---

What it is

Penthera checks your app, its dependencies and your AI coding tools on your own machine. It fixes what it can, with your approval. Every finding comes from a rule you can read, with its evidence at file:line. A model may propose; a rule decides.

It is also an open R&D project. We measure every check in public and publish the results, good or bad, so you can see how far to trust it.

It finds known classes of problems, not novel ones. It does not replace a human pentester.

Start in 30 seconds

You need Node.js 22 or later. No install, no account.

Building with Cursor, Claude Code, Codex, VS Code, Windsurf, Gemini CLI, Zed, JetBrains or Kiro, or an app builder such as Lovable, Bolt, Base44, Replit or v0? Penthera in your coding tool has the setup for each.

In your terminal. Run this in your project folder:

npx penthera

It detects your setup offline, asks what to check, and gives you a grade per area and the three things to fix first. It scans your running app only after you confirm the app is yours. Nothing is committed or pushed (guided start).

In your coding agent, as a skill. Then ask "scan my app for security issues":

npx skills add danoszz/penthera

In your coding agent, as an MCP server. Six read-only tools for Claude Code, Cursor, Codex, VS Code and Windsurf. Pin the version:

claude mcp add penthera -- npx -y [email protected] mcp

In Claude Code, as a plugin. From Claude Code's prompt:

/plugin marketplace add danoszz/penthera
/plugin install penthera@penthera

In Gemini CLI, as an extension. It runs the MCP server pinned in gemini-extension.json, which follows the newest release, release candidates included:

gemini extensions install https://github.com/danoszz/penthera

Other clients: docs/commands/mcp.md. Other skill install routes: docs/commands/skill.md.

To run it in a container: docker build -t penthera . && docker run --rm penthera https://your-app.example.

Public benchmarks

We test Penthera on public datasets that other people built, next to the free open-source tools that do the same job, scored the same way. Each dataset was split in half before we looked: we improved Penthera on one half and scored it once on the other, sealed half. The rules for scoring and ranking were written down before that run (protocol).

Benchmark	Score	Penthera 1.9.0	Penthera 2.0.0	Rank among free tools	Best other free tool
Leaked secrets (Samsung CredData)	F1	0.18	0.74	2nd of 10	deepsecrets 0.78
Malicious npm packages (DataDog)	caught minus false alarms	0.57	0.71	1st of 6, tied 1st to 3rd ⁴	malcontent 0.63
Malicious PyPI packages (DataDog)	caught minus false alarms	0.74	0.82	1st of 8, tied 1st to 3rd ⁴	GuardDog 0.74
Injection bugs in JS libraries (SecBench.js)	found in the right file	0.16	0.70	1st of 8, tied 1st to 4th ⁴	odgen 0.68

⁴ A tied range is a rank interval: the range Penthera's rank fell in, in 95% of 10,000 bootstrap redraws of each tool's counts (on SecBench.js, of its 64 test bugs). Penthera alone came out first in 76% of the redraws on npm, 82% on PyPI and 60% on SecBench.js. Exploratory: computed after the registered ranking.

Leaked secrets: 2nd by F1, the registered score; 1st by F0.5, which weighs precision more (0.82 against deepsecrets 0.80); 2nd by F2, which weighs recall more (0.68 against deepsecrets 0.77).

Some ranked tools are barely in the contest. Other ranked tools scoring below 0.10: 1 of 9 on CredData (trufflehog); 3 of 5 on npm (clamav, yara, ossgadget); 4 of 7 on PyPI (clamav, ossgadget, bandit4mal, aura); 1 of 7 on SecBench.js (njsscan).

If 1 package in 1,000 were malicious, the share of Penthera's malware flags that would be right: npm, about 2.7% at the top of the false-alarm interval (it raised no false alarm on that sample); PyPI, about 1.6% at the measured false-alarm rate, 0.9% at the top of its interval. Exploratory, like the rank intervals.

Every tool, every number (95% intervals)

Leaked secrets (Samsung CredData)