GAUNTLEX

⚔️ GAUNTLEX

Adversarial Co-Generation Engine

Generates code and adversarial attacks from the same specification, at the same time — before a commit exists.

What it is · See it run · Quickstart · Commands · Domains · IDE Integrations · Deep Dive

---

What it is

Every AI coding tool ships code and hopes someone tests it for security later. GAUNTLEX removes the "later." It runs two agents concurrently against the same specification:

• Builder — generates the implementation
• Breaker — generates adversarial attacks against the same spec, at the same instant

An Arbiter scores every attack (mitigated / partial / missed) and produces an Adversarial Resilience Score (ARS). A configurable gate blocks your CI pipeline when the score falls below threshold — the same way a failing test suite blocks a merge.

No manual test authoring. No separate security review step. No waiting for a scanner to catch up to code that shipped last week.

---

See it run

📊 One-page overview — what it is, what's different, how it deploys. Built for sharing with a technical lead or architecture review board.

[Download the full PDF](docs/media/GAUNTLEX_Overview.pdf)

Watch the Demo

Setup through the CI gate, real terminal output, real dashboard — concurrent Builder + Breaker, HIPAA domain testing, and every IDE integration in one pass.

---

Why it's structurally different

Three properties, not features — the reasoning behind each is in the Deep Dive:

1. Concurrent, not sequential. Builder and Breaker fire at the same instant via asyncio.gather(). The Breaker never sees generated code — it reasons from the specification alone, the same surface a real attacker would work from before your implementation choices exist.
2. A native MCP integration, both directions. GAUNTLEX exposes itself as an MCP server so Claude Code, Cursor, Windsurf, or Zed can trigger and poll runs directly from your coding tool — and it consumes external MCP servers (plus built-in CISA KEV / NIST NVD feeds) to enrich every run with live threat data. See the Domain Intelligence page for exactly what's live vs. static.
3. Regulatory domains as first-class input. FINRA, HIPAA, PCI DSS, SOC 2, and OWASP Top 10 playbooks steer the Breaker toward the scenarios that actually matter for a regulated codebase — not a generic scan re-labeled per industry.

---

Where GAUNTLEX fits vs. other security testing

Not a replacement for any of these — a different point in the lifecycle. Static analysis and pentests are still worth doing; GAUNTLEX exists because neither of them runs *while the code is being generated*.

---

Quickstart

gauntlex setup        # start here — interactive, detects and validates the best

model for your environment (Ollama, OpenRouter free

tier, or your own API key)

gauntlex run --issue examples/demo_issue.md --mode quick --pretty # then run the demo spec

Install first with pip install gauntlex-ai, or skip the install entirely with uvx --from gauntlex-ai gauntlex setup.

gauntlex setup writes your model provider and credentials to .env for you — there is no manual configuration step, and no fallback to whatever API key happens to be lying around the environment. What you configure during setup is what runs, always (run gauntlex init separately if you also want a .gauntlex.yml with tunable defaults like rounds_max or the gate threshold).

──────────────────────────────────────────────────────────────────────

GAUNTLEX Adversarial Run Mode: quick (5 attacks) Language: python [signals: filesystem, async] Domain: owasp_top10 ────────────────────────────────────────────────────────────────────── ARS Score: 0.87 ✅ PASSED (gate: ≥ 0.80)

✅ CWE-89 SQL Injection via username param mitigated ✅ CWE-502 Unsafe deserialization mitigated ✅ CWE-78 OS command injection in file path mitigated ✅ CWE-22 Path traversal in upload handler mitigated ❌ CWE-79 Reflected XSS in error message MISSED ──────────────────────────────────────────────────────────────────────

Wall-clock time depends on which model you configure — anywhere from single-digit seconds with a fast paid API to several minutes with a free-tier or local model. Attack count *targets* 5/20/50 by mode (quick/standard/thorough), spread across the adversarial rounds — actual totals land close to but not always exactly at the target (a thorough run might fire ~30–50, for example), since it depends on how many attacks the model actually returns per round.

Run against a GitHub issue directly

gauntlex run --issue https://github.com/your-org/your-repo/issues/42 --mode standard --domain hipaa --pretty

Add business intent — attack surface = spec + why it's needed

--issue is the spec — precise enough for the Builder and Breaker to implement and attack. It answers *what* to build. --intent adds a second, separate input answering *why* it's needed, pulled from wherever your team actually tracks that: a Jira key, a Confluence page, or an Aha! roadmap item. GAUNTLEX reasons from both together, not just the spec alone.

gauntlex run --issue SPEC.md --intent PROJ-123 --domain hipaa --pretty

gauntlex setup connects Jira/Confluence/Aha! automatically if it detects credentials in your environment — see the interactive wizard's business intent step.

Requirements

• Python 3.11+
• macOS, Linux, or Windows (WSL2 recommended on Windows)
• One model provider: Ollama (free, local), OpenRouter free tier, or an Anthropic/OpenAI API key

---

CLI reference

All 22 commands, grouped by when you'd reach for them:

Full usage, flags, and examples for every command: Deep Dive → Complete CLI Reference.

---

Language support

Auto-detected from the specification — no per-project configuration:

---

Compliance & domain coverage

5 regulated-industry playbooks ship today — 43 attack scenarios total, each mapped to a specific rule or control, not a generic label:

Two more (owasp_api_security, nist_ssdf) are available via gauntlex policy install. GDPR, FedRAMP, and DORA are on the roadmap — not available today.

For exactly what's live threat data vs. static playbook content, and how to bring your own domain, see the full [Domain Intelligence page](docs/DOMAIN_INTELLIGENCE.md).

---

IDE & agent integrations

One command wires GAUNTLEX into whatever AI coding tool you already have open:

gauntlex integrate --dry-run               # preview every config it would write, writes nothing

gauntlex integrate # wire up every supported target at once gauntlex integrate --platform claude-code # or just one — .mcp.json gauntlex integrate --platform cursor # .cursor/mcp.json gauntlex integrate --platform windsurf # ~/.codeium/windsurf/mcp_config.json gauntlex integrate --platform copilot # .vscod