SecureFlow CLI
š”ļø AI-Powered Security Analysis for Your Codebase
SecureFlow CLI is a powerful command-line tool that performs comprehensive security analysis of your projects using advanced AI models. It intelligently analyzes your code structure, identifies vulnerabilities, and provides actionable security insights with a beautiful TUI interface.
āØ Features
- š¤ AI-Powered Analysis - Supports 13+ AI models including Claude, GPT, and Gemini
- š Intelligent File Discovery - Smart project analysis with iterative file request system
- šÆ Comprehensive Scanning - Full project security analysis with context-aware insights
- š Multiple Output Formats - Text, JSON, and DefectDojo integration
- šļø Project Profiling - Technology stack detection and application type identification
- šØ Beautiful TUI - Claude-style terminal interface with colored output and progress indicators
š Quick Start
$3
From the repository root:
``bash
Run directly
node packages/secureflow-cli/bin/secureflow --help
Or install globally (future)
npm install -g @codepathfinder/secureflow-cli
`
$3
SecureFlow CLI requires an AI model to perform analysis. Set up your API key:
`
bash
Check current configuration
secureflow config --showThe CLI will prompt for API key configuration on first run
Or manually edit the config file shown in the output
`
Supported Models:
- Anthropic Claude:
claude-sonnet-4-5-20250929
(recommended), claude-opus-4-1-20250805
, claude-sonnet-4-20250514
, claude-3-7-sonnet-20250219
, claude-3-5-haiku-20241022
, ~~claude-3-5-sonnet-20241022
~~ (deprecated)
- OpenAI: gpt-4o
, gpt-4o-mini
, o1
, o1-mini
, gpt-4.1-2025-04-14
, o3-mini-2025-01-31
- Google Gemini: gemini-2.5-pro
, gemini-2.5-flash
- xAI Grok: grok-4-fast-reasoning
- OpenRouter: Access 200+ models from multiple providers (use format: provider/model
e.g., anthropic/claude-3-5-sonnet
)
- Ollama: qwen3:4b
$3
`
bash
Scan current directory with default model
secureflow scanScan specific project with Claude
secureflow scan ./my-project --model claude-sonnet-4-5-20250929Get project profile first
secureflow profile ./my-project
`
š Commands
$3
Performs comprehensive AI-powered security analysis of your project.
`
bash
secureflow scan [path] [options]
`
Options:
-
--model
- AI model to use for analysis
- --format - Output format: text, json, or defectdojo (default: text)
- --output - Save results to file
- --defectdojo - Export in DefectDojo format (shorthand for --format defectdojo)DefectDojo Integration:
`bash
secureflow scan \
--format defectdojo \
--defectdojo-url https://defectdojo.example.com \
--defectdojo-token your-api-token \
--defectdojo-product-id 123 \
--output findings.json
`DefectDojo Options:
-
- DefectDojo instance URL
- --defectdojo-token - API token for authentication
- --defectdojo-product-id - Product ID to submit findings
- --defectdojo-engagement-id - Engagement ID (optional, will create if not provided)
- --defectdojo-test-title <code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> - Test title (default: "SecureFlow Scan")</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">Analyzes project structure and identifies technologies, frameworks, and application types.</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">bash<br />secureflow profile [path] [options]<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><strong>Options:</strong><br />- </code>--model <model><code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> - AI model to use for analysis<br />- </code>--format <format><code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> - Output format: </code>text<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> or </code>json<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> (default: </code>text<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">)<br />- </code>--output <file><code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"> - Save results to file</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3></p><p class="my-3">View and manage CLI configuration.</p><p class="my-3"></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">bash<br />secureflow config --show # Show masked configuration<br />secureflow config --show --raw # Show raw configuration (use with caution)<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">š§ Configuration</h2></p><p class="my-3">SecureFlow CLI stores configuration in a local config file. The location is shown when running </code>secureflow config --show<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">.</p><p class="my-3"><strong>Example Configuration:</strong><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">json<br />{<br /> "model": "grok-4-fast-reasoning",<br /> "apiKey": "xai-token",<br /> "provider": "grok",<br /> "analytics": {<br /> "enabled": false<br /> }<br />}<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><strong>Getting API Keys:</strong><br />- <strong>Anthropic (Claude)</strong>: <a href="https://console.anthropic.com" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">console.anthropic.com</a><br />- <strong>OpenAI</strong>: <a href="https://platform.openai.com" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">platform.openai.com</a><br />- <strong>Google</strong>: <a href="https://ai.google.dev" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">ai.google.dev</a><br />- <strong>Grok (xAI)</strong>: <a href="https://console.x.ai" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">console.x.ai</a><br />- <strong>OpenRouter</strong>: <a href="https://openrouter.ai/settings/keys" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">openrouter.ai</a></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">šÆ Usage Examples</h2></p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">bash<br /><h1 class="text-2xl font-bold mt-6 mb-4">Scan current directory</h1><br />secureflow scan</p><p class="my-3"><h1 class="text-2xl font-bold mt-6 mb-4">Scan with specific model</h1><br />secureflow scan --model grok-4-fast-reasoning</p><p class="my-3"><h1 class="text-2xl font-bold mt-6 mb-4">Save results to file</h1><br />secureflow scan --output security-report.json --format json<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">bash<br /><h1 class="text-2xl font-bold mt-6 mb-4">Profile current project</h1><br />secureflow profile</p><p class="my-3"><h1 class="text-2xl font-bold mt-6 mb-4">Profile specific directory</h1><br />secureflow profile ./backend --format json<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">bash<br /><h1 class="text-2xl font-bold mt-6 mb-4">Export to DefectDojo with minimal setup</h1><br />secureflow scan \<br /> --defectdojo \<br /> --defectdojo-url https://defectdojo.company.com \<br /> --defectdojo-token $DEFECTDOJO_TOKEN \<br /> --defectdojo-product-id 42</p><p class="my-3"><h1 class="text-2xl font-bold mt-6 mb-4">Full DefectDojo configuration</h1><br />secureflow scan \<br /> --format defectdojo \<br /> --defectdojo-url https://defectdojo.company.com \<br /> --defectdojo-token $DEFECTDOJO_TOKEN \<br /> --defectdojo-product-id 42 \<br /> --defectdojo-engagement-id 123 \<br /> --defectdojo-test-title "Weekly Security Scan" \<br /> --output weekly-findings.json<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">šļø How It Works</h2></p><p class="my-3">SecureFlow CLI uses an innovative <strong>LLM File Request System</strong> that works like tool calling:</p><p class="my-3">1. <strong>Project Discovery</strong> - Analyzes project structure and identifies key files<br />2. <strong>Iterative Analysis</strong> - AI makes targeted file requests using XML-like syntax:<br /> </code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">xml<br /> <file_request path="./src/auth.js" reason="Analyze authentication logic" /><br /> <list_file_request path="./src/components" reason="Explore component structure" /><br /> </code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"><br />3. <strong>Security Analysis</strong> - Performs up to 3 iterations of analysis with context building<br />4. <strong>Report Generation</strong> - Outputs comprehensive security findings with severity levels</p><p class="my-3"><strong>Security Features:</strong><br />- ā
Hidden file filtering (ignores </code>.git<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">, </code>.DS_Store<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">, etc.)<br />- ā
Symlink protection against directory traversal<br />- ā
Project scope validation<br />- ā
File size limits (large files truncated)<br />- ā
Comprehensive request logging</p><p class="my-3"><h2 class="text-xl font-semibold mt-5 mb-3">šØ Output Formats</h2></p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br />Beautiful colored terminal output with:<br />- š“ Critical vulnerabilities<br />- š High severity issues <br />- š” Medium severity warnings<br />- šµ Low severity notes<br />- ā¹ļø Informational findings</p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br />Structured output perfect for CI/CD integration:<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono">json<br />{<br /> "summary": {<br /> "totalIssues": 5,<br /> "critical": 1,<br /> "high": 2,<br /> "medium": 1,<br /> "low": 1<br /> },<br /> "findings": [...]<br />}<br /></code>`<code class="bg-muted px-1 py-0.5 rounded text-sm font-mono"></p><p class="my-3"><h3 class="text-lg font-medium mt-4 mb-2">$3</h3><br />Direct integration with DefectDojo security platforms:<br />- Compliant with Generic Findings Import format<br />- Automatic severity mapping<br />- File path and line number extraction<br />- CWE/CVE detection and tagging</p><p class="my-3">---</p><p class="my-3"><strong>Need Help?</strong> <br />- Run </code>secureflow --help` for command overview<br />- Open an issue or discussion on <a href="https://github.com/shivasurya/code-pathfinder/issues" class="text-primary hover:underline" target="_blank" rel="noopener noreferrer">GitHub</a><br /></p></div><div class="flex justify-center absolute inset-x-0 bottom-0 bg-gradient-to-t from-background via-background to-transparent pb-4 pt-16"><button data-slot="button" class="inline-flex items-center justify-center whitespace-nowrap text-sm font-medium transition-all disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg:not([class*='size-'])]:size-4 shrink-0 [&_svg]:shrink-0 outline-none focus-visible:border-ring focus-visible:ring-ring/50 focus-visible:ring-[3px] aria-invalid:ring-destructive/20 dark:aria-invalid:ring-destructive/40 aria-invalid:border-destructive border bg-background shadow-xs hover:bg-accent hover:text-accent-foreground dark:bg-input/30 dark:border-input dark:hover:bg-input/50 h-8 rounded-md gap-1.5 px-3 has-[>svg]:px-2.5"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="lucide lucide-chevron-down mr-1 h-4 w-4"><path d="m6 9 6 6 6-6"></path></svg>Show more</button></div></div></div><template id="P:3"></template><template id="P:4"></template></div></div></div><script>self.__next_f.push([1,"2c:[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}]\n2d:[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^11.1.0\"}]\n2e:[\"$\",\"$L5\",\"posthog-node\",{\"href\":\"/package/posthog-node\",\"className\":\"group flex items-center justify-between rounded-md px-2 py-1.5 text-sm transition-colors hover:bg-accent\",\"children\":[[\"$\",\"span\",null,{\"className\":\"flex items-center gap-1.5 truncate font-mono text-foreground\",\"children\":[[\"$\",\"svg\",null,{\"ref\":\"$undefined\",\"xmlns\":\"http://www.w3.org/2000/svg\",\"width\":24,\"height\":24,\"viewBox\":\"0 0 24 24\",\"fill\":\"none\",\"stroke\":\"currentColor\",\"strokeWidth\":2,\"strokeLinecap\":\"round\",\"strokeLinejoin\":\"round\",\"className\":\"lucide lucide-chevron-right h-3 w-3 text-muted-foreground opacity-0 transition-opacity group-hover:opacity-100\",\"children\":[[\"$\",\"path\",\"mthhwq\",{\"d\":\"m9 18 6-6-6-6\"}],\"$undefined\"]}],\"posthog-node\"]}],[\"$\",\"span\",null,{\"className\":\"ml-2 shrink-0 font-mono text-xs text-muted-foreground\",\"children\":\"^5.10.0\"}]]}]\n"])</script><div hidden id="S:3"><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_aav5ubrb_-trigger-dependencies" hidden="" id="radix-_R_aav5ubrb_-content-dependencies" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-6"></div></div><script>$RS=function(a,b){a=document.getElementById(a);b=document.getElementById(b);for(a.parentNode.removeChild(a);a.firstChild;)b.parentNode.insertBefore(a.firstChild,b);b.parentNode.removeChild(b)};$RS("S:3","P:3")</script><div hidden id="S:4"><div data-state="inactive" data-orientation="horizontal" role="tabpanel" aria-labelledby="radix-_R_aav5ubrb_-trigger-versions" hidden="" id="radix-_R_aav5ubrb_-content-versions" tabindex="0" data-slot="tabs-content" class="flex-1 outline-none mt-6"></div></div><script>$RS("S:4","P:4")</script><script>$RC("B:1","S:1")</script></body></html>