Security at the speed of your agent

Seatbelt reads what your agents shipped, in one command.

$ npx withseatbelt

Hooks into Cursor, Claude Code, Codex, or Antigravity. Reads the project you hand it. The method, and the last thing it found

$ npx withseatbelt
Seatbelt latched to your agent
$ /seatbelt
reading the project you hand it: seven surfaces
code executionclear
loginnoted
paymentsworth a look
secretsmust fix
customer datanoted
databasesmust fix
risky shortcutsmust fix
Not cleared: 3 must fix.
report: withseatbelt.com/r/tUmWTWJ6…
$ /seatbelt fix
fixes applied and signed off by model
Cleared.
$ /seatbelt ship
gate clear, pushed. your app is live.
$
$ npx withseatbelt
Seatbelt latched to your agent
$ /seatbelt
reading the project you hand it: seven surfaces
code executionclear
loginnoted
paymentsworth a look
secretsmust fix
customer datanoted
databasesmust fix
risky shortcutsmust fix
Not cleared: 3 must fix.
report: withseatbelt.com/r/tUmWTWJ6…
$ /seatbelt fix
fixes applied and signed off by model
Cleared.
$ /seatbelt ship
gate clear, pushed. your app is live.
$

A replay of a real run on our leaky sample app: npx withseatbelt latches Seatbelt to your agent, /seatbelt reads the project across seven surfaces and returns the verdict not cleared, 3 must fix, with the report linked above. /seatbelt fix applies the fixes, signed off by model, and the re-check comes back cleared, then /seatbelt ship pushes with the gate clear.

Who it's for

Agentic coding is the new coding. You direct the agents; they write and ship apps that do real things: sign people in, take money, store data. The old review step is gone. Seatbelt is the read that no longer happens, built into the workflow you already have.

“Nearly half of all AI-generated code contains security vulnerabilities. Developers might catch these. Consumers won't.”
Justine Moore, a16z, Feb 3 2026, citing Veracode. Most people can't vibe code

Seatbelt is the check for that second half: a static read of your repo at git push, and a verifiable report that your fleet shipped securely.

withseatbelt-home

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /
title        Seatbelt: security at the speed of your agent
description  Seatbelt reads what your agents shipped: seven risk surfaces, one command, a shareable report. It publishes what it finds.

# pricing (USD)
ship-read   $0      npx withseatbelt in a project, or scan a URL at /app. All seven risk surfaces, a shareable report, unlimited runs, no account, no card. Not a trial, no expiry.
review      $250    a person reads your app before launch, independently of the agent that wrote it. Report ranked by severity with file and line, re-check after you fix. Three business days. Scope at /audit.
handoff     $1,500  the review plus a client facing summary and a signed attestation of what was checked, when, and by whom. Five business days.

# risk-surfaces
code_execution, login, payments, secrets, customer_data, databases, risky_shortcuts

# proof
a16z  "Nearly half of all AI-generated code contains security vulnerabilities. Developers might catch these. Consumers won't." Justine Moore, a16z, Feb 3 2026, citing Veracode.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.