0security is an open-source AI cybersecurity harness for security teams, developers and researchers who need to build and deploy continuous security agents that find, prove, fix and monitor vulnerabilities across code, binaries, dependencies, infrastructure and AI agents.

What it is

0security is an open-source, TypeScript-based AI cybersecurity harness released under Apache-2.0. It lives in the developer-tools and application-security ecosystem and is driven through a web UI, a CLI, CI and an MCP server. The project runs on the user's own infrastructure with the LLM provider of their choice, including any provider key or a local OpenAI-compatible server, so only the context sent to the chosen model leaves the environment.

The concrete problem it solves is the gap between finding a vulnerability and proving, fixing and monitoring it. It replaces a detection-only, one-off scanning workflow with persistent security agents that have a scope, budget and memory and that run on a schedule or on every pull request. Those agents can examine source code, web apps and APIs, MCP endpoints and packages, dependencies, binaries, infrastructure and AI agents; every finding links to its source evidence, and patches are reproduced and validated before they are applied.

Key capabilities

• Finds vulnerabilities in source code, web apps and APIs, MCP endpoints and packages, with each finding linked to its source evidence.
• Checks and fixes dependencies for npm, pnpm, Cargo and PyPI through 0 deps scan and 0 deps fix.
• Reproduces findings, generates patches and validates each patch before application, then keeps watching for recurrence.
• Builds persistent security agents with a scope, budget and memory that run on a schedule or on every pull request, with skills, plugins and automations.
• Reverse engineers binaries with Ghidra and supports kernel and memory-safety fuzzing, while mapping attack surface across domains, JavaScript, cloud and Entra ID posture.
• Hunts variants of a known fix across a codebase, tests AI agents with prompt-injection campaigns, and assembles GHSA-ready advisory drafts from saved findings.
• Automates scans in CI/CD with JSON and SARIF output, exposes an MCP server for coding agents, and can be extended with plugins and skills.

Who uses it and how

• Security engineers can run the harness on a laptop, in CI or in a container, keeping scan context on infrastructure they control and sending only selected context to a provider key or local OpenAI-compatible server.
• Application security teams can create persistent agents with a scope, budget and memory that run on a schedule or on every pull request, covering code, dependencies, infrastructure and AI agents.
• CI/CD owners can automate scans with JSON and SARIF output and use the GitHub Action guide referenced by the README.
• Coding-agent users can drive 0security over MCP; the README shows the 0 mcp-server command with --automations and --workspace options, alongside plugin and skill extension points.
• Security researchers can reverse engineer binaries with Ghidra, run kernel and memory-safety fuzzing, and assemble GHSA-ready advisory drafts; the project cites disclosed vulnerabilities and upstream fixes, including in the Linux kernel.

Getting started

The README's quick start is curl -fsSL https://raw.githubusercontent.com/0sec-labs/0security/main/install.sh | bash, followed by the 0 command; the terminal path sets ANTHROPIC_API_KEY and runs 0 scan source ./your-repo --runtime api --depth quick --cost-ceiling 2. It also ships as the Docker image ghcr.io/0sec-labs/0security:latest, a Windows x64 executable marked experimental, and a source build with Node.js 24+ and pnpm.

How it compares

No comparable tools or paid-product replacement list is provided, so 0security stands alone in this registry. Its documented integrations are with coding agents, MCP, CI/CD and model providers rather than with named competing security products.

When to use it — and when not to

A self-hoster must supply model access through a provider key or a local OpenAI-compatible server and run the CLI, container or CI job on infrastructure they control. Teams that want a fully hosted, zero-operations service should not pick it, because the README describes a self-hosted deployment model. The Windows build is marked experimental, and the licence metadata (Apache-2.0) differs from the README (MIT or Apache-2.0), so terms should be confirmed before adoption.

curl -fsSL https://raw.githubusercontent.com/0sec-labs/0security/main/install.sh | bash
0

export ANTHROPIC_API_KEY="your-api-key"
0 scan source ./your-repo --runtime api --depth quick --cost-ceiling 2

0 automation run --template security-research \
  --target /absolute/path/to/repo --workspace /absolute/path/to/repo
0 mcp-server --automations --workspace /absolute/path/to/repo