Quick Reference

rafter run --format md

# `scan` is an alias for `run`
rafter scan --format md

# Fast scan (default)
rafter run --format md --mode fast

# Plus scan (deeper analysis with additional agent passes)
rafter run --format md --mode plus
rafter run --format md -m plus

rafter run --repo myorg/myrepo --branch main --format md

rafter run --skip-interactive

rafter run --format md > security-report-$(date +%Y-%m-%d-%H-%M-%S).md

rafter run | jq -r '.vulnerabilities | length // 0'

# Count critical vulnerabilities
rafter run | jq '[.vulnerabilities[] | select(.level == "error")] | length'

rafter usage

rafter agent init                          # auto-detect agents
rafter agent init --risk-level aggressive  # set risk level
rafter agent init --codex                  # force Codex CLI detection
rafter agent init --claude-code            # force Claude Code detection

rafter agent scan .              # scan current directory
rafter agent scan --staged       # scan git staged files only
rafter agent scan --json         # output as JSON
rafter agent scan --engine gitleaks  # use Gitleaks engine

rafter agent exec "git push"         # execute with risk assessment
rafter agent exec "rm -rf /" --force # bypass approval (not recommended)

rafter agent audit-skill path/to/skill.md

rafter agent install-hook           # current repo only
rafter agent install-hook --global  # all repos

rafter agent audit                # view recent events
rafter agent audit --limit 50     # last 50 events
rafter agent audit --risk high    # filter by risk level

rafter agent config show                              # view all config
rafter agent config get agent.riskLevel               # get a value
rafter agent config set agent.riskLevel aggressive    # set a value