seclab-taskflow-agent: Define AI Workflows in YAML

Overview

GitHub Security Lab Taskflow Agent runs sequences of AI-agent tasks defined in YAML rather than custom orchestration code. Tasks can combine agent personalities, prompts, tools, and models, with templates and shared outputs connecting steps.

It is designed especially for security research workflows, such as code auditing and vulnerability triage. Use it when you want to describe and validate repeatable agent processes as configuration, or compare model responses within a taskflow.

Key Features

• YAML grammar for taskflows, agent personalities, prompts, toolboxes, and model configurations.
• MCP tool integration using stdio, SSE, and streamable HTTP transports.
• Multiple SDK backends: OpenAI Agents, GitHub Copilot, and Anthropic.
• Task-level retries, checkpoints, and resume support after failures.
• Offline linting for taskflows and referenced documents, plus JSON Schema output.
• Multi-model task execution with named outputs for downstream comparison or review.
• CLI and Docker deployment options.

Use Cases

• Security researchers can define repeatable code-audit workflows that give agents access to tools such as the included CodeQL MCP server.
• Security teams can automate structured triage of code-scanning alerts using task sequences and specialist agent prompts.
• Model evaluators can send the same task to multiple models and use a follow-up task to compare their answers.
• Developers exploring agent orchestration can prototype workflows in YAML before building custom orchestration code.

Getting Started

Requires Python 3.10 or newer, or Docker. To build from source and run an example taskflow:

git clone https://github.com/GitHubSecurityLab/seclab-taskflow-agent.git
cd seclab-taskflow-agent
python -m venv .venv
source .venv/bin/activate
pip install hatch
hatch build
hatch run main -t examples.taskflows.example

Set AI_API_TOKEN for an account entitled to use GitHub Copilot before running model-backed tasks. See the README for configuration, examples, and Docker instructions.

Alternatives

• mcp-agent: A general-purpose Python framework for MCP-based agents and composable workflows, rather than YAML-defined, security-focused task flows.
• autogen: A general multi-agent framework with broad model and tool integrations, rather than a CLI centered on repeatable YAML security tasks.
• deepagents: A Python harness focused on planning, delegation, and context management, rather than configuring multi-agent workflows in YAML.

Considerations

The project describes itself as experimental and is maintained for ongoing Security Lab work. Running agent tasks requires access to a compatible model endpoint and credentials, and MCP toolboxes may require additional services or environment configuration. Docker is documented as a deployment convenience, not a security boundary. Backend capabilities differ, so taskflows may need adjustment when switching SDKs.