Your agent writes the code. Rig checks it for security problems, gives the agent useful findings, and checks its fixes.
Free to use. No account required. Works with Claude Code and Codex.
Checks that understand your project
Most scanners use generic security rules that catch familiar patterns, but your application also has its own database helpers, input handling, and access rules. Rig customizes security rules to match your unique project.
During setup, Rig helps your agent look over your project’s code and security requirements to prepare checks for those details. Those security checks are run every time your agent implements changes to ensure vulnerabilities are not introduced.
- Set up once. Ask your agent to set up Rig for the project.
- Keep coding. Rig checks changes through your agent’s workflow.
- Review the result. The agent addresses findings and Rig checks the changes again.
Frequently asked questions
Where does Rig run? Does it upload my code?
Rig’s security scans run locally on your computer. Rig does not upload any code for remote scanning. Downloads and rule updates can require internet access. Your coding agent’s own data settings still apply to its use of your code.
Do I need an account or subscription?
No. Rig is free to use and does not require a Rig account. Your coding agent may use its tokens and usage while setting up checks or fixing code.
Does it work with my language?
Rig supports a wide range of languages and file formats. See What Rig Checks for the full list and the security categories it targets. The checks available depend on your project and its configured rules.
What will setup change?
Setup prepares project checks and connects them to your agent. Review the proposed configuration with your agent before saving it. Your agent makes source-code fixes through its usual editing workflow.
Does a passing check mean my application is secure?
No. It means the checks that completed did not report a problem within their scope. Missing rules, unsupported code, and security requirements that have not been defined can leave gaps.
Can I stop using it?
Yes. You can disable the integration or remove the plugin. See Troubleshooting.