Gadriel AI Code Assurance (GCA)

The problem is not that AI writes code. The problem is validating it at AI speed.

Source: Sonar, 2026 State of Code Developer Survey (1,100+ developers).

1. 1

   Install the CLI

   Install globally with npm, or run it on demand with npx (no install). Works on Linux, macOS (Intel + Apple Silicon), and Windows.

   bashCopy

   npm install -g gadriel

   • → Already installed? Upgrade: npm update -g gadriel
   • → Without installing: npx gadriel@latest --version
2. 2

   Authenticate with your token

   Paste the token you copied above. It's cached locally so you only do this once per machine (tokens expire in 30 days).

   bashCopy

   gadriel auth login --token "PASTE_YOUR_TOKEN_HERE"

3. 3

   Initialize your project

   From your repo root. This scaffolds .security/ and a .claude/ folder with the Gadriel slash-commands, reviewer agents, and skills. It also syncs the OSV vulnerability database for the languages it detects, so your first scan has CVE detection ready — no separate step needed.

   bashCopy

   cd your-project
   gadriel code init

   • → Only downloads the ecosystems your repo uses. Pass --skip-osv for air-gapped setups (the first scan will sync on demand instead).
4. 4

   Open your AI coding tool

   Launch the AI coding tool you already use in the same directory. Gadriel meets you where you work — Claude Code, Cursor, Windsurf, Aider, Continue, GitHub Copilot CLI, and more. The /gadriel-* slash-commands (or equivalent invocations) installed by init are available inside your session.

   bashCopy

   # If you use Claude Code
   claude
   
   # If you use Cursor / Windsurf / VS Code-based tools
   cursor .        # or: windsurf .  |  code .
   
   # If you use a CLI agent (Aider, Continue, Copilot CLI, etc.)
   aider           # or your tool's launch command

   • → Don't see your tool? Any AI coding assistant that can run shell commands works — point it at the gadriel CLI directly: gadriel code scan
5. 5

   Run your first scan

   Inside Claude Code, type the slash-command. It scans the whole repo (SAST, secrets, dependencies, license, AI-specific risks), writes findings to .security/findings.json, and auto-generates an HTML report.

   bashCopy

   # in Claude Code
   /gadriel-scan

   • → Scope it to a folder if you like: /gadriel-scan src/auth
6. 6

   Open the results

   The scan drops a self-contained HTML report at .security/reports/index.html. Open it in your browser:

   bashCopy

   open .security/reports/index.html      # macOS
   xdg-open .security/reports/index.html  # Linux
   start .security/reports/index.html     # Windows

   • → Need compliance PDFs (EU AI Act, NIST AI RMF, OWASP…)? Run /gadriel-reports → .security/compliance/
7. 7

   Ask Claude to fix problems

   Each finding has an ID (e.g. CODE-W1-L1-001). Hand one to Claude and it proposes — and where safe, applies — the fix, then re-scans to confirm it's resolved.

   bashCopy

   # in Claude Code
   /gadriel-fix CODE-W1-L1-001

   • → Or just ask in plain English: “Fix the critical findings from the last Gadriel scan.”

Gadriel's rigor, applied to code

Code Assurance is not a generic scanner. It inherits the same eight-pillar frame that defines Gadriel AI Behavior Assurance (GBA) — same vocabulary, same audit-defensible evidence.

Common questions