Keep private code local.
Securist tells teams what their humans and coding agents may bring into production—and reopens that permission when reality changes. The free Local Operator is a Node CLI in the Securist monorepo—not an Electron desktop app, not a cloud uploader.
Source in the monorepo. Build + run securist doctor / securist assess .
Without a release-signed runtime identity, doctor reports runtime_unavailable and assess is blocked. That is intentional.
Public npx @securist/operator, signed package install claims, Team Graph sync, or automatic share of local briefs.
Monorepo commands
- 01 · Clone the monorepo
git clone https://github.com/wantzjt/securist-hub.git && cd securist-hub
- 02 · Install dependencies
npm ci
- 03 · Build the Operator CLI
npm run operator:build
- 04 · Doctor (trust status)
npm run securist -- doctor
- 05 · Assess the current directory
npm run securist -- assess . --intended-use "Local engineering review"
Package @securist/operator remains private. Public npx install is not available until a human-signed distribution ships.
After a successful local assess, IDE agents can read a minimized brief over stdio only:
npm run securist -- mcp
Tools: get_brief, list_gaps, get_run_metadata. No execute, approve, shell, or external write tools.
- What is this artifact?
- What did Securist actually observe?
- What remains unknown?
- What should happen next—and who owns it? (durable after Team Graph)
Local briefs are local_only and never automatically shareable.
Monorepo package @securist/operator · private · not published.
Free path is individual and private. Paid Team Graph is shared memory: owners, policy, evidence, and re-review when artifacts change—not token metering.
Team Graph (coming next)Human-signed release candidates and clean-machine verification are documented in the monorepo release lane. Contact securist_info_sec@protonmail.com for design-partner questions—no unsolicited private data.