Skip to content
Agentic Suite

Self-host the daemon

The daemon reviews a configured set of repositories on a cadence. It is opt-in and safe by default: with no config it does nothing.

Configure

Create the config file, then edit it:

Terminal window
uv run python -m app.cli.security_review config-init

This writes ~/.agentic_suite/security-review.json. Override the path with SECURITY_REVIEW_CONFIG.

{
  "enabled": true,
  "dry_run": true,
  "cadence_minutes": 60,
  "repos": [
    {
      "kind": "local_repo",
      "repo": "/srv/your-repo",
      "organization_id": "YOUR_ORG_UUID",
      "enabled": true
    }
  ],
  "scope": { "deny": ["your-org/secret-*"] },
  "holds": ["your-org/your-repo#7"]
}

Fields:

  • enabled: the daemon does nothing until this is true.
  • dry_run: keep true to review without posting anything.
  • cadence_minutes: how often the sweep runs.
  • repos: each entry maps a repository to an organization. A local repository uses a filesystem path; a pull request uses owner/name with pr_number.
  • scope.deny: glob patterns that are always excluded.
  • holds: repository or repo#pr keys to skip.

Run it

The daemon runs as a Celery Beat task named security-review-scan, registered automatically. You need:

  • A Celery worker consuming the run_execution queue.
  • Celery Beat running.

Each sweep reviews every enabled repository in dry-run. Deduplication by head commit means an unchanged repository is not reviewed again. One repository that fails never stops the rest of the sweep.

Keep reports off-host

Report files are written under ~/.agentic_suite/security-reviews. Point that directory at a mounted volume with SECURITY_REVIEW_REPORT_DIR if you want the reports on durable or shared storage.