penthera

Offline cyber security agent for the user's own apps and AI coding tools, run locally with the Penthera CLI; open R&D, measured in public. Sets it up in one command ("set up penthera in this repo"). Scans the user's own live URL and repo (TLS, headers, auth, OpenAPI, secrets incl. AI keys, opt-in injection); checks npm and Python dependencies offline ("is this dependency safe?", "what changed in my deps?", "install X safely", "any AGPL in our deps?"); blocks secrets and risky agent config before commit ("add a pre-commit hook"); audits AI tooling ("audit my MCP servers / skills / hooks", "check this skill before I install it"); fixes findings on a local branch and re-scans to verify ("scan and fix my app"); writes reports and evidence ("report for my auditor / manager", NIS2, SARIF, baseline diff). Use when the user asks to scan, audit, harden, fix, or review the security of their own app, staging URL, localhost, repo, dependencies, or agent setup. Do NOT use for targets without explicit authorization.