Elite Application Security Engineer Agent

A defensive, full-spectrum Application Security CLI agent powered by xAI Grok via the official xai-sdk.

It is built for real AppSec work — secure code review, threat modeling, cloud/DevSecOps guidance, supply-chain analysis, LLM/app agent security — with a hardened client that treats user content, files, and tool output as untrusted data.

Defense only. This agent is designed to harden systems, not weaponize attacks. It will not generate real exploits or operational attack code.

---

Highlights

Area	What you get
AppSec depth	Principal-level secure code review, authn/authz, API/web/mobile, cloud, CI/CD, supply chain, crypto footguns, threat modeling, vuln prioritization, AI/LLM AppSec
Agent tools	web_search, x_search, sandboxed code_execution, optional collections + MCP, vision/file attachments
Local workspace tools	Read-only, path-sandboxed read_workspace_file / list_workspace_dir
Hardened client	Secret redaction, sensitive-path deny list, SSRF-aware URL checks, tool allowlists, size limits, untrusted-content isolation
Secure defaults	API key only from env/.env, no shell/exec tools, low temperature for precise analysis

---

Architecture (high level)

┌─────────────────────────────────────────────────────────────┐
│  You (CLI)                                                  │
│   text · /file · /image                                     │
└───────────────────────────┬─────────────────────────────────┘
                            │ untrusted content wrapped
                            ▼
┌─────────────────────────────────────────────────────────────┐
│  appsec_agent.py  (secure-by-design client)                 │
│  · input limits · secret redaction · path sandbox           │
│  · https-only remote attachments · allowlisted local tools  │
└───────────────┬─────────────────────────────┬───────────────┘
                │                             │
                ▼                             ▼
     xAI Grok (agentic)              Local workspace (RO)
     web / X / code_exec             read + list only
     optional MCP / collections      .env & keys blocked

---

Security posture

This project practices what it preaches:

• No secrets in git — .env is gitignored; only .env.example is published
• API key from environment only — never hardcoded
• Workspace sandbox — local paths cannot escape APPSEC_WORKSPACE (symlink-aware)
• Sensitive path deny list — blocks .env, PEM/keys, cloud creds, kubeconfig, etc.
• Secret redaction — best-effort redaction of key-shaped values before model I/O
• Untrusted content isolation — user/file data wrapped so it is treated as data, not instructions
• Prompt-injection resistant policy — immutable defensive control plane in the system prompt
• Remote attachment SSRF guards — https:// only; blocks localhost / private / link-local / metadata hosts
• No shell, no eval, no write tools — client tools are read-only and allowlisted

Honest limit: no LLM agent is mathematically unbreakable. This stack is defense-in-depth (policy + sandbox + redaction + allowlists).

---

Quick start

1. Prerequisites

• Python 3.10+ (developed/tested with 3.14)
• An xAI API key from console.x.ai

2. Clone and set up

git clone https://github.com/<your-username>/<your-repo>.git
cd <your-repo>

python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate
pip install -r requirements.txt

3. Configure secrets (local only)

cp .env.example .env
# edit .env and set:
#   XAI_API_KEY=xai-...your real key...

Never commit .env. It is already listed in .gitignore.

4. Run

Interactive:

python appsec_agent.py

Single-shot:

python appsec_agent.py -q "Threat model a multi-tenant SaaS JWT session design"

Custom workspace root (sandbox for /file, /image, local tools):

python appsec_agent.py --workspace /path/to/codebase

---

Usage

CLI commands

Command	Action
help	Show help
status	Show config (API key masked)
clear	Fresh conversation (new cache key)
exit / quit / q	Leave

Attachments

/image screenshots/login.png  Find authz issues in this UI flow
/file  src/auth.py            Review session handling for IDOR
/image https://example.com/diagram.png  Explain trust boundaries

• Local paths are confined to the workspace
• Remote URLs must be https to public hosts

Example prompts

Review this FastAPI dependency for BOLA and injection. Cite CWE/OWASP and give a fixed snippet.

Threat model an OAuth2 BFF for a SPA: assets, actors, STRIDE table, residual risk.

Map this GitHub Actions workflow to supply-chain risks and hardening controls (SLSA-minded).

Assess this RAG + tool-calling agent for prompt injection and data exfil paths (OWASP LLM Top 10).

---

Configuration

All configuration is environment-driven. See .env.example for the full list.

Variable	Purpose	Default
XAI_API_KEY	xAI API key (required)	—
XAI_MODEL	Model id	grok-4.5
XAI_REASONING_EFFORT	none | low | medium | high	high
XAI_SERVICE_TIER	default | priority	default
XAI_TEMPERATURE	Sampling temperature (clamped 0–1)	0.2
XAI_MAX_TURNS	Server-side tool loop cap	50
APPSEC_WORKSPACE	Local sandbox root	current working directory
APPSEC_ENABLE_LOCAL_TOOLS	Enable read/list workspace tools	1
XAI_COLLECTION_IDS	Comma-separated collection IDs	empty
XAI_MCP_SERVER_URL	Optional HTTPS MCP endpoint	empty
XAI_WEB_ALLOWED_DOMAINS	Optional web_search allowlist (max 5)	empty

---

Project layout

.
├── appsec_agent.py    # Agent + hardened client
├── requirements.txt   # Minimal runtime deps
├── .env.example       # Safe template (no secrets)
├── .gitignore         # Ignores .env, venv, keys, caches
├── LICENSE            # MIT
└── README.md

---

Publishing checklist (for maintainers)

Before you push to GitHub:

1. Confirm .env is not staged: git status should never list .env
2. Confirm no live keys in tracked files: search for xai- outside .env
3. Keep only .env.example with placeholders
4. Prefer a fine-scoped API key you can rotate if anything ever leaks
5. If a key was ever committed, rotate it immediately in console.x.ai and purge history

# Sanity checks (run from repo root, venv optional)
git status
git check-ignore -v .env          # should report .gitignore
grep -R "XAI_API_KEY=xai-" --exclude-dir=venv --exclude-dir=.git . || true

---

Disclaimer

For authorized defensive security work and education. You are responsible for compliance with laws and your organization’s policies. This is not a penetration-testing exploit framework and not formal compliance certification advice.

---

License

MIT — see LICENSE.