penthera

Hey Behan! agreed with @J4v-Cyberpunkco giving your fullcode base to an LLM provider might not be the most secure move. AI is great for action oriented fixing; but in my experience (pentester) not verifiable AI found "everything" (how could you know what happens in their reasoning/process?)

So I've always used my local rule-based checking systems (acts like a white/red-hat hacker on your codebase) and it flags out most vulnerabilities; not bulletproof - working on that. Made it open-source if you'd like to use it: https://github.com/danoszz/penthera - you can use it through your CLI or Cursor, Claude Code as MCP/skill/agent or via NPM: https://www.npmjs.com/package/penthera - we even have a 24/7 watch dashboard locally (first prototype)- read more about the project here: https://penthera.org ; I aim to make security more accessible for beginning/pro developers building their product with AI tools.

Our rules are research backed and score #1 on a few benchmarks, for now, I am sure paid tools (Snyk, Aikido, Wiz) have a much larger database and more advanced models; but for now rule-based (non-AI) is my bet for the future; we deeply need to understand how these models operate by opening up the engine and have these transparent rules. Let me know if this solves your challenge! its free ofc :)

Daan

happy (safe) coding