I'm Sanjoy, and I built GAUNTLEX because the timing of security testing stopped making sense to me. Every AI coding assistant I use can turn a ticket into a working implementation in under a minute. The security review of that implementation still takes days — a SAST scan that runs after the code is merged, a pentest scheduled for next quarter, a security engineer writing test cases by hand. We got a 100x speedup on one half of the workflow and left the other half exactly where it was. The gap between "code exists" and "code has been adversarially tested" is now the most dangerous window in the whole pipeline, and it's getting wider. GAUNTLEX closes that window by moving the test to the same instant as the build. It runs two agents concurrently against one specification. The Builder generates the implementation. The Breaker generates adversarial attacks — and it never sees the Builder's code. It reasons from the spec alone, which is exactly the surface a real attacker works from before your implementation choices exist. An Arbiter scores every attack as mitigated, partial, or missed, and the run produces a single number: the Adversarial Resilience Score. Drop below your threshold and the CI gate blocks the merge, the same way a failing test suite does. A few things that came out of building it this way: There's no test authoring. You point it at the same spec your AI tool used and it derives the attacks itself. Regulated teams can steer the Breaker with domain playbooks — HIPAA, FINRA, PCI DSS, SOC 2, OWASP Top 10 — so the attacks map to actual controls instead of a generic scan relabeled per industry. Every report carries a SHA-256 hash over the ordered results, so gauntlex verify re-proves months later that an audit artifact wasn't edited. And the whole engine runs on a local Ollama model with zero outbound calls if you're air-gapped. It installs with pip install gauntlex-ai, wires into Claude Code / Cursor / Windsurf / Copilot / Zed as an MCP server with one command, and it's MIT licensed. Runs on your own API key, a free-tier model, or fully local — your choice at setup. I'd genuinely like the feedback that stings, so I ran GAUNTLEX against its own source (free-tier model, signed report, gauntlex verify re-derives the hash yourself) and published a controlled concurrent-vs-sequential comparison on one spec: 2.6x faster, and the sequential pipeline scored a login flow a perfect 1.0 while missing that nobody ever verifies the JWT it hands out. GAUNTLEX's own gate caught that one, at 0.75, for the actual reason, before the sequential run even finished. Tell me where the concurrent-execution premise breaks down, what would stop you putting this in front of your CI gate, which domain should ship next. I'll be here all day. https://github.com/sanjoy1234/ga...

GAUNTLEX

Security testing that matches the speed of development

Security testing that matches the speed of development