raptor: An Autonomous Security Research Framework for Claude Code

Vulnerability research usually means juggling five tools and a notes file. RAPTOR — Recursive Autonomous Penetration Testing and Observation Robot — chains the whole loop inside a Claude Code session: static analysis, binary analysis, LLM-powered vulnerability validation, exploit generation, and patch writing, run against a codebase or binary you are authorized to test. The author list reads like a security conference lineup: Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), Michael Bargury, and John Cartwright.

Why This Skill Matters

RAPTOR is a framework, not a single skill: the raptor launcher wraps your Claude Code session with pre-flight trust checks, environment sanitizing, and coverage tracking before the agent starts. The README is refreshingly honest about maturity — "it is not polished software... held together with enthusiasm and duct tape" — and about its construction: mostly AI-generated code, with humans setting direction, reviewing output, and making design decisions while mechanical verification (tests, static analysis, corpus calibration) holds the quality bar.

The safety engineering is the part worth copying. Untrusted-content subprocesses are sandboxed with Linux namespaces, Landlock, and seccomp; network access is blocked from the sandbox; dangerous environment variables are stripped at startup; and file paths from scanned repos are never interpolated into shell strings.

Installation

Manual install takes a few commands:

git clone https://github.com/gadievron/raptor.git
cd raptor
pip install -r requirements.txt
npm install -g @anthropic-ai/claude-code
pip install semgrep
export PATH="$PATH:$PWD/bin"
raptor

The container route is what the authors recommend — isolating an agent that analyzes untrusted repositories is standard security practice. The image is around 6 GB:

docker pull danielcuthbert/raptor:latest
docker run -it -v "$(pwd):/workspaces/raptor" raptor:latest

Real Workflow: First Scan of a Codebase

The cheapest run is pure static analysis — no LLM calls, no API keys beyond Claude Code itself:

/scan /path/to/code

RAPTOR runs Semgrep (plus Coccinelle when installed; add --codeql for CodeQL), deduplicates findings, and writes a SARIF report — a few minutes on a typical repository.

Real Workflow: LLM-Validated Findings

When you want the full pipeline, switch to the agentic run:

/agentic /path/to/code

Every finding passes through staged LLM validation (stages A-F). The README's calibration: a medium-sized codebase with around 50 findings takes 10-30 minutes and $2-8 in analysis-layer costs, with a default cost cap of $10 per run that you can adjust via --max-cost-usd. The orchestration layer runs on your Claude subscription; only external analysis models (OpenAI, Gemini, and so on) bill separately.

Tips

• Always use the raptor launcher rather than plain claude — running Claude Code from a different directory gives you plain Claude Code with no RAPTOR configuration.
• Start with /scan before /agentic; read the SARIF output first and spend LLM budget only on findings worth validating.
• The container route doubles as blast-radius control — mount only the target folder you are analyzing.
• CodeQL is optional but recommended; note its license does not permit commercial use.

When Not to Use This

Use RAPTOR only against codebases you are authorized to test — your own code, engagements in scope, or research targets with permission. It is a research framework by admission, not a compliance-grade scanner, and its exploit-generation stages have no place outside authorized work. If you just want a quick dependency audit, a plain Semgrep run without the framework is lighter.

See the leaderboard for more skills.