raptor

Why we included this project

Teams that want to automate vulnerability hunting without growing the analyst headcount will find a practical starting point here. RAPTOR is a security research framework built on Claude Code, though not locked to it: you can plug in your own analysis layer. It runs static scans with Semgrep and CodeQL, deduplicates the findings into a SARIF report, then has an LLM check each candidate issue for exploitability and even draft a patch. The /scan command does a quick static pass, while /agentic runs the full scan, validate, exploit, and fix stages end to end. Because the whole thing is rules, skills, and orchestration layered on Claude Code rather than a compiled black box, you can read and edit every stage, and swapping in a different model is a configuration change. It is rough around the edges and aimed at people comfortable running their own tooling, but for red teams and researchers it shows a credible way to turn an LLM coding agent into a security research engine.