auditx
One Command Multi-Scanner Security Audit & AI Guardrail CLI — 2026
Tech Stack
My Role
Architected the TypeScript CLI engine, parallel scanner orchestrator, file-hash cache layer, MCP server integration, and agent-mode JSON reporting.
Team
Timeline
2026 • Security, CLI & Systems
Overview
auditx eliminates the fragmented developer experience of security auditing. Today, conducting a complete security audit requires learning multiple CLI tools, managing binary installations, and manually consolidating conflicting JSON schemas. auditx unifies this entire workflow into a single, zero-config command (npx auditx@latest .) that executes in seconds. Architecturally, auditx operates across a 4-phase pipeline: 01 DETECT (walks workspace 4 levels deep auto-detecting package.json, pyproject.toml, go.mod, Dockerfile, *.tf, tsconfig.json, Prisma schemas across Node.js, Python, Go, Rust, Docker, and SQL), 02 RUN (CPU-aware orchestration with cost weights 1–3, using an LPT greedy queue to fill CPU cores without overloading the host machine), 03 NORMALIZE (synthesizes findings from up to 22 parallel scanners into a single finding schema with stable fingerprints), and 04 OUTPUT (dispatches results across 5 flexible formats: terminal TTY, Markdown PR comments, HTML dashboards, CI JSON, and single-line --output agent JSON). To power modern AI-assisted software engineering, auditx is built for the agentic coding era. Its built-in Model Context Protocol (MCP) server (auditx-mcp) and --output agent JSON contract provide Claude Code, Antigravity, Cursor, and Codex with deterministic issue fingerprints, file maps, and fix guidance. This enables AI agents to parse security findings, execute automated LLM patch loops (apply_llm_patch), and verify fixes until the codebase is clean—100% locally with zero cloud telemetry. Benchmark tests show auditx executing under 10 seconds locally compared to 45s+ cloud uploads for Snyk or multi-minute SonarQube builds.
What I Built
- 4-phase pipeline architecture: Detect (4 levels deep) → Run (CPU-aware LPT) → Normalize → Dispatch
- CPU-aware scanner scheduler assigning cost weights (1–3) across CPU cores for maximum parallel throughput
- Stack auto-detection across Node.js, TypeScript, Python, Go, Rust, Docker, Terraform, React, Next.js, Express, Django, SQL, and Prisma
- 22 parallel scanners grouped into 4 domains: Security & Vulnerabilities, Code Quality, AI Anti-Patterns, and Project Health
- Multi-format reporting: terminal TTY table, Markdown (audit-report.md), HTML dashboard, SARIF, and --output agent JSON
- Agentic-coding loop integration (--output agent & auditx-mcp) providing stable issue fingerprints and fix guidance for LLM repair loops
- Additional CLI modes: --watch for continuous re-audits, --fix for auto-remediating issues, --ci exit gates, and Git hooks installer
- 100% local, zero-telemetry execution running complete AST and vulnerability scans in under 10 seconds
System Impact & Engineering Metrics
Orchestrated in a single local CPU-aware pipeline
Sub-10s complete scan execution compared to cloud scanner delays
Zero code, tokens, or dependency data sent to third-party clouds
Key Highlights
22 Parallel Scanners
Aggregates Gitleaks, Trivy, Semgrep SAST, IaC misconfigs, and 100+ AI anti-patterns into a unified local scan.
CPU-Aware Orchestrator
LPT greedy queue allocates scanner cost weights across CPU cores for optimal parallel execution without host throttling.
Built for Agentic Coding
Single-line --output agent JSON and MCP server allow Claude Code, Cursor, and Codex to parse findings and run fix loops.
Interested?
Want to explore auditx?
An open-source, zero-config CLI security scanner and MCP server aggregating 22 parallel static analyzers, secret detectors, CVE scanners, and AI anti-pattern checkers into a single command.