OpenAI open-sourced its security-scanning agent

A CLI and TypeScript SDK that scans repositories, paths, or diffs against a branch for vulnerabilities, defaulting to gpt-5.6-sol at extra-high reasoning effort, emitting JSON, CSV and SARIF, registrable as an MCP server, and accepting custom knowledge bases such as threat models and architecture docs. No benchmarks are published in the README. It reached 503 points and 170 comments on Hacker News in about 13 hours, read live at 06:15 EDT on July 29; Michael D'Angelo, a Promptfoo co-founder now at OpenAI, answered questions in the thread.

Why it matters: SARIF output and MCP registration mean this drops into an existing verification loop rather than asking for a new one. Treat the absence of published benchmarks as the open question it is.