Penthera: your open-source cyber security agent
The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.
penthera.org: try the check in your browser. Nothing you paste leaves the page.
Watch the 80-second walkthrough: setup, a scan, the dashboard, a fix approved, the report. Demo data, no sound, captions in the video.
Penthera checks your app, its dependencies and your AI coding tools on your own
machine. It fixes what it can, with your approval. Every finding comes from a
rule you can read, with its evidence at file:line. A model may propose; a rule
decides.
It is also an open R&D project. We measure every check in public and publish the results, good or bad, so you can see how far to trust it.
It finds known classes of problems, not novel ones. It does not replace a human pentester.
You need Node.js 22 or later. No install, no account.
In your terminal. Run this in your project folder:
npx pentheraIt detects your setup offline, asks what to check, and gives you a grade per area and the three things to fix first. It scans your running app only after you confirm the app is yours. Nothing is committed or pushed (guided start).
In your coding agent, as a skill. Then ask "scan my app for security issues":
npx skills add danoszz/pentheraIn your coding agent, as an MCP server. Six read-only tools for Claude Code,
Cursor, Codex, VS Code and Windsurf. The MCP server is new in 1.9 and is on
npm's next tag until 1.9.0 ships, so pin the release candidate:
claude mcp add penthera -- npx -y penthera@1.9.0-rc.1 mcpOther clients: docs/commands/mcp.md. Other skill install routes: docs/commands/skill.md.
npx penthera runs the latest release (1.8.1). Use npx penthera@next for
the 1.9 release candidate.
| Area | What Penthera does | Start with |
|---|---|---|
| Your running app | TLS, headers, CORS, cookies, auth, JWT, IDOR, OAuth and OpenAPI on your localhost or preview URL. Injection probes and fuzzing only when you ask | penthera <url> |
| Your source | Routes, trust boundaries, code-execution sinks, and secrets including AI provider keys | penthera --repo . |
| Your dependencies | What each npm and Python package can do (install scripts, shell, network, env), what an upgrade added, lookalike names, licenses | penthera deps |
| New installs | What a package brings before any install script runs | penthera install <pkg> |
| Your AI tooling | Skills, MCP servers, hooks, plugins and rule files: hidden instructions, unpinned servers, broad permissions | penthera agents --home |
| Your runtimes | Whether the PHP, nginx, Apache, Node.js, Python, OpenSSL or MongoDB version you run is affected by a known advisory | Runtime advisories |
| Fixes | Deterministic fix recipes on a local branch, then a re-scan to prove each one. Never pushes | penthera agent --loop |
| Evidence | Reports for developers, owners and auditors, a signable evidence bundle, NIS2 and CRA readiness drafts | Evidence |
Every finding has a severity, a confidence label (confirmed, likely,
potential, needs-human-review) and its evidence. Reports come out as
Markdown, JSON and SARIF. penthera ui shows it all in a local dashboard on
127.0.0.1. Compliance output is readiness tooling, not a certification and not
legal advice.
AI mode (opt-in, 1.9 release candidate). penthera --repo . --ai lets a
local model propose problems no rule describes. Penthera checks each proposal
with its rules, and anything unconfirmed is labelled "model-proposed,
unverified" and never fails CI. Whether it finds more than the rules alone is
not measured yet (AI mode).
| Measure | Result | Sample |
|---|---|---|
| Precision, bundled benchmark | 0.88, 95% CI 0.69 to 0.96 | 21 true and 3 false positives |
| Recall, bundled benchmark | 0.91, 95% CI 0.73 to 0.98 | 2 misses, each explained |
| Requests past loopback during the benchmark | 0 | Enforced by a network guard |
| E10 pilot, known-vulnerable apps | Precision 0.88, 95% CI 0.78 to 0.93. Recall 0.07 before fixes, 0.71 (CI 0.45 to 0.88) after | 14 root causes in Juice Shop and DVNA (results) |
The bundled benchmark is 24 findings in small labs we wrote ourselves. It catches regressions; it does not measure real-world accuracy. The E10 pilot used one labeller and is not independent: the fixes were written after seeing the misses on the same two apps. On WebGoat, held out, recall stayed at 2 of 9. Accuracy on real projects is experiment E1, pre-registered and not yet run. Intervals are Wilson.
What makes it safe to run:
- Offline. No account, no telemetry.
--offlinelimits traffic to the target you named, and every report lists the hosts it contacted (network use). - Non-destructive by default. Default scans send no attack payloads.
--deep,--fuzzand--allare opt-in and ask first. - Asks before it changes anything. The fix loop works on a local branch and never pushes or opens pull requests.
- No rule downloads at run time. Rules ship inside reviewed releases as signed rule packs.
- Verifiable releases. npm provenance, a 2FA approval per version, and an internal audit of eight gates before each release.
How it decides, and what it cannot see: methodology and its known limitations.
Scan only systems you own, systems you have written authorization to test, or local environments you control. Some modes send attack payloads. Unauthorized testing may break computer-misuse laws such as the US CFAA and the UK Computer Misuse Act. The software is provided "as is", without warranty, and you are responsible for making sure every scan is lawful.
What changed, what we are measuring, and what comes next, in one place.
| Where it stands | Read more | |
|---|---|---|
| Latest release | 1.8.1 (2026-10-22) on npm latest: more careful runtime advisories, on top of 1.8.0's advisories, security-review fixes and redesigned dashboard |
CHANGELOG |
| Release candidate | 1.9.0-rc.1 on npm next: penthera mcp, opt-in AI mode, new detection rules, no attack payloads in default scans |
Roadmap |
| Research | E10 pilot published: precision 0.88, recall 0.07 to 0.71 on two known-vulnerable apps after fixes (one labeller, not independent; a re-run is pending because default scans no longer send login checks). E1 on real code is pre-registered; E8 (agent guardrails) is a draft | E10 results, E1 pre-registration, agents safely |
| Next | 1.9.0 once the release candidate holds up, then real-world precision and recall with intervals, published whatever the result | Roadmap: next, research plan |
Releases are deliberately slow: a feature freeze, an independent review, the release checks, and a release candidate before any new minor version. Watch the repository for releases or join the Discussions.
Penthera is developed with substantial help from generative AI: 91% of the commits up to v1.7.0 were written with Claude (Anthropic) through Claude Code, directed and reviewed by the maintainer, and marked with a co-author trailer. Generated code passes the same gates as any change: tests, CodeQL, an independent review, the internal audit, and a 2FA-approved release. Inside the product, models only ever propose; deterministic checks decide. The full disclosure, and the rules for AI-assisted contributions, are in docs/genai.md.
| You want | Read |
|---|---|
| Every guide, ordered from first scan to research | docs/index.md |
| Every command and flag | docs/commands/ |
| How it compares to Socket, Snyk, GitHub, ZAP and Semgrep | Comparisons |
| Why it was built this way | Manifesto and FAQ |
| To contribute, or to point a coding agent at this repo | CONTRIBUTING.md, AGENTS.md |
| What ships next | ROADMAP.md |
| To cite it | CITATION.cff, or how to cite |
Penthera is free. If it caught something before you shipped it, you can sponsor its maintenance. Sponsorship pays for maintainer time and buys no influence over findings (tiers).
MIT. See LICENSE. Report vulnerabilities in Penthera itself through SECURITY.md.