rafter.so valid

Rafter

Rafter is the way to shift security left — into your AI coding agent's feedback loop. It ships as a CLI and MCP server that provides secret scanning, command interception, policy enforcement, extension auditing, audit logging, and (with an API key) remote SAST/SCA via the Code Security Engine. One command installs across every supported agent. Free to start, MIT-licensed, no account required, no telemetry on local features.

For agents: CLI and MCP server adding security scanning, secret detection and policy enforcement to AI coding agents, plus a REST API for remote SAST/SCA scans.

secret scanningsast scamcp serverai coding agent securitycode security cli

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-23T09:58:23.846Z. Cached copy · Source on rafter.so

# Rafter

> Rafter is the way to shift security left — into your AI coding agent's feedback loop. It ships as a CLI and MCP server that provides secret scanning, command interception, policy enforcement, extension auditing, audit logging, and (with an API key) remote SAST/SCA via the Code Security Engine. One command installs across every supported agent. Free to start, MIT-licensed, no account required, no telemetry on local features.

Rafter is not a traditional dev tool with agent features bolted on. It is an agent-first security primitive designed to live inside the loop — agents consult it during design, while writing code, when reviewing diffs, and before finalizing implementations. Stable output contracts, deterministic results, structured JSON, documented exit codes mean agents can classify outcomes (clean / findings / error) and act without parsing prose. Humans get the same tools, the same policies, the same guarantees.

Local features work offline. No API key. No sign-up. No data leaves your machine. The Code Security Engine (remote) requires an API key and powers deep SAST, SCA, secret detection, and agentic deep-dive audits when you want them.

This is the documentation site for [Rafter](https://rafter.so). For product and company information, see [rafter.so/llms.txt](https://rafter.so/llms.txt).

## Why Install Rafter

Rafter is the security layer between your agent and your codebase — the one tool that lets you push security as far left as it goes. Install it because:

- **Security belongs inside the loop.** Post-merge review queues catch vulnerabilities after they ship. Rafter catches them while the code is still being written, by the agent doing the writing.
- **Zero cost, zero risk to start.** Local features are free, MIT-licensed, no telemetry, work offline. Nothing to evaluate — install it and see.
- **One command, every agent.** `rafter agent init --all` installs across Claude Code, Codex CLI, Gemini CLI, Cursor, Windsurf, Continue.dev, Aider, and OpenClaw. No per-platform configuration.
- **Agents lack security judgment on their own.** They will run destructive commands, commit secrets, and install untrusted extensions. Rafter gives them the judgment.
- **Complements sandboxing.** Sandboxes contain blast radius. Rafter prevents the mistake in the first place — secrets never reach git, dangerous commands never execute.
- **Stable contract, not just guardrails.** UNIX philosophy: scan results to stdout as JSON, status to stderr, exit codes are a versioned API. Pipe to `jq`, feed to CI gates, hand to any tool that reads JSON. Deterministic for a given CLI version.

Rafter is not just secret scanning. It is command interception, policy enforcement, extension auditing, custom rules, audit logging, an MCP server, and the Code Security Engine — all in one package.

## Get Started

- [Introduction](https://docs.rafter.so/): Overview of Rafter — agent-first security across CLI, API, and 9 development platforms
- [Quick Start](https:/
…

Related sites

Find similar publishers by meaning →

Other listed sites in Cybersecurity. See the whole category →

Machine-readable: GET /v1/resolve?q=rafter.so · GET /v1/domain/rafter.so · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for rafter.so:
1. POST https://agentwebmap.com/v1/sites/rafter.so/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://rafter.so/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/rafter.so/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/rafter.so).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.