← Projects

Project · Go · MIT

sarifix experimental

Turns any SARIF-emitting scanner into a verified fixer. Today it diffs, plans and reports findings, and tells Claude Code about the ones its changes introduced.

Source Docs
shell 
brew install rossedman/tap/sarifix

sarifix reads SARIF from the scanners you already run (Trivy, Checkov, golangci-lint, Semgrep, gitleaks or your own) and works out what’s new, what’s fixed and what could be fixed. The goal is an agent that fixes findings in small single-rule batches and proves each fix by re-running the scanner and your tests. That part is still on the roadmap.

What works today:

  • Any scanner, through config. Each one is an argv list in sarifix.yaml, run without a shell.
  • Fingerprints that ignore line numbers, so sarifix diff reports a finding that moved as unchanged.
  • sarifix check --hook as a Claude Code Stop hook. Claude fixes the findings its own changes introduced before it finishes, and never sees the existing backlog.
  • sarifix plan groups findings into single-rule batches and says why each skipped one was skipped.
  • fix --mode report writes enriched SARIF and a JSON summary, with no edits.

The docs site has tutorials on real repositories and explains how fingerprints work.

Writing about sarifix

  1. Introducing sarifix: Make Your Scanners' Findings Fixable sarifix reads SARIF from the scanners you already run, tracks findings across scans without relying on line numbers, and hands Claude Code the findings its own changes introduced so it fixes them before it finishes. 9 min read