Multi-language CLI for Rafter — the security toolkit built for AI coding agents and the developers who use them.
This repository also configures its own agents. See what rafter-cli tells them →
Cursor rule Cursor
REQUIRED before declaring a task done when the diff touches user input, SQL, shell, auth, credentials, file paths, serialization, or dependency surface. Walks OWASP/ASVS/MITRE questions the compiler and the test suite won't catch. Pair with rafter run on the same diff. A security-relevant task marked complete without…
Cursor rule Cursor
REQUIRED before writing code for any feature touching auth, payments, credentials, tokens, sessions, file upload, user data, or data deletion. Invoke it, record answers inline in the design doc or PR description, then write the code. Skipping this is how auth bypass, token leakage, and delete-the-wrong-record bugs…
Cursor rule Cursor
REQUIRED before copying any third-party SKILL.md, MCP manifest, Cursor rule, or agent config into this machine or forwarding one to a user. Installing a skill grants Read/Bash/network under your identity — this is curl | sh in a different costume. Do not install, load, recommend, or forward any third-party agent asset…
Cursor rule Cursor
Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs rafter run (remote SAST+SCA), rafter secrets (local secrets-only), rafter audit, policy checks, or command-risk evaluation. If a task is security-relevant and no rafter skill or CLI call has been made, invoke this before handing the…
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: