Penthera

Penthera: your open-source cyber security agent

The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.

penthera.org: check your live site in a few seconds. Passive, nothing stored.

132 readable rules · 6 read-only MCP tools · 1 runtime dependency · 0 requests past loopback in the benchmark · MIT, no telemetry

Watch the 80-second walkthrough: setup, a scan, the dashboard, a fix approved, the report. Demo data, no sound, captions in the video.

What it is

Penthera checks your app, its dependencies and your AI coding tools on your own machine. It fixes what it can, with your approval. Every finding comes from a rule you can read, with its evidence at file:line. A model may propose; a rule decides.

It is also an open R&D project. We measure every check in public and publish the results, good or bad, so you can see how far to trust it.

It finds known classes of problems, not novel ones. It does not replace a human pentester.

One real fix

On 23 October 2026 the live check on penthera.org gave penthera.org itself 95 out of 100. Every header, TLS and page check passed; two email-spoofing records were missing. Two DNS records later, it scored 100.

penthera.org    95/100   FIX  No SPF record for penthera.org
                         FIX  No DMARC record for penthera.org

+ TXT  @        v=spf1 -all
+ TXT  _dmarc   v=DMARC1; p=reject; adkim=s; aspf=s

penthera.org   100/100   Solid basics

The same report, with a prompt for your coding agent to make the fixes, is one click away for your own site.

Start in 30 seconds

You need Node.js 22 or later. No install, no account.

In your terminal. Run this in your project folder:

npx penthera

It detects your setup offline, asks what to check, and gives you a grade per area and the three things to fix first. It scans your running app only after you confirm the app is yours. Nothing is committed or pushed (guided start).

In your coding agent, as a skill. Then ask "scan my app for security issues":

npx skills add danoszz/penthera

In your coding agent, as an MCP server. Six read-only tools for Claude Code, Cursor, Codex, VS Code and Windsurf, new in 1.9.0. Pin the version:

claude mcp add penthera -- npx -y penthera@1.9.0 mcp

In Claude Code, as a plugin. From Claude Code's prompt:

/plugin marketplace add danoszz/penthera
/plugin install penthera@penthera

In Gemini CLI, as an extension. With the same pinned MCP server:

gemini extensions install https://github.com/danoszz/penthera

Other clients: docs/commands/mcp.md. Other skill install routes: docs/commands/skill.md.

To run it in a container: docker build -t penthera . && docker run --rm penthera https://your-app.example.

What it does

flowchart LR
    U["You or your AI agent"] --> P(("Penthera<br/>on your machine"))

    P --> APP["Your app<br/>URL scan, repo scan<br/>runtime advisories"]
    P --> DEP["Your dependencies<br/>capabilities, install firewall<br/>typosquats, upgrade diff"]
    P --> AI["Your AI tooling<br/>skills, MCP, hooks<br/>plugins, rule files"]

    APP --> F[["Findings<br/>severity, confidence<br/>evidence at file:line"]]
    DEP --> F
    AI --> F

    F --> FIX["Fix loop<br/>asks first, local branch<br/>cannot edit its own tests"]
    FIX -. "re-scan proves it" .-> F
    F --> R["Reports and dashboard<br/>terminal, Markdown, SARIF<br/>penthera ui, MCP tools"]
    F --> E["Evidence<br/>signed bundle<br/>NIS2 and CRA drafts"]

    classDef core fill:#0000ed,stroke:#0000ed,color:#ffffff
    classDef box fill:#ffffff,stroke:#000000,color:#000000
    class P core
    class U,APP,DEP,AI,F,FIX,R,E box

Before you deploy

What you build with

After you ship

Every finding carries a severity, a confidence label (confirmed, likely, potential, needs-human-review), its evidence and the research behind it. Reports come out as Markdown, JSON and SARIF for GitHub code scanning. Exit code 1 means critical or high findings. Every command and flag is in docs/commands/. Compliance output is readiness tooling, not a certification and not legal advice.

AI mode (opt-in, new in 1.9.0). penthera --repo . --ai lets a local model propose problems no rule describes. Penthera checks each proposal with its rules, and anything unconfirmed is labelled "model-proposed, unverified" and never fails CI. Whether it finds more than the rules alone is not measured yet (AI mode).

How it is measured

Each feature goes through the same path: method → evidence → tool.

• Method. The methodology states the threat model, what black-box (HTTP) and white-box (source) analysis can and cannot see, the confidence model, and the false-positive controls on each probe. Each design choice cites the research or standard it rests on: 95 verified references, in APA style, in docs/references.md.
• Evidence. A benchmark runs on every release, and the release gate fails if precision or recall drops by more than 0.02. Experiments that decide what ships next are pre-registered in docs/research/prereg/ before any data is collected, and the results are published either way.
• Tool. What holds up ships in a reviewed, signed release. What does not hold up is dropped, and the rules stay.

The bundled benchmark is 24 findings in small labs we wrote ourselves. It catches regressions; it does not measure real-world accuracy. The E10 pilot used one labeller and is not independent: the fixes were written after seeing the misses on the same two apps. On WebGoat, held out, recall stayed at 2 of 9. Accuracy on real projects is experiment E1, pre-registered and not yet run. Intervals are Wilson. What Penthera cannot see is listed under Known limitations. Refresh the counts with npm run docs:numbers and npm run bench.

Cite this repository with the button on GitHub or CITATION.cff. APA and BibTeX forms are in the methodology.

Why you can trust it

• Local and offline. No account, no telemetry, no cloud. --offline limits network traffic to the target you named, and every report lists the hosts it contacted (network use).
• Deterministic. Rules you can read, with file:line evidence. A model may propose a fix or a lead; a deterministic re-scan and your tests decide.
• Non-destructive by default. Default scans send no attack payloads. Payload testing (--deep, --fuzz, --all) is opt-in, asks for a confirmation bound to the target, and is rate-limited.
• Asks before it changes anything. The fix loop works on a local branch, asks before every change by default, and never pushes or opens pull requests.
• No update channel to hijack. Detection rules ship inside reviewed releases as signed, versioned rule packs. You can add your own by path (--rules <dir>). Nothing is downloaded and run at run time.
• Releases you can verify. npm provenance through trusted publishing, a maintainer approval with 2FA for every version, SHA-pinned CI, CodeQL and OpenSSF Scorecard. Every release passes an internal audit of eight gates (latest report).

Penthera finds known classes of problems, not novel ones, and it does not replace a human pentester or incident response. The decisions behind it, its limits, and how to challenge them are in the manifesto and FAQ.

How it fits with other tools

Penthera works next to the tools you already use; its SARIF output goes straight into GitHub code scanning, for example. Each comparison page says where the other tool goes further and how to run the two together.

All comparisons, including Cloudflare's security-audit skill: docs/compare/.

Start here

The full map, by situation and from first scan to research, is in docs/index.md.

Ethics and authorization

Penthera sends HTTP requests to the targets you give it, and some modes (--deep, --fuzz, --all) send attack payloads, after a confirmation. Scan only what you own, what you have written authorization to test, or local environments you control. Do not use it to probe third-party systems, exfiltrate data, disrupt services, or harm anyone. Unauthorized testing may break computer-misuse laws such as the US CFAA, the UK Computer Misuse Act, and their EU equivalents. When in doubt, do not scan.

The software is provided "as is", without warranty. The author accepts no liability for misuse, and you are responsible for making sure every scan you run is lawful. The live check on penthera.org has its own terms.

Building in public

What changed, what we are measuring, and what comes next, in one place.

Releases are deliberately slow: a feature freeze, an independent review, the release checks, and a release candidate before any new minor version. Watch the repository for releases or join the Discussions.

How Penthera is built

Penthera is developed with substantial help from generative AI: 91% of the commits up to v1.7.0 were written with Claude (Anthropic) through Claude Code, directed and reviewed by the maintainer, and marked with a co-author trailer. Generated code passes the same gates as any change: tests, CodeQL, an independent review, the internal audit, and a 2FA-approved release. Inside the product, models only ever propose; deterministic checks decide. The full disclosure, and the rules for AI-assisted contributions, are in docs/genai.md.

Contributing and support

Clone the repository and run npm install, then npm test for the suite and npm run bench for precision and recall. CONTRIBUTING.md covers the project layout, the release cadence and the release checklist; AGENTS.md is the short version for coding agents. The roadmap shows what ships next, and the research plan what we measure. Issues and pull requests are welcome.

Penthera is free. If it caught something before you shipped it, you can sponsor its maintenance. Sponsorship pays for maintainer time and buys no influence over findings (tiers).

License

MIT. See LICENSE. Report vulnerabilities in Penthera itself through SECURITY.md.