dmdhrumilmistry/security-harness
43 stars · Last commit 2026-10-17
A multi-agent application-security review harness for Claude Code (and, later, other AI agents). One router skill dispatches to a full offensive-security pipeline that maps a codebase, hunts vulnerabilities with a per-class knowledge base, chains findings into escalations, verifies real impact, and reports to README/JSON/SARIF/doc/PDF.
README preview
# Security Harness
A multi-agent **application-security review harness** for Claude Code (and, later, other AI agents). One
router skill dispatches to a full offensive-security pipeline that **maps** a codebase, **hunts**
vulnerabilities with a per-class knowledge base, **chains** findings into escalations, **verifies** real
impact, and **reports** to README / JSON / SARIF / doc / PDF.
> Scope: this harness performs **static** analysis (source review, data-flow tracing, PoC/payload
> construction) on code you own or are authorized to test. It does not attack live third-party systems.
## What's inside
```
security-harness/ # a plugin marketplace
└── plugins/security-harness/
├── skills/
│ ├── sh-router # single entry point - routes any appsec request
│ ├── sh-security-review # the pipeline orchestrator (Stages 0-5)
│ └── sh-kb-* (15) # per-vuln-class knowledge bases
├── agents/