About this template
AI vulnerability scanner (CodeCrucible LLM SAST)
Search ai vulnerability scanner or ai sast — this template is the forkable Claude Code seat: Block's CodeCrucible CLI, dry-run cost gate, SARIF out, human triage.
You want whole-repo LLM security analysis that fits a real remediation workflow — not another SaaS scanner you cannot tune, and not a weekend spent installing Go so you can build Block's open-source CLI.
This template forks with CodeCrucible already built, prompt sets on disk, and an operator skill that forces the safe play: dry-run first, bound cost, emit SARIF, you still triage.
The undeniable demo
export PATH="$HOME/.agents/bin:$PATH"
codecrucible scan ~/.agents/codecrucible/samples/tiny-app --dry-run
# then, with your own key:
export ANTHROPIC_API_KEY=… # or log into Claude Code
codecrucible scan /path/to/repo \
--provider anthropic \
--prompts-dir "$HOME/.agents/codecrucible/prompts/default" \
--output "$HOME/scans/results.sarif" \
--max-cost 25
Open the SARIF. Jump to the top finding in source. Confirm or reject. Draft triage only — never auto-merge.
What's in the fork
| Path | What |
|---|---|
~/.agents/bin/codecrucible | Built CLI (persist-safe under claudecode KeepGlobs) |
~/.agents/codecrucible/prompts/ | default, carlini, exploit-proof-* sets |
~/.claude/skills/codecrucible/ | Upstream Block agent skill |
~/.claude/skills/codecrucible-operator/ | jurniti operator playbook |
~/.agents/codecrucible/samples/tiny-app | Dry-run sample |
~/.agents/codecrucible/scan.md | Defaults stub (no secrets) |
BYOK (your keys, your bill)
Model spend is yours. Export env names only — never paste key values into skills or the repo:
ANTHROPIC_API_KEY(or Claude Code login)- optional:
OPENAI_API_KEY,GOOGLE_API_KEY,DATABRICKS_HOST+DATABRICKS_TOKEN - optional:
GH_TOKENto draft GitHub triage notes (human posts)
Config precedence is CodeCrucible's: flags > env > config file > defaults. Keep secrets out of git.
Who this is for
- AppSec / eng leads who want LLM-primary SAST (whole-repo), not "LLM validates Semgrep hits only"
- Teams that need SARIF for GitHub Code Scanning or a review queue
- Operators who will read findings before anyone merges a "fix"
Who this is not for
- Lights-out auto-remediation or auto-merge bots
- Zero-budget token free rides (scans cost real model dollars — use
--dry-runand--max-cost) - Compliance theatre that treats model output as a final CVE verdict without source verification
Provenance
- Tool: block/codecrucible
- Blueprint essay: CodeCrucible: A blueprint for LLM-driven SAST (Block Engineering)
- Signal: jack on X
- Software Factory: Security × GitHub (SARIF path)
You own the microVM. You own the keys. You own the merge button.