brainblast

The interesting design decision in brainblast is that it deliberately doesn't try to be a security scanner. It targets a specific failure mode: an AI agent writes plausible-looking integration code that is silently wrong in a way no linter flags and no test covers, because the bug is about a semantic contract — Stripe's raw-body requirement, Privy's signature and `aud`/`iss` checks, Solana's immutable on-chain config — rather than a syntax error. The checks map one-to-one onto those contracts, and the consequence column is written in money and auth terms (`creator earns zero fees forever`, `any payment_intent.succeeded can be forged`), which is exactly the framing you need when you're deciding whether to add a blocking CI step. Where it fits well: Node.js backends with Stripe webhooks or Privy auth, and Solana/Anchor projects where a config mistake is unfixable after launch. The diff-aware mode is the feature that makes adoption realistic — `--since HEAD` for a pre-commit hook, `--since origin/main` for CI — and the note that living-memory precedents are still looked up in `--since` mode but the memory snapshot is only written on full runs is a thoughtful detail that keeps a partial scan from corrupting the full picture. `brainblast watch .` emitting one NDJSON event per debounced save (`watch_started`, `finding`, `scan_complete`, `scan_error`) is a genuinely useful integration point for an agent daemon that would otherwise poll the report file. The auto-fix path is handled honestly: `fix . --apply` writes each `fix.diff`, re-runs the audit, and reports any fix that didn't take rather than dropping it quietly; structural fixes it won't auto-synthesize are listed as guidance. Where it doesn't fit: teams with no Stripe, Privy, or Solana code, since most of the bundled pack is then irrelevant. Projects without a git work tree lose `--since` and `watch` altogether — exit code 2 is exactly that failure. It requires a Node.js environment and is CLI-only, and the checks are pattern-based by design, so expect false positives and missed novel variants; `CANT_TELL` is a first-class outcome for that reason, and `--ci --strict` is how you choose to treat it as a failure. Cost analysis for Solana depends on accurate program data you supply. It will not replace Snyk or Semgrep, and it doesn't track remediation beyond the auto-fix. If your team hand-writes integrations and reviews them carefully, the marginal value is much lower — the tool is priced in effort saved on agent-generated code specifically.