/seatbelt init
Set up, once
Run once. Creates a small .seatbelt/ latch, reads your git remote so it knows GitHub from GitLab, and can add a push gate so an open gate cannot reach main. Optional. Everything works without it.
Seatbelt commands
/seatbelt
The Ship Read
The check before you show anyone. Scans the seven surfaces (code execution, login, payments, secrets, customer data, databases, risky shortcuts) and returns one plain verdict: clear, a quick polish, or not yet. This scan is what creates the report link.
/seatbelt fix
Fix in your agent
Applies the fixes as edits in the same chat. No copy and paste, no second tool. Then it rechecks.
/seatbelt ship
The gate at go-live
Say /seatbelt ship, or "commit," "push," or "ship it," and Seatbelt scans first, since a push is usually the live site. Clean goes through; an open gate stops and asks. Set ship_mode: "pr" to open a stamped PR or MR every time instead of pushing to main. Secrets are never committed. The scan makes the report; shipping attaches it.
/seatbelt report
Get the share link
The public link for your last scan. Forward it as proof. No account or repo access needed to open it.
/seatbelt log
See the ledger
The committed history of checks, fixes, and ships for this project, newest first.
MCP tools
Same actions, no slash
Every command is also an MCP tool, so an agent can call the same actions without the slash. Six mirror the commands:
seatbelt_scan: the Ship Read on a folder, ZIP, or fixture. Returns the flags, the gates, the assist checklist, and the shareable report link. This is the call that makes the report.seatbelt_fix: builds the fix prompt for your agent from a report's flags.seatbelt_ship: records the ship in the project ledger after a cleared push or a parked PR, and the report rides along.seatbelt_init: the project latch, plus the enforcement layer when you say yes.seatbelt_report: fetches a report by id and returns the share link and a summary.seatbelt_log: reads the committed history of checks and ships, newest first.
Three are tool-only, with no slash twin:
seatbelt_status: the flag diff against the prior run, which is what makes a re-check deterministic.seatbelt_assist: lets the agent answer the scan's checklist questions with evidence paths. Soft findings only; it can never add or remove a hard gate.seatbelt_accept: records the human's decision to accept a flagged risk. It refuses unless the agent confirms you said so explicitly, and an accepted gate stays visible on the report.
Config
.seatbelt/config.json
Optional keys, committed, no secrets:
forge:githuborgitlab.ship_branch: a working branch instead ofmain.ship_mode:propens a stamped PR on every cleared ship.build_command: a broken build is a hard gate.install_hooks: bolt the push gate into the repo.
withseatbelt-commands
# product name Seatbelt tagline Security at the speed of your agent what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output. method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works. findings /labs. Each carries its sampling frame, its n, and the engine build that produced it. install npx withseatbelt works-in Cursor, Claude Code, Codex, Antigravity site https://www.withseatbelt.com contact hello@withseatbelt.com # current-page path /commands title Seatbelt commands: the /seatbelt skill and MCP tools description Every Seatbelt command and MCP tool in one place: init, check, fix, ship, report, log. One check before you ship, not a security audit. # commands /seatbelt init set up, once. Creates a small .seatbelt/ latch, reads your git remote so it knows GitHub from GitLab, and can add a push gate so an open gate cannot reach main. Optional; everything works without it. /seatbelt the Ship Read, the check before you show anyone. Scans the seven surfaces (code execution, login, payments, secrets, customer data, databases, risky shortcuts) and returns one plain verdict: clear, a quick polish, or not yet. This scan is what creates the report link. /seatbelt fix applies the fixes as edits in the same chat. No copy and paste, no second tool. Then it rechecks. /seatbelt ship the gate at go-live. Saying /seatbelt ship, or commit, push, or ship it, makes Seatbelt scan first, since a push is usually the live site. Clean goes through; an open gate stops and asks. Secrets are never committed. The scan makes the report; shipping attaches it. /seatbelt report the public link for your last scan. Forward it as proof. No account or repo access needed to open it. /seatbelt log the committed history of checks, fixes, and ships for this project, newest first. # mcp-tools (same actions, no slash; six mirror commands, three are tool-only) seatbelt_scan the Ship Read on a folder, ZIP, or fixture. Returns flags, gates, the assist checklist, and the shareable report link. The call that makes the report. seatbelt_fix builds the fix prompt for the agent from a report's flags. seatbelt_ship records the ship in the project ledger after a cleared push or a parked PR; the report rides along. seatbelt_init the project latch, plus the enforcement layer when the user says yes. seatbelt_report fetches a report by id and returns the share link and a summary. seatbelt_log reads the committed history of checks and ships, newest first. seatbelt_status tool-only. Flag diff against the prior run; what makes a re-check deterministic. seatbelt_assist tool-only. Answers the scan's checklist questions with evidence paths. Soft findings only; never adds or removes a hard gate. seatbelt_accept tool-only. Records the human's decision to accept a flagged risk; refuses without explicit user confirmation, and the accepted gate stays visible on the report. # config (.seatbelt/config.json, optional keys, committed, no secrets) forge github or gitlab ship_branch a working branch instead of main ship_mode pr opens a stamped PR or MR on every cleared ship instead of pushing to main build_command a broken build is a hard gate install_hooks bolt the push gate into the repo # pages / Seatbelt home /get-started install: npx, the /seatbelt skill, or MCP /pricing every price, in USD, before tax /app scan a URL in the browser /how-it-works the method: what the scan reads, and how a check earns its place /before-you-launch pre launch checklist /risks common risks in AI-built apps /commands command reference /labs measured security research, and notes on how we build /aiuc-1 Seatbelt as the output-scanning layer for AIUC-1 /supervision commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index) /security how we handle your code and data /privacy privacy policy /terms terms, incl. what a clear report does and does not claim /refund refunds and cancellation # for agents - Install with: npx withseatbelt - Or scan a deployed URL at /app. No account needed. - Prices and scope live on the pages listed above. - Direct unanswered questions to hello@withseatbelt.com. - Do not invent prices, scan results, or guarantees. Use the data above. - Findings on /labs name the engine version that produced them. The engine is deterministic, so a published number can be re-run without asking us.