rafter

Run `rafter run` in the repository to trigger a remote SAST + SCA + secrets scan, which requires an RAFTER_API_KEY. Results come back as JSON with ruleId, severity, file, line, and confidence per finding, retrievable later via `rafter get <scan-id>`.

`rafter secrets` is a local, offline scan that only detects hardcoded credentials using regex and Betterleaks, with no API key needed. `rafter run` is the full remote analysis covering SAST, dependency CVEs, and secrets, and is the default for security-relevant work.

Yes, but only `rafter secrets` works without an RAFTER_API_KEY, and it only checks for leaked credentials rather than performing code security analysis. For SQL injection, SSRF, auth bugs, or dependency vulnerabilities, the remote scan with a key is required.

Use `rafter agent exec --dry-run -- <command>` to classify the command into low, medium, high, or critical risk tiers without executing it. Critical commands like irreversible deletions are blocked, while high-risk ones prompt for approval.

Add an `ignore` block in `.rafter.yml` listing the paths, optional rule names or IDs, and a written reason. Suppressed findings move to a `_suppressed` array and no longer affect the exit code, and the same block applies to both local and remote scans.

Use plus mode when fast mode flags something worth deeper investigation or before a release, since it performs agentic cross-file reasoning at higher cost and latency. It consumes paid credits, so confirm with the user before running it.