Run an audit without pretending certainty.
SecHelix is an Agent Skill and an evidence contract for scoped application-security reviews. Every page here describes behaviour that exists in the public framework repository. Where something has not been measured, it says so.
546explicit hypotheses across 21 families and 26 lenses
17model-neutral specialist role profiles
15JSON Schema Draft 2020-12 contracts
9evidence adapters that normalize, not scan
76paired eval cases across 38 fixtures
0.950blind label-suite precision; full workflow NOT_MEASURED
Install
npx skills@latest add omarmohelal/SecHelix --skill sechelixWorks for Claude Code, Codex, Cursor, and other Agent Skills clients.
Then point your coding agent at a repository you own or are explicitly authorized to test. The skill locks scope before any active testing. Continue with Quickstart or read What is SecHelix first.
Getting Started
What SecHelix is, how to install it, and how to run a first audit safely.
What is SecHelixSecHelix is an evidence-first application-security Agent Skill: it treats every scanner alert and model suspicion as a hypothesis until an evidence chain survives independent verification.InstallationInstall the SecHelix skill with the Agent Skills CLI, or copy the portable bundle into Claude Code, Codex, Copilot, and other hosts. Includes the truthful compatibility matrix.QuickstartThe five-minute path from install to a release decision: scope, map, select, hunt, verify, fix, regress, retest, report, gate.Execution ModesSTATIC, LOCAL, STAGING, and PRODUCTION_SAFE define how much dynamic traffic a run may generate. Mode is recorded in the scope record before any testing.Your First AuditA worked first run on a repository you own, with the scope record fields to fill in, what each phase should produce, and how to read the result honestly.
Using SecHelix
Task-shaped runs. Each one is an instruction to your coding agent, not a separate binary.
Full AuditThe complete workflow across a repository: map first, select only applicable hypotheses, hunt in parallel lanes, verify independently, fix root causes, prove regressions, gate the release.PR ReviewScope a run to a diff: changed trust boundaries and dataflows, new or weakened controls, and a verdict of verified blocker, known risk, or no evidence-backed regression.Authorization ReviewBuild a role by object by action matrix and test BOLA/IDOR, BFLA, tenant isolation, ownership, mass assignment, and database policy gaps separately from the API layer.Business LogicTreat state machines, payment truth, idempotency, and race windows as security surfaces. Replay, partial success, late callbacks, and double-spend windows are in scope.AI & MCPAudit prompt and context provenance, tool authorization, MCP servers, memory, and autonomous side effects. Nondeterminism is not exploitability.Fix ModeRepair the canonical invariant rather than the symptom, find sibling variants of the same defect, and leave a regression test that fails before the fix and passes after it.Release GateRun the policy gate over a canonical report. It returns PASS, PASS_WITH_KNOWN_RISK, BLOCKED, or INCOMPLETE, and fails closed on missing or malformed evidence.
Core Concepts
The contracts that decide whether a claim is allowed to become a finding.
Evidence StandardThe nine links a verified vulnerability should establish: attacker control, reachability, boundary failure, safe reproduction, impact, preconditions, root cause, fix, and regression proof.Attack SurfaceThe mapping phase builds entrypoints, identities, trust boundaries, assets, state machines, and a role by object by action matrix from evidence rather than assumption.ApplicabilityEvery hypothesis is labelled APPLICABLE, NOT_APPLICABLE, UNKNOWN, or BLOCKED before testing. Missing evidence is never treated as absence.Independent VerificationA verifier receives the candidate as a claim to disprove, without the hunter narrative or the desired verdict. Agreement between models is not verification.Variant HunterAfter a verified root cause, the deterministic variant hunter compares sibling paths against the seed invariant and returns EXACT, VARIANT, REFUTED, or BLOCKED.Regression ProofA fix is finished when a test fails against the vulnerable control and passes after the repair, at the layer where the invariant actually lives.Release DecisionsFour release outcomes with fail-closed semantics, and the rules that stop UNKNOWN or BLOCKED coverage from being laundered into a PASS.
Tooling
How external scanner output enters the evidence contract.
Reference
The machine-readable side: contracts, report formats, the catalog, packs, and extensions.
SchemasFifteen JSON Schema Draft 2020-12 contracts covering scope, attack surface, applicability, evidence, findings, reports, catalog, extensions, knowledge, research, and Gold Check Packs.Report FormatOne canonical report-v1 document renders to Markdown, redacted JSON, SARIF 2.1.0, and escaped standalone HTML. Redaction and escaping are part of the renderer, not an afterthought.CatalogThe coverage model is 21 security families by 26 verification lenses, producing 546 explicit hypothesis records with stable IDs. Each record is a review question, not a claim.Gold PacksGold Check Packs deepen a selected catalog hypothesis with a threat model, detection layers, false-positive filters, refutation tests, and regression fixtures. They cannot mark themselves verified.Extension APIThe community extension contract: a manifest that declares every permission it needs, a curated registry, fixture proof, and the COMMUNITY to INCUBATING to OFFICIAL lifecycle.
Teams
Running SecHelix inside an organization alongside the tooling you already have.
Enterprise AdoptionA four-phase rollout: baseline one service, add a private policy pack, wire the gate into CI and pull requests, then measure the metrics that matter.CI/CDGenerate the canonical report in one job, run the policy gate in a separate fail-closed step, and treat exit codes 1 and 2 as non-green. Includes forked pull request rules.Private Policy PacksKeep real role names, trust boundaries, severity overrides, and accepted-risk approvals in a private repository. The public examples describe mechanics only.Risk AcceptancePASS_WITH_KNOWN_RISK requires an owner, a reason, an approval time, and an expiry. A model may summarize an accepted risk; it may not approve one.Production SafetyWhat PRODUCTION_SAFE permits and forbids, which proofs belong in local or staging fixtures, and how evidence retention is classified and redacted.
Research
What has been measured, what has not, and why the difference is published.
Evaluation MethodologyThe record every published run must carry, and the six metrics SecHelix is willing to be judged on. A screenshot is not a benchmark artifact.Benchmark StatusThe blind label suite has one uncontaminated run: precision 0.950, detection recall 1.000, false-positive rate 0.053 across 76 cases. It is label-only, so full-workflow metrics stay NOT_MEASURED.Case StudiesThe first end-to-end run against a real application: one verified and fixed finding, one high-severity candidate refuted, and a stale build cache that nearly faked a fix.