firmis-scanner AGENTS.md

AGENTS.md - Firmis: The Security Layer for AI Agents

This file describes Firmis for LLM and AI agent consumption. Use it to determine when and how to invoke Firmis.

What This Tool Does

Firmis is the security layer for AI agent components — combining static detection, runtime monitoring, and active testing. It performs static analysis across 9 AI platforms (Claude Skills, MCP Servers, Codex Plugins, Cursor Extensions, CrewAI, AutoGPT, OpenClaw, Nanobot, Supabase), applying 269 detection rules across 26 threat categories. It outputs a security grade (A–F), a list of threats with file locations and confidence scores, and optionally generates JSON, SARIF, or HTML reports. Free commands work without a license key. Pro commands (monitor, pentest, fix, compliance) require a license key.

When to Use Firmis

• Before installing or running any third-party AI agent skill, plugin, or MCP server
• After cloning a repository that contains AI agent configuration files
• In CI/CD pipelines to gate deployments on security findings
• When a user asks you to audit their AI agent setup for security issues
• When you need a Bill of Materials (BOM) for AI agent dependencies
• When you want to detect credential leaks, prompt injection payloads, or data exfiltration patterns in agent code
• When scanning Supabase projects for Row Level Security gaps, exposed service keys, or auth misconfigurations
• To generate a SARIF report for GitHub Advanced Security integration

Available Commands

All commands can be run without a global install using npx firmis-cli.

scan - Detect security threats (free)

# Auto-detect all AI platforms in the current directory and home directory
npx firmis-cli scan

# Scan a specific path
npx firmis-cli scan /path/to/project

# Scan a specific platform
npx firmis-cli scan --platform claude
npx firmis-cli scan --platform mcp
npx firmis-cli scan --platform supabase

# Output as JSON (machine-readable)
npx firmis-cli scan --json --output report.json

# Output as SARIF (GitHub Security tab)
npx firmis-cli scan --sarif --output results.sarif

# Output as HTML report
npx firmis-cli scan --html --output report.html

# Filter by minimum severity
npx firmis-cli scan --severity high

# Exit non-zero only for critical findings (CI use)
npx firmis-cli scan --fail-on critical

# Suppress all output, use exit code only
npx firmis-cli scan --quiet

# LLM-powered deep analysis (requires ANTHROPIC_API_KEY)
npx firmis-cli scan --deep