v1.45.0-PL

Achilles is a local agent desktop app with a built-in AppSec Findings platorm: scan a code base repo, triage hits on your machine, then take the work to the editor or agent you already use. Optionally chat with ANY model (all major providers supported) for more detail on the findings.

Scans

Scans write to a local, private ledger (achilles.db). You can scan the full tree and/or git-changed files.

Coverage includes leaked secrets (and local git history on a full-tree scan), SAST-lite on tagged languages, deploy/CI/IaC surfaces, and SCA (lockfiles → OSV, plus pinning and hygiene). Optional intel (Socket, NVD, and similar) when you enable them with your keys.

Scan types:

• Fast — Quick engines only
• Investigate / deep — Inspection engines, then an agent loop on ledger ids (the model does not invent findings)

Install

Download the release asset for your OS:

• Windows: AchillesSetup.exe
• macOS: .dmg
• Linux: .deb, .rpm, or .flatpak

After install: configure a model if onboarding asks → Findings → choose a workspace → scan. Connect to virtually every major model provider / AI inference provider.

Beyond the scan

• Ask / Explain on a finding, or chat about the ledger after a scan
• Skills shipped with the app (map codebase, map attack surface, review findings, propose a fix, rotate a secret, dependency risk, code review and many more)
• Recipes for packaged scans and recaps, including scheduled runs
• Scheduling for recurring scans and recipe jobs
• Code Map to explore functions by file, follow call graphs, and trace HTTP/API routes and templates

Achilles does not apply patches. Copy a finding brief, attach Achilles MCP from another client, or paste findings into the agent harness you already use and fix the code there.

PL release Includes release CI/CD fixes and stability / panic fixes, and installation display fixes.

Apache 2.0. See LICENSE and LICENSING.md in the repository.

v1.45.0

Achilles is a local agent desktop app with a built-in AppSec Findings platorm: scan a code base repo, triage hits on your machine, then take the work to the editor or agent you already use. Optionally chat with ANY model (all major providers supported) for more detail on the findings.

Scans

Scans write to a local, private ledger (achilles.db). You can scan the full tree and/or git-changed files.

Coverage includes leaked secrets (and local git history on a full-tree scan), SAST-lite on tagged languages, deploy/CI/IaC surfaces, and SCA (lockfiles → OSV, plus pinning and hygiene). Optional intel (Socket, NVD, and similar) when you enable them with your keys.

Scan types:

• Fast — Quick engines only
• Investigate / deep — Inspection engines, then an agent loop on ledger ids (the model does not invent findings)

Install

Download the release asset for your OS:

• Windows: AchillesSetup.exe
• macOS: .dmg
• Linux: .deb, .rpm, or .flatpak

After install: configure a model if onboarding asks → Findings → choose a workspace → scan. Connect to virtually every major model provider / AI inference provider.

Beyond the scan

• Ask / Explain on a finding, or chat about the ledger after a scan
• Skills shipped with the app (map codebase, map attack surface, review findings, propose a fix, rotate a secret, dependency risk, code review and many more)
• Recipes for packaged scans and recaps, including scheduled runs
• Scheduling for recurring scans and recipe jobs
• Code Map to explore functions by file, follow call graphs, and trace HTTP/API routes and templates

Achilles does not apply patches. Copy a finding brief, attach Achilles MCP from another client, or paste findings into the agent harness you already use and fix the code there.

Includes release CI/CD fixes and stability / panic fixes.

Apache 2.0. See LICENSE and LICENSING.md in the repository.

v1.45.0-preview

Achilles is a local agent desktop app with a built-in AppSec Findings platorm: scan a code base repo, triage hits on your machine, then take the work to the editor or agent you already use. Optionally chat with ANY model (all major providers supported) for more detail on the findings.

Scans

Scans write to a local, private ledger (achilles.db). You can scan the full tree and/or git-changed files.

Coverage includes leaked secrets (and local git history on a full-tree scan), SAST-lite on tagged languages, deploy/CI/IaC surfaces, and SCA (lockfiles → OSV, plus pinning and hygiene). Optional intel (Socket, NVD, and similar) when you enable them with your keys.

Scan types:

• Fast — Quick engines only
• Investigate / deep — Inspection engines, then an agent loop on ledger ids (the model does not invent findings)

Install

Download the release asset for your OS:

• Windows: AchillesSetup.exe
• macOS: .dmg
• Linux: .deb, .rpm, or .flatpak

After install: configure a model if onboarding asks → Findings → choose a workspace → scan. Connect to virtually every major model provider / AI inference provider.

Beyond the scan

• Ask / Explain on a finding, or chat about the ledger after a scan
• Skills shipped with the app (map codebase, map attack surface, review findings, propose a fix, rotate a secret, dependency risk, code review and many more)
• Recipes for packaged scans and recaps, including scheduled runs
• Scheduling for recurring scans and recipe jobs
• Code Map to explore functions by file, follow call graphs, and trace HTTP/API routes and templates

Achilles does not apply patches. Copy a finding brief, attach Achilles MCP from another client, or paste findings into the agent harness you already use and fix the code there.

Apache 2.0. See LICENSE and LICENSING.md in the repository.

Stable

chore(ci): remove BuildNotify workflow

Posts to a Discord webhook that isn't configured in this fork, so
every run just fails. Drop it instead of wiring notifications nobody
asked for.

Canary

fix(ci): raise Node heap for desktop packaging

Vite OOM'd at the default ~2GB heap while bundling the renderer on macOS, so Package Desktop never produced an .app. Give Electron Forge 8GB and install rustup before cargo cache on manylinux.