Your API key starts with RF and should be kept secure. Never commit it to version control (e.g. GitHub). Use environment variables instead.
3
Start your first scan
Navigate to a Git repository, then run:
cd /path/to/your/reporafter run --api-key "RFabc-your-api-key-here" --format md
Or set the key as an environment variable and skip the flag:
export RAFTER_API_KEY="RFabc-your-api-key-here"cd /path/to/your/reporafter run --format md
The CLI auto-detects your repository and branch from Git, then displays scan results in your terminal.
rafter scan is an alias for rafter run — use whichever you prefer. Add --mode plus (or -m plus) for deeper analysis with additional agent passes beyond the default fast scan.
Rafter’s local features work with zero setup — no API key, no sign-up:
# Set up agent security for all detected platformsrafter agent init --all# Scan for secrets locallyrafter scan local .
This gives you secret scanning, pre-commit hooks, command interception, and audit logging — all offline, all free. See the agent security guide for details.
The whole point of Rafter is that your agent should be the one reaching for it — during design, while writing code, when reviewing diffs, before finalizing changes. Paste this prompt into Claude Code, Cursor, Codex, Windsurf, Aider, or any other agent so security becomes part of its loop instead of an afterthought:
Use Rafter as a lightweight security layer throughout your development process.Rafter is an open-source CLI that helps identify vulnerabilities, prevent secretleaks, audit dependencies and extensions, and provide security context as you build.If it's not initialized yet, run: npx rafter-cli agent init --all(No API key required)Use Rafter to shift security left:- during design and planning, to anticipate risks (auth, data flow, permissions, integrations)- while writing and modifying code, especially around sensitive logic- when reviewing changes or diffs- before finalizing implementationsTreat it as part of your workflow:- check for issues early and iteratively- incorporate findings into implementation decisions- fix what's straightforward and call out non-trivial risks- avoid patterns that could lead to vulnerabilities, secret exposure, or unnecessary privilege expansionThe goal is not just auditing after the fact, but continuously informing saferdesign and implementation choices.With an API key (RAFTER_API_KEY), unlock the Rafter Code Security Engine to deeplyanalyze your project with SAST, SCA, secret detection, agentic deep dives, and more.Docs: https://docs.rafter.so/llms.txtRepo: https://github.com/Raftersecurity/rafter-cli
Set RAFTER_API_KEY in your shell or your agent’s environment so every scan it runs goes through the Code Security Engine — you stop thinking about security; the agent never stops doing it.
