gadievron/raptor

Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.

What it solves

RAPTOR is an autonomous security research framework designed to automate the discovery, validation, and patching of vulnerabilities in codebases and binaries. It replaces manual security audits with a pipeline that chains together static analysis, binary analysis, and LLM-powered validation to find real, exploitable bugs rather than just pattern-matching noise.

How it works

RAPTOR operates as an orchestration layer built on top of Claude Code, integrating several specialized tools:

  • Scanning: Uses Semgrep, CodeQL, and Coccinelle to perform static analysis and identify potential vulnerabilities.
  • Validation Pipeline: A multi-stage process (Stages A-F) that uses LLMs to determine if a finding is a true vulnerability, if it is reachable from an external attacker, and if it is actually exploitable.
  • Binary Analysis: Performs evidence-first investigation of compiled artefacts using tools like radare2 and Frida, building a call graph and mapping ingress points to identify vulnerabilities in binaries.
  • SMT Integration: Uses Z3 to check path satisfiability in CodeQL and verify the feasibility of binary gadgets.
  • SCA: Conducts Software Composition Analysis to identify vulnerable dependencies and supply-chain risks.
  • Automation: The /agentic command runs the full end-to-end workflow from mapping the attack surface to generating exploit PoCs and secure patches.

Who it’s for

Security researchers, penetration testers, and developers who need to automate the vulnerability research process for both source code and compiled binaries.

Highlights

  • Autonomous Workflow: Fully automates the pipeline from initial scan to exploit generation and patch writing.
  • Multi-Model Support: Supports various LLMs (Claude, GPT, Gemini, Mistral, Ollama) for the analysis dispatch layer.
  • Deep Binary Analysis: Includes tools for black-box binary investigation, fuzzing with AFL++, and root-cause analysis for C/C++ crashes.
  • SCA Integration: Comprehensive supply-chain analysis that goes beyond simple CVE lookups to include reachability and hygiene checks.
  • Air-gapped Support: Ability to cache static analysis rules for use in offline environments.
  • Sandboxed Execution: Runs LLM-generated code in a restricted environment using Linux namespaces and seccomp to handle untrusted repositories safely.

Related

  • Project
    anthropics/defending-code-reference-harness

    A reference implementation for autonomous vulnerability discovery and remediation that uses Claude to find, verify, and patch security bugs in source code.

  • Project
    adshao/flounder

    An autonomous white-hat security auditor that turns coding agents into an end-to-end system for target preparation, vulnerability discovery, and execution-backed exploit construction.

  • Project
    ipa-lab/hackingBuddyGPT

    An open-source framework for building LLM-driven security-testing agents that automates tasks like privilege escalation and web pentesting.

  • Project
    samugit83/redamon

    An autonomous AI framework that automates the security pipeline from reconnaissance and exploitation to AI-driven triage and automated code fixes via GitHub pull requests.

  • Project
    openai/codex-security

    A CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in code using AI, featuring support for multiple LLM providers and bulk scanning.