SuperFastClaw ships a built-in security agent with 6 analysis tools, plus a flexible runner that supports any custom agent defined in config.yaml. Agents run multi-turn, call tools, and stream results in real time.
The security agent is registered automatically — no configuration required. It has 6 tools that let it read, search, and analyse a codebase for vulnerabilities, secrets, and risky dependencies.
Reads a file with line numbers, buffered to a maximum of 500 lines. Provides the agent with full context of any source file.
Recursively lists files under a directory with configurable depth. Automatically skips .git, node_modules, and other noise.
Regex search across files with configurable context lines. Returns up to 100 matches with file path, line number, and surrounding context.
Walks a directory tree and flags files that are world-writable (0o002), setuid (0o4000), or setgid (0o2000).
Scans files for 12 secret patterns. Matches are redacted — only the type and location are reported. Handles AWS keys, GitHub tokens, private key PEM headers, DB connection strings, and more.
Reads go.mod or package.json and cross-references against a list of known-vulnerable or risky packages. Reports any matches with severity notes.
# CLI — audit a local project $ ./superfastclaw agent run security --input "Audit /path/to/project" # Read input from stdin $ echo "Scan /app for secrets and risky deps" | ./superfastclaw agent run security --stdin # Via WebSocket { "method": "agents.run", "payload": { "agent_id": "security", "input": "Audit /srv/app for vulnerabilities" } }
The Runner is a generic multi-turn loop. It calls the provider, receives tool calls, executes them, and appends results — repeating until the model has no more tool calls or max_turns is reached.
runState and the client receives agent.started / agent.done events.
Define prompt-only agents in config.yaml under the agents key. No code required — just a system prompt, a model, and a max turns limit.
agents: # Built-in security agent — no config needed # Run: ./superfastclaw agent run security default: provider: anthropic model: claude-sonnet-4-6 system_prompt: "You are a helpful assistant." max_turns: 20 code-reviewer: provider: anthropic model: claude-sonnet-4-6 system_prompt: "You are a senior engineer reviewing code for correctness, performance, and security." max_turns: 10 docs-writer: provider: anthropic model: claude-haiku-4-5-20251001 system_prompt: "You write clear, concise technical documentation in Markdown." max_turns: 5 analyst: provider: openai model: gpt-4o system_prompt: "You are a data analyst. Always respond with structured insights." max_turns: 15 options: temperature: 0.3
Agent interface in Go and register with agent.Register() in internal/agent/.
All agent interactions happen through these four methods and two events.
| Method / Event | Direction | Description |
|---|---|---|
| agents.list | → request | Returns all registered agent IDs and their config (provider, model, max_turns) |
| agents.run | → request | Starts a new agent run. Returns immediately; progress arrives via events. |
| agent.started | ← event | Fired as soon as the run goroutine begins. Payload: {run_id, agent_id} |
| agent.progress | ← event | Fired after each tool call with intermediate output |
| agent.done | ← event | Fired when the run completes. Payload: {run_id, output, turns_used} |
| agent.error | ← event | Fired if the run fails. Payload: {run_id, error} |
// → Start a security audit { "id": "req-42", "method": "agents.run", "payload": { "agent_id": "security", "input": "Audit /srv/myapp for vulnerabilities and exposed secrets", "provider": "anthropic", "model": "claude-sonnet-4-6" } } // ← Immediate acknowledgement { "id": "req-42", "ok": true, "payload": { "run_id": "run-7f3a" } } // ← Progress events (asynchronous) { "event": "agent.started", "payload": { "run_id": "run-7f3a" } } { "event": "agent.progress", "payload": { "run_id": "run-7f3a", "tool": "list_files", "output": "..." } } { "event": "agent.done", "payload": { "run_id": "run-7f3a", "output": "Security report..." } }
# List all registered agents $ ./superfastclaw agent list security built-in 6 tools default anthropic claude-sonnet-4-6 code-reviewer anthropic claude-sonnet-4-6 docs-writer anthropic claude-haiku-4-5-20251001 # Run security agent on a directory $ ./superfastclaw agent run security \ --input "Audit /path/to/project for secrets and CVEs" # Run with a custom provider override $ ./superfastclaw agent run code-reviewer \ --input "Review the PR diff below" \ --provider openai \ --model gpt-4o \ --stdin < diff.txt