Crack Code

AI-powered security auditor for your codebase.

Scans for vulnerabilities, explains findings with exact code references, and optionally applies fixes — all from your terminal.

---

Features

• 🛡️ Security-first — finds injections, hardcoded secrets, auth flaws, SSRF, XSS, and more
• 🤖 Provider-agnostic — Anthropic, OpenAI, Google, or Ollama with one flag
• 🔒 Read-only by default — never modifies files unless you explicitly allow it
• ⚡ Streaming — results appear in real-time as the AI analyzes
• 🧰 Agentic — reads files, lists directories, runs commands, and writes fixes
• 🔐 Permission-gated — every destructive action requires your approval
• 💬 Interactive + one-shot — use as a REPL or a single command

Install

bun install -g crack-code

Requires Bun v1.0+

Quick Start

# First run — setup wizard picks provider, model, and API key
crack-code

# One-shot scan
crack-code "scan this project for vulnerabilities"

# Target specific code
crack-code "check src/auth/ for authentication flaws"

# Interactive REPL
crack-code -i

# Enable file editing
crack-code --allow-edits "fix the SQL injection in src/db.ts"

# Skip permission prompts (use with caution)
crack-code --yolo "scan and fix everything"

CLI Options

-i, --interactive          Force interactive REPL mode
--setup                    Re-run the setup wizard
--allow-edits              Enable file writing (read-only by default)
--provider <name>          Override provider (anthropic, openai, google, ollama)
--model <name>             Override model
--key <key>                Override API key
--policy <policy>          Permission policy (ask, skip, allow-all, deny-all)
--scan <glob>              Only scan files matching this pattern
--max-steps <n>            Max agent steps (default: 30)
--max-tokens <n>           Max output tokens per response (default: 16384)
-h, --help                 Show help
-v, --version              Show version

REPL Commands

Command	Description
/help	Show available commands
/exit	Exit the REPL
/clear	Clear conversation history
/usage	Show token usage for this session
/mode	Toggle read-only ↔ edit mode
/model	Show current model and provider
/policy	Show or set permission policy
/compact	Summarize conversation to reduce context size

Tools

The AI agent has access to these tools during analysis:

Tool	Description	Approval
read_file	Read file contents with line numbers	No
list_files	List files matching a glob pattern	No
run_command	Execute shell commands	Yes
write_file	Write/overwrite files (edit mode)	Yes

Configuration

Config is stored at ~/.crack-code/config.json and created automatically on first run.

# Re-run setup anytime
crack-code --setup

Environment Variables

Variable	Provider
ANTHROPIC_API_KEY	Anthropic
OPENAI_API_KEY	OpenAI
GOOGLE_GENERATIVE_AI_API_KEY	Google
OLLAMA_ENDPOINT	Ollama

If set, the setup wizard will detect and offer to use them.

Piped Input

# Pipe code directly for analysis
cat src/db.ts | crack-code

License

MIT