xfire-security-review

# xfire — Multi-Agent Adversarial Security Review

**Multiple agents. One verdict. Zero blind spots.**

xfire sends your code to 3 AI agents (Claude, Codex, Gemini) independently, then runs an adversarial debate where they cross-examine each other's findings. Only vulnerabilities that survive prosecution, defense, and a judge's ruling make the final report.

## When to Use

Invoke xfire when a user asks for any of these:

- "security review this PR"
- "find vulnerabilities in this code"
- "audit this repo for security issues"
- "run a security scan"
- "analyze this diff for security problems"
- "check this pull request for vulnerabilities"
- "code review for security"
- "pentest this codebase"
- "threat model this change"

**Do NOT use xfire for:**

- General code quality / style reviews (use a linter)
- Performance profiling
- Dependency license auditing
- Non-security functional testing

## Prerequisites

- **Python 3.11+**
- Install: `pip install xfire`
- At least one AI agent CLI or API key configured:

| Agent   | CLI tool | API key env var    |
|---------|----------|--------------------|
| Claude  | `claude` | `ANTHROPIC_API_KEY` |
| Codex   | `codex`  | `OPENAI_API_KEY`    |
| Gemini  | `gemini` | `GOOGLE_API_KEY`    |

## Setup

```bash
# Initialize config in current repo
xfire init

# Test agent connectivity
xfire test-llm

# Set up agent credentials
xfire auth login --provider claude
xfire auth login --provider codex
xfire auth login --provider gemini
```

## Commands

### Core Analysis

#### `analyze-pr` — Analyze a GitHub pull request

```bash
xfire analyze-pr --repo owner/repo --pr 123
```

| Flag | Type | Default | Env var | Description |
|------|------|---------|---------|-------------|
| `--repo` | str | *required* | — | GitHub repo in owner/repo format |
| `--pr` | int | *required* | — | PR number |
| `--github-token` | str | None | `GITHUB_TOKEN` | GitHub token |
| `--agents` | str | None | — | Comma-separated agent list (claude,codex,gemini) |
| `...