SABBA v0.2.0

First public release of Sabba, a security and correctness prover that any coding agent can call over MCP. Nothing is reported unless it runs: a finding is a re-runnable proof, not a score.

What is in it

• 14 MCP tools, most token-free. verify_change proves a change works through the bundled Magga engine: a newly added test fails on the git base and passes on the head, across 16 languages. prove, hunt, scan, verify, and solve find and prove security bugs, minting a finding only when the exploit reproduces inside the target.
• Provers per language and chain: C/C++ (clang + AddressSanitizer/UBSan), Solidity/EVM (Foundry mainnet fork), Python (atheris), Go, Java (Jazzer), and Node/JS/TS (Jazzer.js).
• A scope-gated Kali toolchain layer with an append-only audit log, a network-cut container sandbox, and installable security command templates.
• Codex, Claude Code, OpenCode, Cursor, and Hermes all connect over stdio or HTTP.

Install

git clone --recurse-submodules https://github.com/8NobleTruths/sabba.git
cd sabba && ./install.sh

Then wire it into Codex via ~/.codex/config.toml, or any MCP client. See the README and docs/AGENT_INTEGRATION.md.