danosz

amazing! great design too. would love to see a way to integrate with MCP/API or another connection (even on the free-tier max. 1 scan) to inspect the data to make some data-driven product decicions in your coding environment (e.g Cursors/Claude Code where our marketing team "lives")

hey Behan! agreed with Cyberpunkco giving your fullcode base to an LLM provider might not be the most secure move. AI is great for action oriented fixing; but in my experience (pentester) not verifiable AI found "everything" (how could you know what happens in their reasoning/process?) So I've always used my local rule-based checking systems (acts like a white/red-hat hacker on your codebase) and it flags out most vulnerabilities; not bulletproof - working on that. Made it open-source if you'd like to use it: https://github.com/danoszz/penthera - you can use it through your CLI or Cursor, Claude Code as MCP/skill/agent or via NPM: https://www.npmjs.com/package/penthera - we even have a 24/7 watch dashboard locally (first prototype)- read more about the project here: https://penthera.org ; I aim to make security more accessible for beginning/pro developers building their product with AI tools. Our rules are research backed and score #1 on a few benchmarks, for now, I am sure paid tools (Snyk, Aikido, Wiz) have a much larger database and more advanced models; but for now rule-based (non-AI) is my bet for the future; we deeply need to understand how these models operate by opening up the engine and have these transparent rules. Let me know if this solves your challenge! its free ofc :)

Daan happy (safe) coding