Hi Everyone! I built Ocherfort because most security tools gave me fragments, not decisions. One tool found secrets. Another found dependency issues. Another checked CI. Another helped explain risk. But none of them gave a clean, local-first workflow that answered: what is wrong, what matters, what maps to standards, and are we actually safe to ship? That was the idea behind Ocherfort. I wanted a tool that works directly on a repo, keeps evidence local, stores every run, maps findings to frameworks like CWE, OWASP, and NIST, and adds real ship/no-ship gates instead of just dumping alerts into the terminal. A big design choice was separating deterministic scanning from AI. The AI in Ocherfort can explain, coach, and prioritize, but it cannot invent findings or silently change the result. That boundary mattered a lot while building it. As the project evolved, it expanded beyond normal code scanning into workflows, release safety, supply chain risks, and even agentic surfaces like prompts, skills, and MCP configs. Modern repos are bigger than app code, so the scanner had to reflect that reality. This launch is the start of that vision. If you try it, I’d love feedback on the CLI experience, the gates, the standards coverage, and what security surfaces you want Ocherfort to understand next.

Ocherfort

Ship secure code with evidence, not guesswork

Ship secure code with evidence, not guesswork