secure-coding-agent

Secure Coding Agent

A security-first workflow layer for Claude Code and OpenCode-based agents.

Secure Coding Agent turns subscription-based coding CLIs into a structured secure development workflow with planning, implementation, review, reporting, and rollback built in.

• Coordinate Claude Code, OpenCode, Codex, and optional review runtimes through explicit roles instead of ad hoc prompting.
• Keep security inside the development workflow, not as a disconnected afterthought.
• Install a reproducible workflow with config, commands, checkpoints, CI validation, and docs.

Why this exists

AI-assisted development is productive, but the default workflow is still weak:

• prompts are inconsistent
• model roles are implicit
• security review is often bolted on too late
• rollback and reproducibility are usually missing

Secure Coding Agent exists to answer a specific problem:

How do you turn AI coding CLIs into a disciplined, security-aware workflow that is usable by real engineers?

This project treats AI-assisted development as a systems problem:

• role orchestration
• safe defaults
• reproducible installation
• policy-aware review
• explicit operational boundaries

Quickstart

Recommended: let an agent install it

Copy and paste this prompt into your agent session:

Install and configure secure-coding-agent in this repository by following the instructions here:
https://raw.githubusercontent.com/raomaster/secure-coding-agent/main/docs/guide/installation.md

Use curl to fetch the guide.
Default to --host auto.
Keep the security layer enabled unless I explicitly ask to skip it.
If oh-my-openagent / oh-my-opencode is already present, install the OMO-aware setup.
Only ask questions if the host setup is genuinely ambiguous.

Fallback: run the CLI yourself

Run it from the root of the project you want to bootstrap:

npx secure-coding-agent

Install into a different project without changing directory:

npx secure-coding-agent /path/to/project

What you get

Secure Coding Agent installs a two-layer workflow:

Layer 1: npx agent-security-policies  -> security rules, policies, baseline agent guidance
Layer 2: npx secure-coding-agent      -> orchestration, role config, pipeline commands

Core roles:

Role	Default CLI / model	Responsibility
Planner	Claude Sonnet 4.6 or OpenCode host	Research, decomposition, orchestration
Coder	Claude Haiku 4.5 or OpenCode host	Implementation workers
Reviewer	Gemini 3.1 Pro or OpenCode host	Security review
Reporter	Gemini Flash or OpenCode host	Executive reporting
Specialist	Codex o4-mini	Second opinion / complex problem solving

How it works

flowchart TD
    A["Developer request"] --> B["/plan<br/>Planner"]
    B --> C["Task breakdown<br/>and security surface analysis"]
    C --> D["/code<br/>Coder workers"]
    D --> E["Checkpoint + rollback safety"]
    E --> F["/review<br/>Reviewer"]
    F --> G["/report<br/>Reporter"]
    G --> H["Decision-ready output"]

Key design choices:

• Role-driven orchestration: each model has a defined job
• Host-aware install: claude-code, opencode, and opencode-omo install different surfaces
• Config-driven runtime: .multi-agent.json controls the preferred stack and runtime commands
• Rollback-first safety: agent output can be reverted cheaply
• Security-first workflow: review is part of delivery, not a separate ritual

Stable today

These flows are part of the current v0.2.x stable surface:

• npx secure-coding-agent
• prompt-based install via docs/guide/installation.md
• positional target path support
• --host auto|claude-code|opencode|opencode-omo
• .multi-agent.json installation and role configuration
• built-in create-skill skill
• OmO custom agents for opencode-omo
• /plan, /code, /review, /report, /full-cycle
• /checkpoint, /rollback, /roles
• TypeScript installer + bash installer
• npm run verify
• CI validation on GitHub Actions

Experimental today

These capabilities are intentionally shipped as preview / evolving workflows:

• /lint
• /security-review
• deeper MCP-based shared context and scanner orchestration

The goal is to keep the core reliable while higher-value workflows mature in public.

Who this is for

Secure Coding Agent is built for:

• engineers using AI coding tools who want a more disciplined workflow
• AppSec / product security engineers experimenting with agent-assisted delivery
• engineering leads who want reproducible AI workflows instead of prompt folklore
• builders creating internal tooling around secure AI development

It is not positioned as:

• a generic “AI wrapper”
• a replacement for your existing CI/CD platform
• a fully autonomous software factory

What makes it different

Most AI coding tools optimize for raw generation speed.

Secure Coding Agent optimizes for:

• security-aware execution
• role governance across models
• structured review and reporting
• operational reproducibility
• installation into existing repos, not only greenfield repositories

The differentiator is not “more models”. The differentiator is security-first orchestration for AI coding workflows.

Proof

This repository includes the artifacts needed to evaluate the project as a serious engineering system:

• Architecture
• Design Decisions
• Use Cases
• Compatibility Policy
• Skills Reference
• Usage Walkthrough
• Example Project

Validation:

npm run verify

That runs:

• build
• unit and installer tests
• package dry-run

Compatibility

Supported baseline:

• Node.js >=18
• macOS and Linux are validated in CI
• Windows/WSL is roadmap-level support, not yet first-class

Required CLIs depend on the workflow you want:

Capability	Requirement
Orchestration install	Node.js + npm
Full security layer	agent-security-policies install path via npx
Claude host mode	@anthropic-ai/claude-code
OpenCode host mode	opencode
OpenCode + OmO host mode	opencode + oh-my-openagent
Optional Codex specialist role	@openai/codex
Optional Gemini review/reporting	@google/gemini-cli

See docs/compatibility.md for explicit behavior and limitations.

Commands

Stable workflow commands

Command	Purpose
/plan	Explore the codebase and produce a structured implementation plan
/code	Delegate implementation to the configured coder
/review	Run AI security review with the configured reviewer
/report	Generate executive output from findings
/full-cycle	Execute the end-to-end workflow
/checkpoint	Create a manual safety checkpoint
/rollback	Restore a previous checkpoint
/roles	Show or change role assignments

Preview commands

Command	Purpose
/lint	Run language-aware linting
/security-review	Run a broader static + AI review workflow

Packaged reusable skill

Skill	Purpose
create-skill	Create or refine repo-local skills using the project skill contract

Installation details

Prerequisites

# Claude Code
npm i -g @anthropic-ai/claude-code

# Gemini CLI
npm i -g @google/gemini-cli
gemini auth login

# Codex CLI
npm i -g @openai/codex
codex

From npm (fallback/manual)

# Run in the current project
npx secure-coding-agent

# Let the installer infer the host from the repo
npx secure-coding-agent --host auto

# Force OpenCode + oh-my-openagent mode
npx secure-coding-agent --host opencode-omo

# Install globally if preferred
npm i -g secure-coding-agent
secure-coding-agent

# Advanced: install into another project
npx secure-coding-agent /path/to/project

From source

git clone https://github.com/raomaster/secure-coding-agent.git
cd secure-coding-agent
npm install
npm run verify

What gets installed

Layer 2 from this package installs:

• CLAUDE.md for claude-code hosts
• AGENTS.md for opencode and opencode-omo hosts
• .multi-agent.json role configuration with host-aware defaults and optional .secure-coding/ persistence settings
• .claude/commands/* for claude-code and opencode-omo
• .opencode/command/* for plain opencode
• create-skill in .claude/skills/ or .opencode/skills/ depending on host
• OmO custom agents in .claude/agents/ for opencode-omo
• OmO built-ins remain untouched; secure-coding-agent only adds complementary project agents
• optional .claude/settings.json for Claude Code MCP

Roadmap

Near-term roadmap:

• richer .secure-coding/ persistence and artifact workflows
• stronger OpenCode / OmO command specialization
• optional role validation and smarter diagnostics
• MCP-backed shared memory and scanner orchestration
• CI-native review workflows and artifacts

See ROADMAP.md for the full progression.

Credits

• Security policies foundation: agent-security-policies
• Workflow inspiration from role-specialized coding agent systems and practical secure development pipelines