# Penthera documentation > **Starter and pro.** For "where do I start, and where do I go next?" Penthera is an open-source cyber security agent. It checks your app, its dependencies and your AI coding tools on your own machine, offline, with rules you can read. A model may propose; a rule decides. Pick the journey that fits you. Each page answers one question, and each journey runs from the first command to the details. [](https://github.com/danoszz/penthera/raw/main/assets/walkthrough.mp4) [Watch the 80-second walkthrough](https://github.com/danoszz/penthera/raw/main/assets/walkthrough.mp4). Demo data, no sound, captions in the video ([as text](https://github.com/danoszz/penthera/raw/main/assets/walkthrough.vtt)). ## 1. I'm new For "is my app safe to ship?" Start with one command in your project folder: ```bash npx penthera ``` | Your question | Read | |---|---| | "What does `npx penthera` do, and what does it not do?" | [Set up in one command](https://penthera.org/docs/commands/init.md) | | "How do I scan my running app and its source?" | [Scanning your app](https://penthera.org/docs/commands/scan.md) | | "Is this package safe to add?" | [Dependency risk](https://penthera.org/docs/commands/deps.md), [the install firewall](https://penthera.org/docs/commands/install.md) | | "Can I see it all in one place?" | [The local dashboard](https://penthera.org/docs/dashboard.md) | | "What does it send over the network?" | [Privacy and network use](https://penthera.org/docs/privacy.md) | ## 2. I use AI coding tools For "is my AI setup safe, and can my agent run Penthera?" | Your question | Read | |---|---| | "Is this MCP server or skill safe?" | [Auditing your AI tooling](https://penthera.org/docs/commands/agents.md) | | "Can my coding agent run it for me?" | [Penthera as an Agent Skill](https://penthera.org/docs/commands/skill.md) | | "Can my agent call it as a tool?" | [Penthera as an MCP server](https://penthera.org/docs/commands/mcp.md) (1.9 release candidate) | | "I let an agent work on my code. What should I check?" | [Running AI agents safely](https://penthera.org/docs/agents-safely.md) | | "Can a model look for what the rules miss?" | [AI mode](https://penthera.org/docs/ai-mode.md) (opt-in, 1.9 release candidate) | | "An AI audit gave me a list of findings. Which are real?" | [`penthera verify`](https://penthera.org/docs/commands/verify.md) | ## 3. I run it in CI For "how do I make it part of every change?" | Your question | Read | |---|---| | "How do I put it in CI?" | [Penthera in CI](https://penthera.org/docs/commands/action.md), [scan in CI](https://penthera.org/docs/commands/scan.md#ci-integration), [example workflows](https://github.com/danoszz/penthera/blob/main/docs/examples/github-actions-scan.yml) | | "How do I stop problems before they are committed?" | [The pre-commit hook](https://penthera.org/docs/commands/hook.md) | | "How do I run the fix loop?" | [Fixing what it finds](https://penthera.org/docs/commands/fix.md), [the local loop and its memory](https://penthera.org/docs/local-loop.md) | | "How do I tune the rules?" | [Scan configuration](https://penthera.org/docs/commands/scan.md#configuration), [rule packs](https://penthera.org/docs/rule-packs.md) | | "Is the runtime I deploy affected by an advisory?" | [Runtime advisories](https://penthera.org/docs/runtime-advisories.md) | | "Which OWASP tests does it cover?" | [OWASP WSTG coverage](https://penthera.org/docs/owasp-wstg-coverage.md) | | "Which command and flag do I need?" | [All commands](https://penthera.org/docs/commands/README.md) | ## 4. I need evidence for an auditor For "what do I give my auditor?" Compliance output is readiness tooling. It is not a certification and not legal advice. | Your question | Read | |---|---| | "What do I hand over, and how does the auditor check it?" | [Evidence bundles and audience reports](https://penthera.org/docs/evidence.md) | | "What does NIS2 ask, and what can Penthera show?" | [NIS2](https://penthera.org/docs/compliance-nis2.md) | | "What must I report under the CRA, and what is in my AI-BOM?" | [The CRA and AI-BOM](https://penthera.org/docs/compliance-cra.md) | ## 5. I'm a researcher For "how do you know it works?" | Your question | Read | |---|---| | "How does it decide, and what can't it see?" | [Methodology](https://penthera.org/docs/METHODOLOGY.md), [known limitations](https://penthera.org/docs/METHODOLOGY.md#known-limitations) | | "How accurate is it?" | [Benchmark](https://github.com/danoszz/penthera/blob/main/bench/README.md) and [latest results](https://github.com/danoszz/penthera/blob/main/bench/RESULTS.md), the [E10 pilot](https://github.com/danoszz/penthera/blob/main/bench/known-vuln/RESULTS.md) on known-vulnerable apps | | "What will you measure next?" | [Research plan](https://penthera.org/docs/vision-2.0.md), [pre-registrations](https://github.com/danoszz/penthera/blob/main/docs/research/prereg/E1-real-world-accuracy.md), [research notes](https://github.com/danoszz/penthera/tree/main/docs/research) | | "How do I know a release is sound?" | [Internal audit](https://github.com/danoszz/penthera/blob/main/docs/internal-audit.md) | | "What research is it based on?" | [References](https://penthera.org/docs/references.md) ([BibTeX](https://github.com/danoszz/penthera/blob/main/docs/references.bib)), [how to cite](https://penthera.org/docs/METHODOLOGY.md#how-to-cite) | | "How does it compare to the tool I use?" | [Comparisons](https://penthera.org/docs/compare/README.md) | | "Why was it built this way?" | [Manifesto and FAQ](https://penthera.org/docs/MANIFESTO.md) | | "How much of it did AI write?" | [Use of generative AI](https://penthera.org/docs/genai.md) | The accuracy numbers come with their sample and caveats on the same page. In short: the bundled benchmark is 24 findings in labs we wrote ourselves, the E10 pilot used one labeller, and accuracy on real projects (E1) is not measured yet. ## The project | Page | For | |---|---| | [Roadmap](https://github.com/danoszz/penthera/blob/main/ROADMAP.md) | Where it stands, what ships next, and what is not planned | | [CONTRIBUTING](https://github.com/danoszz/penthera/blob/main/CONTRIBUTING.md) | Setup, tests, the merge flow and the release steps | | [AGENTS.md](https://github.com/danoszz/penthera/blob/main/AGENTS.md) | Coding agents working on or with Penthera | | [Voice guide](https://github.com/danoszz/penthera/blob/main/docs/voice.md) | How Penthera's docs and messages are written | | [CHANGELOG](https://github.com/danoszz/penthera/blob/main/CHANGELOG.md) | Every release | | [SECURITY](https://github.com/danoszz/penthera/blob/main/SECURITY.md) | Reporting a vulnerability in Penthera itself | | [Funding](https://github.com/danoszz/penthera/blob/main/docs/funding/sponsor-tiers.md) | Sponsor tiers, the [partner brief](https://github.com/danoszz/penthera/blob/main/docs/funding/partner-one-pager.md) and the [due diligence checklist](https://github.com/danoszz/penthera/blob/main/docs/funding/due-diligence-checklist.md) | | [Marketing automation](https://github.com/danoszz/penthera/blob/main/docs/marketing.md) | What runs on a schedule, and what a person still posts | | [MCP directory listings](https://github.com/danoszz/penthera/blob/main/docs/mcp-listing.md) | What the maintainer pastes into MCP directories | ## Programmatic API ```javascript import { loadTemplatesFromPaths, runTemplateScan } from "penthera/plugins"; import { runAdaptiveProbes } from "penthera/adaptive"; ``` The exports are in `lib/plugins.js` and `lib/blackbox/adaptive-scan.js`, both shipped in the npm package. The npm package ships only `docs/examples/` from this folder; the rest of the docs live on GitHub. Only scan systems you own or are authorized to test.