[farchide]

Adds Gadriel Code Assurance, a local AI code security harness that scans AI-generated code and agent skills for SAST vulnerabilities, hardcoded secrets, vulnerable dependencies (SCA/SBOM), container image issues, IaC/config misconfigurations, and OWASP LLM Top 10 / Agentic AI risks. It runs locally via CLI (@gadriel_ai/cli), MCP server (io.github.Gadriel-ai/gadriel), or IDE plugin for Claude Code, Cursor, GitHub Copilot, VS Code, and Codex without sending source code off the machine.

Disclosure: I am a maintainer of Gadriel AI.

Tool requirements

• The tool is at least six months old (gadriel.ai registered January 3, 2026; proprietary CLI and IDE plugins available via npm @gadriel_ai/cli, VS Code Marketplace GadrielAI.gadriel-security, and GitHub repositories under Gadriel-ai; manual review applies to proprietary service launch timeline).
• The tool has at least 20 GitHub stars (N/A — license: proprietary; manual review required per CONTRIBUTING.md).
• The tool has more than one contributor (N/A — license: proprietary; manual review required per CONTRIBUTING.md).
• The description is no longer than 500 characters (355 characters).
• I have not changed README.md directly.

Supporting links for proprietary tool review

• Install & try locally: npm install -g @gadriel_ai/cli (npm package @gadriel_ai/cli), VS Code Marketplace (GadrielAI.gadriel-security), and Official MCP Registry (io.github.Gadriel-ai/gadriel)
• Public code analyzed & benchmark results:
  • Gadriel Vulnerable CBOM Benchmark (Gadriel-ai/gadriel-vulnerable-cbom) — cryptographic bill of materials and weak-crypto static analysis test corpus with documented findings.
  • Gadriel SCA Multi-Ecosystem Test Corpus (Gadriel-ai/gadriel-sca-test) — multi-language SCA/SBOM vulnerability detection test suite across 11 package ecosystems.
• Documentation & scanner output reference: Gadriel Code Assurance Documentation
• Open-source IDE & agent integrations:
  • Claude Code plugin (Gadriel-ai/gadriel-claude-plugin)
  • Cursor plugin (Gadriel-ai/gadriel-cursor-plugin)
  • GitHub Copilot plugin (Gadriel-ai/gadriel-copilot-plugin)

AI tags, if applicable

• ai-generated-code — Gadriel Code Assurance is specifically designed as a local security harness for AI-generated code and agentic skills (skill), running deterministic local SAST, secrets, SCA/SBOM, container, IaC, and OWASP LLM Top 10 checks before commits or PRs.
• uses-llm — Omitted because the local static analysis engines (SAST, secrets, SCA, container, config, and deterministic AI pattern checks) run locally without requiring an LLM call during analysis.

[github-actions]

Contributing criteria check

[REVIEW] Gadriel Code Assurance

Note: Thanks for sharing your tool! For proprietary tools, please include public links in your PR description showing:

• Code the tool has analyzed and the results.
• Someone outside the team using the tool or reviewing it in detail.
• That the tool has been publicly available for at least six months, and where to install or try it.

Marketing claims, download counts, or an older domain aren't enough on their own. We need these examples even if you've linked a GitHub repository.

Already included these? Thanks! A maintainer will need to review them; rerunning CI won't clear this check. If you need more time to gather examples, you're welcome to resubmit when they're ready.

Criterion	Result
Stars (min 20)	skip N/A
Human contributors (min 2)	skip N/A
Homepage domain age (min 6 months; RDAP record)	pass Domain registered on January 3, 2026 (at least six months ago). Service age still requires manual review.

---

Thank you for your contribution. One or more criteria could not be verified automatically, so this pull request needs manual review and will not be closed automatically. Please provide evidence for the unverified contribution criteria, or retry the check if an external API was unavailable.

[mre]

Thank you for your submission. I appreciate that you included references to analyzed code. However, it is difficult to determine whether these examples come from actual client usage or internal testing.

At this stage, there is limited publicly available evidence to help assess the maturity and adoption of the service. Customer testimonials or endorsements on the website, public case studies featuring organizations that have used the product, or independent reviews on platforms such as Trustpilot or G2 would help establish its credibility.

For now, I would prefer to hold off on adding the project until more evidence of real-world adoption becomes available.