展示HN：Kekkai – 终端中的互动安全分类工具
嘿，HN，
作为一名应用安全工程师，我花了很多时间运行和调试开源安全扫描工具，如 Trivy、Semgrep、Gitleaks 和 Dojo。我发现，运行这些工具很简单，但审查结果就没那么容易了。每个工具输出不同的 JSON，误报层出不穷，持续集成（CI）要么变得嘈杂，要么阻塞所有内容。
因此，我构建了 Kekkai（前身为 Hokage），这是一个小型开源命令行工具，专注于人力审查。
Kekkai 在隔离的 Docker 容器中运行这些扫描工具，将它们的输出标准化为统一格式，并提供交互式终端用户界面，以便审查发现、标记误报并将决策保存在本地。
你可以试试：
```
pipx install kekkai-cli
kekkai scan
kekkai triage
```
目前的功能包括：
- 运行 Trivy（依赖项）、Semgrep（代码）和 Gitleaks（秘密）
- 将发现结果标准化为统一报告
- 提供基于键盘的终端用户界面（TUI）用于审查和标记发现
- 支持 .kekkaiignore 文件以处理误报
- 具有基于严重性失败阈值的 CI 模式
设计选择：
- 默认优先考虑本地使用（无需 SaaS）
- 不使用专有扫描逻辑，基于现有工具
- 扫描器在只读、无网络的 Docker 容器中运行
这仍处于早期阶段，主要面向个人开发者和小团队。我接下来要做的事情是实现跨运行的持久审查状态（基线）和更好的 PR 级工作流程。
代码库和文档：
[https://github.com/kademoslabs/kekkai](https://github.com/kademoslabs/kekkai)
我随时可以回答关于权衡、限制或这个工具存在原因的问题。
查看原文
Hey HN,<p>As an AppSec engineer, I’ve spent a lot of time running and tunning open-source security scanners like Trivy, Semgrep, Gitleaks and Dojo. What I have found is that running them is easy, reviewing the results, not so much. Each tool outputs different JSON, false positives pile up, and CI either becomes noisy or blocks everything.<p>So I built Kekkai (formerly Hokage), a small open-source CLI that wraps these scanners and focuses specifically on human triage.<p>Kekkai runs the scanners in isolated Docker containers, normalizes their outputs into a single format, and provides an interactive terminal UI to review findings, mark false positives, and save decisions locally.<p>You can try it out:<p>```
pipx install kekkai-cli
kekkai scan
kekkai triage
```<p>What it currently does:<p>- Runs Trivy (dependencies), Semgrep (code), and Gitleaks (secrets)
- Normalizes findings into a unified report
- Provides a keyboard-driven TUI for reviewing and marking findings
- Supports .kekkaiignore for false positives
- Has a CI mode with severity-based failure thresholds<p>Design choices:<p>- Local-first by default (no SaaS required)
- No proprietary scanning logic, it sits on top of existing tools
- Scanners run in read-only, no-network Docker containers<p>This is still early and aimed at individual developers and small teams. The next things I’m working on are persistent triage state across runs (baselines) and better PR-level workflows.<p>Repo and docs:
<a href="https://github.com/kademoslabs/kekkai" rel="nofollow">https://github.com/kademoslabs/kekkai</a><p>I’m around to answer questions about tradeoffs, limitations, or why this exists at all.