An open question
Is the free tool enough?
Penthera is free and stays free. Pro is an experiment, not a sale: it measures whether teams need anything beyond the free agent. If they do, the income keeps Penthera maintained beyond one part-time person, and pays independent reviewers and outside experts to critique its rules. If they don't, the free tool is the whole product, and that's a fine answer.
What it is
Rules decide. We show our work.
The free Penthera agent runs in your CI, and Pro keeps what it found. Every finding comes from a written rule: a model can propose a problem, but a rule has to confirm it. Every result is signed, and anyone can check it with penthera evidence verify, free.
Every day: what you shipped, checked again.
Pro matches the dependency list you shipped against new advisories every day: OSV, the CISA known-exploited list and EPSS. If something you shipped becomes known-bad, you get an email or a GitHub issue.
Every week: your sites, from the outside.
Passive checks on the domains you've verified: certificates, headers, CSP, and keys exposed in your bundles. Nothing is attacked.
Every month: a signed report.
Written from your stored results, for you, your client or your auditor, with evidence for the Cyber Resilience Act. A dashboard with the history in between.
Measured in public
Ranked against the free tools.
-
npm malware
1st of 6
Penthera 0.71 malcontent 0.63
-
PyPI malware
1st of 8
Penthera 0.82 GuardDog 0.74
-
JS injection bugs
tied 1st of 8
Penthera 0.70 odgen 0.68
-
Leaked secrets
2nd of 10
Penthera 0.74 deepsecrets 0.78
Four public datasets other people built, on a half we sealed before we started. Penthera against the best other free tool on each; a lead under 0.03 counts as a tie. Every tool, intervals and limits
What goes up, and what doesn't
Your code stays in your CI.
- Opt-in only.
penthera --publishsends a signed bundle: findings, the dependency list (SBOM), the evidence manifest and site check results. Never source code. - Without
--publish, nothing leaves your machine. That is how the free agent works today. - Bring your own model. Use the AI reviewer you already pay for:
penthera verifykeeps what the rules confirm, and the rest stays labelled unverified. We don't resell model access.
What we'd test
From about $100 a month per team.
A person, if you want one: an optional quarterly review with a written note. Assessments of one app or one release are quoted on their own.
Nothing is for sale. The hosted parts are planned, and they get built only if the waitlist shows a need. No check ever moves behind a paywall. Pro is not a certification: it shows what was checked and found, with the evidence.
Rather run it yourself? npx penthera@2.0.0 init --yes sets up the same checks in your own CI, free.
In research Checks your agents can call and pay for, one at a time, each with a signed verdict.