⚡ Deterministic-First
Native tools (gitleaks, npm audit, AST parsers, custom regex harnesses) extract candidate locations in milliseconds. AI models never do work a static tool does faster, cheaper, and reliably.
Local-First
Zero Telemetry
Multi-Engine Auth
CI Schedulable
The Software Factory
A schedulable fleet of software-development-lifecycle (SDLC) agents that run locally under your existing developer session authentication (pi, claude, antigravity) and in CI on GitHub Actions.
Deterministic Scanners Enumerate.
AI Models Triage, Synthesize, and Judge.
Most agent systems either burn expensive token budgets reading thousands of irrelevant files, or run brittle heuristic scripts that produce noisy false positives. The Software Factory combines fast deterministic discovery with targeted AI verification.
🔑 Reuses Existing Session Auth
No new third-party API accounts or subscriptions needed. Runs locally using your active CLI session tokens (pi, claude, antigravity) and runs headlessly in CI with GitHub Secrets.
🛡️ Disprove-Only Verification
Discovery and verification operate in separate sessions. Discovery optimizes for recall; verification runs in a fresh, isolated session prompted strictly to disprove the finding before filing.
🎯 Stable Fingerprinting
Findings are keyed by sha256(agent:rule:path:snippet), deliberately omitting line numbers. Refactoring code around a finding preserves its identity and avoids duplicate alerts.
📦 Pluggable Issue Sinks
Verified findings route directly to whatever issue tracking system your repository uses: local Beads (.beads), public GitHub Issues, or private markdown delta reports.
🔒 Public Disclosure Guard
High and critical security vulnerabilities are never posted directly to public issue trackers. They are safely isolated into encrypted local files or draft security advisories.
Architecture & Pipeline
Every agent run follows a clean, three-phase lifecycle executed by the factory dispatcher:
1. Trigger
Manual CLI invocation, scheduled daemon (
launchd / cron), or GitHub Actions workflow dispatch.
2. Enumerate
Deterministic pre-pass scans target repository and inspects
THREAT_MODEL.md to produce structured candidate JSON.
Tools: gitleaks, npm audit, custom Python scanners
3. Triage & Judge
AI engine adapter (
pi, claude, antigravity) executes the agent's SKILL.md against candidate findings.
Fresh-context verification prompt tests for false positives
4. Dedupe
Findings store computes stable SHA-256 fingerprints, updates lifecycle states (OPEN, IN_PROGRESS, RESOLVED), and ignores known noise.
5. Sink
Output lands in local Beads issue database (
bd), GitHub Issues via gh CLI, or local markdown reports.
Available Agents & Lines
The factory includes pre-configured agents across security, code health, performance, and documentation:
Security & Vulnerabilities
secret-scan, threat-model, vuln-discovery, vuln-triage, vuln-verify, deps-supply-chain
Performance & Memory
bundle-size, memory-profile, perf-hillclimb, perf-review, resilience
Quality & Engineering
test-gap, pr-fixer, qa-station, issue-triage, modern-web, ui-ux-audit
Documentation & Releases
docs-drift, docs-write, release-notes, log-check
Quickstart & Setup
Set up the factory on macOS or Linux in less than two minutes.
1
Clone and install dependencies
Ensure Python 3.9+ and at least one coding CLI (pi, claude, or antigravity) is available in your PATH.
git clone https://github.com/PaulKinlan/agents.git
cd agents
./install.sh2
List available agents
Inspect all available agents, their required tools, and active configuration:
./factory list3
Run an agent against a target
Run against any registered target in targets/ or against any local directory:
# Run secret scan on a project
./factory run secret-scan --target /path/to/my-web-app
# Run threat modeling using the pi engine
./factory run threat-model --target /path/to/my-web-app --engine pi
# Output findings to a local markdown report
./factory run test-gap --target /path/to/my-web-app --sink file4
Schedule recurring fleet sweeps
Install scheduled jobs with launchd (macOS) or systemd/cron (Linux) to keep repos continually audited:
# Generate schedule definitions
./factory schedule --daily
./factory schedule --install