# AI Vulnerability Scanner CodeCrucible SAST

> AI vulnerability scanner / AI SAST on Claude Code: Block CodeCrucible, dry-run cost gate, SARIF out. You verify findings — nothing auto-merges.

- Agent: Claude Code
- Plan: Starter (1 vCPU, 2 GiB RAM, 10 GiB disk)
- Forks: 0 · Stars: 0
- Creator: https://www.jurniti.com/creator-ca0ff2
- Tags: ai-sast, claude-code, codecrucible, github, pack, sast, security, software-factory, vulnerability-scanner
- Requires config (you provide): ANTHROPIC_API_KEY
- Skills: codecrucible, codecrucible-operator

**To fork:** open https://www.jurniti.com/templates/ai-vulnerability-scanner-codecrucible-sast and use the Fork action — it starts a Stripe Checkout for a new VM seeded with this template's persist disk (same flat plan price, no fork fee).

## README

# AI vulnerability scanner (CodeCrucible LLM SAST)

Search **ai vulnerability scanner** or **ai sast** — this template is the forkable Claude Code seat: Block's CodeCrucible CLI, dry-run cost gate, SARIF out, human triage.

You want **whole-repo LLM security analysis** that fits a real remediation workflow — not another SaaS scanner you cannot tune, and not a weekend spent installing Go so you can build Block's open-source CLI.

This template forks with **CodeCrucible already built**, prompt sets on disk, and an operator skill that forces the safe play: dry-run first, bound cost, emit SARIF, **you** still triage.

## The undeniable demo

    export PATH="$HOME/.agents/bin:$PATH"
    codecrucible scan ~/.agents/codecrucible/samples/tiny-app --dry-run
    # then, with your own key:
    export ANTHROPIC_API_KEY=…   # or log into Claude Code
    codecrucible scan /path/to/repo \
      --provider anthropic \
      --prompts-dir "$HOME/.agents/codecrucible/prompts/default" \
      --output "$HOME/scans/results.sarif" \
      --max-cost 25

Open the SARIF. Jump to the top finding in source. Confirm or reject. Draft triage only — **never auto-merge**.

## What's in the fork

| Path | What |
| --- | --- |
| `~/.agents/bin/codecrucible` | Built CLI (persist-safe under claudecode KeepGlobs) |
| `~/.agents/codecrucible/prompts/` | default, carlini, exploit-proof-* sets |
| `~/.claude/skills/codecrucible/` | Upstream Block agent skill |
| `~/.claude/skills/codecrucible-operator/` | jurniti operator playbook |
| `~/.agents/codecrucible/samples/tiny-app` | Dry-run sample |
| `~/.agents/codecrucible/scan.md` | Defaults stub (no secrets) |

## BYOK (your keys, your bill)

Model spend is **yours**. Export env **names** only — never paste key values into skills or the repo:

- `ANTHROPIC_API_KEY` (or Claude Code login)
- optional: `OPENAI_API_KEY`, `GOOGLE_API_KEY`, `DATABRICKS_HOST` + `DATABRICKS_TOKEN`
- optional: `GH_TOKEN` to draft GitHub triage notes (human posts)

Config precedence is CodeCrucible's: flags > env > config file > defaults. Keep secrets out of git.

## Who this is for

- AppSec / eng leads who want **LLM-primary** SAST (whole-repo), not "LLM validates Semgrep hits only"
- Teams that need **SARIF** for GitHub Code Scanning or a review queue
- Operators who will **read findings** before anyone merges a "fix"

## Who this is not for

- Lights-out auto-remediation or auto-merge bots
- Zero-budget token free rides (scans cost real model dollars — use `--dry-run` and `--max-cost`)
- Compliance theatre that treats model output as a final CVE verdict without source verification

## Provenance

- Tool: [block/codecrucible](https://github.com/block/codecrucible)
- Blueprint essay: [CodeCrucible: A blueprint for LLM-driven SAST](https://engineering.block.xyz/blog/codecrucible-a-blueprint-for-llm-driven-sast) (Block Engineering)
- Signal: [jack on X](https://x.com/jack/status/2082358678498246935)
- Software Factory: Security × GitHub (SARIF path)

You own the microVM. You own the keys. You own the merge button.