Quick Reference

rafter run --format md

# `scan` is an alias for `run`
rafter scan --format md

# Fast scan (default)
rafter run --format md --mode fast

# Plus scan (agentic deep-dive — audits code like a professional cybersecurity analyst)
rafter run --format md --mode plus
rafter run --format md -m plus

# Pass a GitHub PAT directly
rafter run --github-token ghp_... --format md

# Or use an environment variable
export RAFTER_GITHUB_TOKEN=ghp_...
rafter run --format md

rafter run --repo myorg/myrepo --branch main --format md

rafter run --skip-interactive

rafter run --format md > security-report-$(date +%Y-%m-%d-%H-%M-%S).md

rafter run | jq -r '.vulnerabilities | length // 0'

# Count critical vulnerabilities
rafter run | jq '[.vulnerabilities[] | select(.level == "error")] | length'

rafter usage

rafter agent init                          # config only, detect agents
rafter agent init --risk-level aggressive  # set risk level
rafter agent init --with-claude-code       # install Claude Code integration
rafter agent init --all                    # install all detected integrations
rafter agent init --interactive            # guided setup with prompts

rafter agent init-project                  # generate instruction files for all platforms
rafter agent init-project --only claude-code,cursor  # specific platforms only
rafter agent init-project --list           # preview without writing

rafter secrets .              # scan current directory (respects .gitignore by default)
rafter secrets --staged       # scan git staged files only
rafter secrets --json         # output as JSON
rafter secrets --engine betterleaks  # force Betterleaks binary (default: auto-pick if installed)
rafter secrets --watch        # watch for changes and re-scan
rafter secrets --no-gitignore # scan everything, even files matched by .gitignore

rafter agent exec "git push"         # execute with risk assessment
rafter agent exec "rm -rf /" --force # bypass approval (not recommended)

rafter agent audit-skill path/to/skill.md

rafter agent install-hook           # current repo only
rafter agent install-hook --global  # all repos

rafter agent audit                       # view recent events
rafter agent audit --last 50             # last 50 events
rafter agent audit --event secret_detected  # filter by event type
rafter agent audit --agent claude-code   # filter by agent
rafter agent audit --since 2026-02-01    # filter by date

rafter brief                     # list available topics
rafter brief security            # local security briefing
rafter brief setup/claude-code   # platform-specific setup guide
rafter brief commands            # condensed command reference
rafter brief all                 # everything

rafter agent config show                              # view all config
rafter agent config get agent.riskLevel               # get a value
rafter agent config set agent.riskLevel aggressive    # set a value