Today we’re thrilled to launch Fraim, the first full release of our open‑source framework designed to help security teams integrate LLMs into their toolchains without getting bogged down in low‑level details.

Why Fraim?

Security teams often find themselves needing to leverage LLMs to assist with things like code review, vulnerability triage, and PR audits but struggle with the mess of:

• LLM API integration
• Structured output parsing
• Error handling and retries
• Chaining prompts and tool usage into workflows
• Standardizing reports (e.g., in SARIF format)

Fraim wraps all that scaffolding. You describe your workflows declaratively and Fraim handles the rest.

Core features

• Modular workflow engine

  You define one or more workflows, each made up of LLM prompts and optional tool integrations. Workflows can be chained, conditional, or parallel.

• Input adapters

  Starting with code‑chunk inputs (e.g. a GitHub repo or local dir), Fraim will soon support VS Code diffs, GitHub PR diffs, and other plugins in a plug‑and‑play fashion.

• Robust LLM orchestration

  Built‑in support for retries and error handling ensures you don’t end up with ANSI‑color JSON dumps when things go sideways.

• Built-in tool integrations

  Fraim comes with built-in tree-sitter tool integrations for LLMs to navigate codebases.

• Structured SARIF output

  All results are rendered into standard SARIF, so they play nice with mainstream tools like GitHub Code Scanning, Azure Sentinel, and VS Code.

• Highly extensible design

  Every component — inputs, LLM prompt steps, tool integrations, SARIF mappers — is modular. Want to swap in a different LLM or add a new tool? Just write a new plugin.

Example workflows

Fraim also comes with a few workflows ready to use out-of-the-box:

• Code Security Analysis - scan a codebase for vulnerabilities and security issues (src, docs)
• Infrastructure as Code Analysis - scan an IaC repo for security issues or misconfigurations (src, docs)

We’ll be adding more in the coming weeks.

How it works

Workflows are written in plain Python, but Fraim provides common building blocks to make it easier.

1. Define the input outputs for your workflow. Today Fraim ships with built-in support for code inputs and SARIF report outputs.

   type Input = {code: CodeChunk, config: Config}
   type Output = List[sarif.Result]

2. Create a class for the workflow, and implement its workflow method to define the logic. This method is plain Python, but Fraim provides an LLMStep building block to keep the code succinct.

   class MyWorkFlow(Workflow[Input, Output]):
     async def workflow(self, input: Input) -> Output:
       stepOne = LLMStep(llm, PROMPTS["system"], PROMPTS["user"], parser, tools=tools)
       results = await self.stepOne.run({code: input.code})
       return results

3. Run the workflow using the CLI. Fraim loads the input project, chunks the code, orchestrates the LLM & tools, handles errors/retries in the background, and emits a .sarif file.

   uv run fraim --path ~/git/test-repo --workflow my_workflow

What’s next?

• Support for VS Code diffs, GitHub PR inputs, and other code input formats
• Additional built‑in tool integrations (e.g., CLI scanners, vulnerability lookups) and MCP support
• More prompt templates, steps and other building blocks for common security workflows
• Integrations with Orca, Wiz, Jira, Slack, and other common tools
• GitHub Actions support for running workflows on PRs
• A more user-friendly CLI

Get started

The full repo is available now on GitHub: github.com/fraim-dev/fraim

This is our first release, so we’re counting on your feedback! Please:

• Open issues for bugs or missing features
• Submit pull requests to add integrations or workflows
• Share real‑world use cases — we’d love to learn where Fraim is working for you (or where it isn’t yet)

Check out the documentation for more details.

---

Join us in shaping the future of secure, LLM‑driven automation. If you’ve been building your own glue‑code for LLMs in security workflows let’s collaborate instead.

Start exploring Fraim on GitHub →

---