Releases · jhammant/AutoSecScan

LLM-assisted, self-hosted security scanner for continuous automated pen-testing of your own assets — free & open source.

Highlights

Unified scanning: network/host (nmap, nuclei) + code/deps/secrets/IaC (semgrep, trivy, gitleaks, osv-scanner) in one run.
LLM triage: false-positive filtering, severity re-ranking, plain-English explanations, concrete fixes, exec summary. Robust on local/weak models.
Agentic mode (--agent): the LLM manages the pen-test — discovers, follows the evidence, can install tools and write its own sandboxed probes.
Pluggable LLMs: Ollama, LM Studio (incl. abliterated/reasoning), Claude Code Router, Anthropic, aiondemand, any OpenAI endpoint — by size tier & flavor.
Continuous: per-target state (alerts only on new findings) + Slack/Discord webhooks; cron & git-hook installers.
Reports: JSON, HTML, PDF, SARIF, NDJSON.
Privacy: secrets redacted before any hosted LLM; `local_only` keeps everything on-box.

`curl -fsSL https://raw.githubusercontent.com/jhammant/AutoSecScan/main/install.sh | bash`
`pip install autosecscan` · `docker run --rm ghcr.io/jhammant/autosecscan doctor`
Claude Code: `/plugin marketplace add jhammant/AutoSecScan` → `/plugin install security-scan@autosecscan`
CI: `uses: jhammant/AutoSecScan@v0.1.0`

See the README for the full tour. 79 tests, CI-verified, MIT.