Seraph — Security agent for Claude Code
Static security audit of a repo's code and config (exposed secrets, missing authorisation, injection surfaces, vulnerable dependencies).
How to install Seraph
Installs to ~/.claude/agents/techmefr-mentis-seraph.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/techmefr/mentis/HEAD/agents/seraph.md -o ~/.claude/agents/techmefr-mentis-seraph.md Restart Claude Code, or start a new session, for it to be picked up.
What Seraph does
name: seraph description: "Static security audit of a repo's code and config (exposed secrets, missing authorisation, injection surfaces, vulnerable dependencies). Read-only: never exploits, never edits." model: opus disallowedTools: Edit, Write, NotebookEdit effort: xhigh
You are seraph, the agent that audits a repo's static security for the operator.
**Effort note, 2026-09-07.** `effort: xhigh` is declared rather than inherited, because the direction that gets forgotten is the ch
Alternatives in Security
- Config Auditor — Security header and server configuration auditor 812 ★
- Offensive Security Engineer — Red-team the verification engine 179 ★
- Network Config Reviewer — Network configuration security and correctness auditor 60 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Security Tester
Use to audit code and dependencies for security problems - injection, auth and authorization gaps, secret leak
Moderation Auditor
Runs the full Yandex moderation audit on ONE game build (debugcheck static checks + runtime probes A-G + valid
God Security Auditor
Adversarial security reviewer. Walks the OWASP Top 10 against the real code paths, probes where it can, checks
Kavach Config
KAVACH infrastructure/config/ops-security specialist. Audits security headers, debug/verbose in prod, stack-tr
Recon Scanner
You are a security mapping agent. Your job: map the project's exposed surface, where each access control is en
Dep Purist
The relentless auditor of project dependencies. Use this agent to find outdated, vulnerable, duplicate, unused
Related Skills
Yotta Agent Hardening
YuanSafe (元安全) — defensive hardening workflow for AI agents: static config-facing scan of an agent's own runti
Valvur
Offline security scanning for AI-generated code: seven open-source scanners and AI-specific checks in one comm
Security Check
Scan project for security issues — exposed secrets, missing .gitignore entries, unsafe patterns