absec

Production CLI + rules engine for web-app security gates — by Agent Breach.

Complements Agent Breach DAST. No account required. Not a penetration test or SOC 2 attestation.

60-second win

npm i -D @agentbreach/absec
npx absec init
npx absec check --fail-on medium

Gate OpenAPI auth gaps:

npx absec openapi ./openapi.json --fail-on high

Check local app headers (localhost only by default):

npx absec headers http://127.0.0.1:3000

Packages

Package	Role
@agentbreach/absec	CLI (absec)
@agentbreach/absec-core	Shared analyzers + SARIF (used by absec-mcp and absec-assert)

Commands

• absec init — config + GitHub Actions workflow
• absec check [paths] — static rules (secrets, JWT none, cookie smells, authz hints)
• absec openapi <file> — securitySchemes / write-path auth
• absec headers <url> — CSP/HSTS/XFO (use --allow-remote only on systems you own)
• absec baseline create|verify — fail only on new findings
• absec hook install — git pre-commit
• absec sarif / --format sarif — Code Scanning

Config (absec.config.json)

{
  "severityThreshold": "medium",
  "disabledRules": [],
  "ignorePaths": ["**/node_modules/**", "**/dist/**"],
  "baselinePath": ".absec-baseline.json"
}

Inline suppressions: # absec-ignore: ABSEC-JWT-001

Safety

• No default telemetry (ABSEC_TELEMETRY=1 to opt in — reserved, currently unused)
• Non-localhost HTTP blocked without --allow-remote
• See SECURITY.md

License

Apache-2.0 © Agent Breach