# Penthera: your open-source cyber security agent

> The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.

Penthera 1.9.0 is an open-source security agent for your apps and AI coding tools. It runs on your machine, with no account and no telemetry. Readable rules decide every finding and show the evidence; a model may only propose. MIT license, Node.js 22 or later, one runtime dependency.

This is https://penthera.org/ as Markdown. Only scan what you own or are authorized to test.

## Three ways to start

Each command is pinned, so it runs 1.9.0 and never updates without you.

1. In a terminal, the CLI. The guided start asks before it changes anything and never commits or pushes.

   ```
   npx penthera@1.9.0
   ```

2. In your coding agent, the Agent Skill. It teaches Claude Code, Cursor, Codex and other agents to run scans and explain them.

   ```
   npx skills add danoszz/penthera
   ```

3. As tools your agent calls, the MCP server. Read-only tools; no fixes applied, no shell, no attack payloads.

   ```
   claude mcp add penthera -- npx -y penthera@1.9.0 mcp
   ```

   Other clients: https://penthera.org/docs/commands/mcp.md

## What it checks

| Target | What | Command |
|---|---|---|
| Your app | Secrets and AI keys (21 patterns), admin and API routes, runtime versions with known advisories | `npx penthera@1.9.0 --repo .` |
| Dependencies | What each package can do: shell, network, install scripts. Typosquats against 15,765 package names, known-malicious versions | `npx penthera@1.9.0 deps` |
| AI tooling | MCP servers, hooks, permissions, and instructions that tell an agent to do harm (39 rules) | `npx penthera@1.9.0 agents --home` |
| A live URL | Headers, TLS, cookies, exposed files (16 URL scan templates), on sites you may test | `npx penthera@1.9.0 https://staging.example.com` |

132 readable rules in this release, citing 95 sources.

## Live check API

Checks a public site's HTTPS, TLS, security headers, cookies, scripts, security.txt and DNS from what a browser loads. Passive only: no other paths, no payloads, nothing stored. Only for sites you own or are authorized to test.

```
curl -s https://penthera.org/api/check -H 'content-type: application/json' -d '{"url":"example.com","consent":true}'
```

- `consent`: required, `true`. It states that you own the site or are authorized to test it, and accept the terms: https://penthera.org/terms
- A site whose robots.txt opts out of Penthera-QuickCheck is not checked (403 `opted_out`). Checks are rate-limited per address and per site.
- Errors: `{"error": {"code", "message", "hint"}}`.
- OpenAPI 3.1: https://penthera.org/openapi.json

## How accurate it is

On the project's benchmark: precision 0.88 (95% CI 0.69 to 0.96) and recall 0.91 (95% CI 0.73 to 0.98), from 21 true positives, 3 false positives and 2 misses in labs the project wrote. These numbers catch regressions; they do not measure real-world accuracy.

## Limits

- It finds known classes of problems, not novel ones. Opt-in AI mode lets a local model propose leads that the rules then check.
- It does not find business-logic or authorization flaws yet. Authenticated preview scans are planned.
- It will not find zero-days.
- It does not replace a human penetration test. Use it before and between tests.
- Accuracy on code the project did not write is still being measured (Penthera Bench v1 and experiment E1, pre-registered).

Details: https://penthera.org/docs/METHODOLOGY.md

## Links

- https://penthera.org/llms.txt: for agents, what Penthera is and where each doc is
- https://penthera.org/llms-full.txt: README.md and the documentation as one file
- https://penthera.org/docs/index.md: the documentation index
- https://penthera.org/openapi.json: the live check API
- https://penthera.org/terms: the live check's terms
- https://github.com/danoszz/penthera: source
- https://www.npmjs.com/package/penthera: package
- https://penthera.org/sitemap.xml