rafter-security

Rafter Security

Local security toolkit for developers. Scans code, enforces policies on commands, audits extensions, and prevents vulnerabilities.

Overview

Rafter provides real-time security checks for agent operations:

• Secret Detection: Scan files before commits
• Command Validation: Block dangerous shell commands
• Skill Auditing: Comprehensive security analysis of Claude Code skills
• Output Filtering: Redact secrets in responses
• Audit Logging: Track all security events

---

Setup

To initialize Rafter, use opt-in --with-* flags to select integrations. There are NO --skip-* flags.

# Install specific integrations (opt-in)
rafter agent init --with-openclaw
rafter agent init --with-claude-code --with-betterleaks

# Install everything detected
rafter agent init --all

# WRONG — these flags do not exist:
# rafter agent init --skip-openclaw    # DOES NOT EXIST
# rafter agent init --skip-claude-code # DOES NOT EXIST

---

Commands

/rafter-scan

Scan files for secrets before committing.

rafter secrets <path>

When to use:

• Before git commits
• When handling user-provided code
• When reading sensitive files

What it detects:

• AWS keys, GitHub tokens, Stripe keys
• Database credentials
• Private keys (RSA, SSH, etc.)
• 21+ secret patterns

Exit codes:

• 0 — clean, no secrets
• 1 — secrets found
• 2 — runtime error (path not found, not a git repo)

JSON output (--json): Array of {file, matches[]} objects. Each match contains pattern (name, severity, description), line, column, and redacted value. Raw secrets are never included.

---

/rafter-bash

Explicitly run a command through Rafter's security validator.

rafter agent exec <command>

When to use: Only needed in environments where the PreToolUse hook is not installed. When rafter agent init has been run, all shell commands are validated automatically — you do not need to route commands through this.