Penthera

Penthera: your open-source cyber security agent

The security review you never had time for. Offline, rule-based, and you can verify every finding yourself.

[penthera.org](https://penthera.org): check your live site in a few seconds. Passive, nothing stored.

Daily notes from Penthera: [x.com/penthera_org](https://x.com/penthera_org)

Who builds it: Daan van der Zwaag, part-time and in the open.

How it compares: next to Snyk, Socket, Semgrep, ZAP and GitHub.

132 readable rules · 6 read-only MCP tools · 0 runtime dependencies · 0 requests past loopback in the benchmark · MIT, no telemetry

---

What it is

Penthera checks your app, its dependencies and your AI coding tools on your own machine. It fixes what it can, with your approval. Every finding comes from a rule you can read, with its evidence at file:line. A model may propose; a rule decides.

It is also an open R&D project. We measure every check in public and publish the results, good or bad, so you can see how far to trust it.

It finds known classes of problems, not novel ones. It does not replace a human pentester.

Start in 30 seconds

You need Node.js 22 or later. No install, no account.

Building with Cursor, Claude Code, Codex, VS Code, Windsurf, Gemini CLI, Zed, JetBrains or Kiro, or an app builder such as Lovable, Bolt, Base44, Replit or v0? Penthera in your coding tool has the setup for each.

In your terminal. Run this in your project folder:

npx penthera

It detects your setup offline, asks what to check, and gives you a grade per area and the three things to fix first. It scans your running app only after you confirm the app is yours. Nothing is committed or pushed (guided start).

In your coding agent. Pick yours, then ask "scan my app for security issues". The MCP lines pin the version.

The skill tells your agent how to run Penthera; the MCP server gives it six read-only tools. More routes: skill.md, mcp.md.

To run it in a container: docker build -t penthera . && docker run --rm penthera https://your-app.example.

Public benchmarks

We test Penthera on public datasets that other people built, next to the free open-source tools that do the same job, scored the same way. Each dataset was split in half before we looked: we improved Penthera on one half and scored it once on the other, sealed half. The rules for scoring and ranking were written down before that run (protocol).

⁴ A tied range is a rank interval: the range Penthera's rank fell in, in 95% of 10,000 bootstrap redraws of each tool's counts (on SecBench.js, of its 64 test bugs). Penthera alone came out first in 76% of the redraws on npm, 82% on PyPI and 60% on SecBench.js. Exploratory: computed after the registered ranking.

Leaked secrets: 2nd by F1, the registered score; 1st by F0.5, which weighs precision more (0.82 against deepsecrets 0.80); 2nd by F2, which weighs recall more (0.68 against deepsecrets 0.77).

Some ranked tools are barely in the contest. Other ranked tools scoring below 0.10: 1 of 9 on CredData (trufflehog); 3 of 5 on npm (clamav, yara, ossgadget); 4 of 7 on PyPI (clamav, ossgadget, bandit4mal, aura); 1 of 7 on SecBench.js (njsscan).

If 1 package in 1,000 were malicious, the share of Penthera's malware flags that would be right: npm, about 2.7% at the top of the false-alarm interval (it raised no false alarm on that sample); PyPI, about 1.6% at the measured false-alarm rate, 0.9% at the top of its interval. Exploratory, like the rank intervals.

Every tool, every number (95% intervals)

Leaked secrets (Samsung CredData)

Malicious npm packages (DataDog)

Malicious PyPI packages (DataDog)

Injection bugs in JavaScript libraries (SecBench.js)

A rank is shown only where at least 5 other free tools were measured; otherwise "–". The rank column orders tools by score, and close scores can swap places. Penthera's 95% rank interval (bootstrap, exploratory): 2nd on CredData, 1st to 3rd on npm, 1st to 3rd on PyPI, 1st to 4th on SecBench.js.

Paid tools (GitGuardian, Socket, Snyk, Phylum, Semgrep Pro) publish no results on these benchmarks, so they are not in the tables.

Published elsewhere, on other datasets (context, not comparable):

• A comparative study of software secrets reporting by secret detection tools (2023): nine tools on SecretBench, ggshield included
• [How effective are npm malicious package detec