OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Sec Af

Sec Af is an open-source AI-native code security auditor built on AgentField. It assesses application vulnerabilities and produces exploitability verdicts, traces, and actionable evidence.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Sec Af — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it when a code-security review needs exploitability analysis and traceable evidence alongside vulnerability findings.

Who it is for

  • Developers reviewing application code for security issues.
  • DevSecOps teams triaging and prioritizing vulnerability findings.
  • Security practitioners examining GraphQL or CWE-oriented application risks.

Documented uses

  • Audit a repository for application vulnerabilities.
  • Trace suspected data flows from source to sink.
  • Distinguish confirmed, likely, inconclusive, and non-exploitable findings.
  • Attach code locations and evidence to security findings.
Before you choose

Requirements & limits

The repository is public and displays an Apache 2.0 license. The documented examples use the AgentField `af` CLI or a local HTTP API request; the repository also identifies Python 3.11+ as a project requirement.

  • Findings include a verdict, proof object, data-flow trace, and exact code location.
  • The documented verification design separates vulnerability hunters from agents that test or challenge their conclusions.
  • The repository demonstrates analysis across command injection, SQL injection, authentication, SSRF, credential, denial-of-service, and configuration issues.
  • The CLI example requires af version 0.1.87 or later.
  • The benchmark documentation reports results for a deliberately vulnerable GraphQL application, not a general guarantee for every codebase.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Submit a repository for an audit through the documented CLI

Start an audit by sending a repository URL to Sec Af with the AgentField CLI.

Before you start

  • The AgentField af CLI at version 0.1.87 or later.
  • A repository URL to audit.

Steps

  1. Run the af call sec-af.audit command.

  2. Pass the repository URL in the JSON repo_url input.

  3. Review the streamed progress and returned audit result.

Expected outcome

The CLI triggers the Sec Af audit and prints its result, including documented security findings and their supporting analysis.

Guide limitations

  • The documented example does not establish the full setup process, authentication requirements, or behavior for repositories other than the example input.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
30 September 2026
Original website title
Agent-Field/sec-af · Official homepage title · retained in its source language
How we review sourcesSuggest a correction