Penthera documentation
Starter and pro. For “where do I start, and where do I go next?”Penthera is an open-source cyber security agent. It checks your app, its dependencies and your AI coding tools on your own machine, offline, with rules you can read. A model may propose; a rule decides. Pick the journey that fits you. Each page answers one question, and each journey runs from the first command to the details.
Watch the 80-second walkthrough. Demo data, no
sound, captions in the video (as text).
1. I’m new
For “is my app safe to ship?” Start with one command in your project folder:2. I use AI coding tools
For “is my AI setup safe, and can my agent run Penthera?”3. I run it in CI
For “how do I make it part of every change?”4. I need evidence for an auditor
For “what do I give my auditor?” Compliance output is readiness tooling. It is not a certification and not legal advice.5. I’m a researcher
For “how do you know it works?”
The accuracy numbers come with their sample and caveats on the same page. In
short: the bundled benchmark is 24 findings in labs we wrote ourselves, the E10
pilot used one labeller, and accuracy on real projects (E1) is not measured
yet.
The project
Programmatic API
lib/plugins.js and lib/blackbox/adaptive-scan.js, both
shipped in the npm package. The npm package ships only docs/examples/ from
this folder; the rest of the docs live on GitHub.
Only scan systems you own or are authorized to test.