# sarifix

> Turns any SARIF-emitting scanner into a verified fixer. Today it diffs, plans and reports findings, and tells Claude Code about the ones its changes introduced.

- URL: https://rossedman.io/projects/sarifix/

`sarifix` reads SARIF from the scanners you already run (Trivy, Checkov, golangci-lint, Semgrep, gitleaks or your own) and works out what's new, what's fixed and what could be fixed. The goal is an agent that fixes findings in small single-rule batches and proves each fix by re-running the scanner and your tests. That part is still on the [roadmap](https://rossedman.io/sarifix/roadmap/).

What works today:

- **Any scanner, through config.** Each one is an argv list in `sarifix.yaml`, run without a shell.
- **Fingerprints that ignore line numbers**, so `sarifix diff` reports a finding that moved as unchanged.
- **`sarifix check --hook`** as a Claude Code Stop hook. Claude fixes the findings its own changes introduced before it finishes, and never sees the existing backlog.
- **`sarifix plan`** groups findings into single-rule batches and says why each skipped one was skipped.
- **`fix --mode report`** writes enriched SARIF and a JSON summary, with no edits.

The [docs site](https://rossedman.io/sarifix/) has tutorials on real repositories and explains how fingerprints work.