Node.js 18+ and Semgrep; CodeQL is optional and forbids commercial use. The container image is about 6 GB. The full pipeline on a mid-size project takes tens of minutes and consumes tokens; other models need their own keys.
How to disable. Run plain claude outside the RAPTOR directory, remove bin from PATH or delete the container.
FAQ
How much does a full run cost?
With Claude Code as the analysis model there is no extra cost beyond the subscription. External models bill per token, with a default per-run cost cap.
Why run it in a container?
The agent executes generated code and processes untrusted repos; a container limits filesystem access and supply chain blast radius.
Discussion
No questions or reviews yet.
Related
WorkflowsA security CLI for coding agents: secret scanning, command policies, pre-commit hooks, third-party skill auditing
A skills router for authorized reverse engineering, pentest, CTF and threat analysis: it picks a methodology for the task and checks available tools
An MCP server and agent toolkit for reverse engineering: Ghidra, Frida, x64dbg and Rizin for binary analysis, CTF and malware research
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Anthropic's reference set for defending code: threat-model, vuln-scan, triage and patch skills in Claude Code plus an autonomous vulnerability pipeline
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
README in short
The README presents RAPTOR as an autonomous offensive and defensive research framework built on Claude Code by well-known security researchers. It covers prerequisites, manual install with the raptor launcher, and running in Docker or a devcontainer. It explains what /scan and /agentic do and their time and cost. A separate section covers the security model and sandbox.