Launching today
Penthera
Penthera: free elite cyber security agent for your site/app
1 follower
Penthera: free elite cyber security agent for your site/app
1 follower
Find security gaps before you push to production. Point Penthera (local btw) at your site or code and see what's wrong, with evidence. It checks secrets, headers, dependencies and your AI setup (MCP, skills, plugins). It fixes what it can with your consent on a local branch, then re-scans to prove it. Free and open source. Research-backed rules decide every finding, your code stays on your machine, no account, no telemetry. Benchmarked in public, no bs, just more safety for all.
Free
Launch Team / Built With
Dropbox Sign APISimplify your eSignature integration
Promoted
As we've seen last month(s) with PHP, hacks, EU gov shutting down, and other CVEs - cybersecurity is going wild (finally). How can we make our systems safer as AI gets smarter? While I don't have a direct answer, I know that -as a computer scientist- there are things you can do within your control, like fixing your security principles and think like a hacker before you launch. You don't need to get an expensive degree or 50 years of experience to do that tho. Hence, i open-sourced my security rules I've collected over the years- wrapped up in a pretty package/agent/skill (whatever they will call it in a year from now)
I started Penthera as a local pentester for my own projects (made 100+ apps for 1M+ users that generated big $, but like no one (except Binance) could afford getting hacked) because AI lets people ship an app in a weekend, and nothing/nobody (unless you are a cyber hacker) tells you what you just left insecure. Good security tooling was either expensive or built for people who already know what a CSP is (do you?).
I think security is/should be a right for every builder, not a paid luxury, wishy-washy companies, or asking your AI agent "yo fix my code" (aka your codebase leaving your computer = high risk). So Penthera is free, rule-based ("non-AI", but we have a flag if you'd like a second look from your own local LLM; it can only propose, and the rules check it; in short, an agentic harness) and open source. Point it at your site or your code, see what's wrong in plain words, and it fixes what it can with your consent. It checks your AI setup (MCP, plugins, skills, hooks) too.
Research-backed rules decide every finding, not a model. Your code stays on your machine, with no account and no telemetry (so nothing going to our servers). And I benchmarked it in public against 25 free tools, losses included: tied 1st on npm and PyPI malware, but 2nd on leaked secrets, not 1st. Also just finished measuring ~7,000 sites/apps with Penthera (biggest study I've done); results coming soon
Happy to answer anything about the rules, the benchmarks, or the app you're about to ship. Try it on your next launch and lmk what it missed or make a PR!
<3 to happy safe coding and building your ideas into reality (without getting hacked and crazy creditcard bills for tokens you've never used)
Daan
how to get started
1. run it in your app's folder: npx penthera
it checks your code, packages, AI setup (MCP, skills, plugins) and your live site, and tells you what's wrong in plain words. needs Node 22+, no account, nothing leaves your machine
2. let it fix what it can: it shows each change, asks for your consent, applies it on a local branch, then re-checks to confirm the fix. what it can't fix, it tells you
3. keep it running where you already work:
- in your coding agent (Claude Code, Cursor, Codex): npx skills add danoszz/penthera
- as an MCP server: claude mcp add penthera -- npx -y penthera@2.2.0 mcp
- on every push, with the GitHub Action
just want a quick look first? paste your URL at penthera.org, passive check, nothing stored then you get to make the hard decision: what to build next, now that you know what's open
<3
btw its free & open-source, just released V2.2 https://github.com/danoszz/penthera/releases/tag/v2.2.0 to celebrate the PH launch
try it on your next launch and tell me what/if it got (something) wrong, leave a star to receive updates and if you feel adventerous feel free to make a PR to improve
you didn't come this far, just to come this far; give a ⭐️ https://github.com/danoszz/penthera