Pick a folder. Hit Scan. Get a durable, triage-ready list of leaked secrets, vulnerable packages, risky CI/cloud config, dangerous code and much more, all on your machine. Use any model you already have access to including all major providers. Achilles is a full-fledged security product utility, not a simple chat wrapper.
Achilles makes Codex, Claude Code, OpenCode and Cursor (and more) security aware. As a dedicated security assistant with optional MCP, it finds, triages and briefs on real findings so your harness can patch with full ledger context and far fewer tokens. You can continue using your preferred harness and avoid wasting tokens on high-cost AI inspection libraries.
Achilles is private, local, and ledger-first. Below is a sample code base with 524 files, 5 findings, all on local to the developer's machine.
achilles.db.
A desktop app you run on your computer (Windows, Mac, Linux). Not a website that uploads your code. You keep everything, the scan, the list, the history, on your machine.
In seconds it looks through the code base you already have, same ignore rules as ripgrep. Opt in for more advanced and exhaustive dependency checks.
Confirm, mark as a false alarm, or mark as fixed. It remembers across rescans. Rescan the whole tree or just git-changed files.
Achilles can copy a pasteable fix brief, or connect as MCP to Cursor, Claude Code, Codex, OpenCode. Achilles finds and triages; you (or that editor) apply the patch. Extremely token-efficient, the engines guide the AI through the lift.
Pairs with Codex / Claude Code / OpenCode / Cursor — Achilles finds + triages, your harness patches.
| Capability | Achilles | deepsec agent audit | Endor agent audit | Raw prompt baseline | Point scanners one job |
|---|---|---|---|---|---|
| Find — one shared walk | |||||
| One shared walk · vendor opt-in | ✓ native | ~ matchers + agents | ~ graph index | — repo dump | — re-walks |
| Dangerous-code sensor · JS/TS, Python, Go, Rust, Java, C/C++ + more | ✓ native | ~ candidates + AI | ✓ AI SAST | — metered | ✓ alone |
| Leaked-credential sensor + git history | ✓ native | ~ | ~ | — metered | ✓ alone |
| Package risk: known-CVEs + pinning + install / typo hygiene | ✓ native | — | ✓ reachability | — | ✓ alone |
| Extra supply-chain alerts on same packages, token-optional | ✓ native | — | ~ supply-chain | — | ~ separate feed |
| Deploy / CI exposure checks | ✓ native | ~ custom matchers | — | — | — 2nd tool |
| Startup + surface inventory | ✓ native | ~ | — | — | — |
| KEV / EPSS attach on CVE aliases | ✓ native | — | ~ context-scored | — | ~ separate feed |
| Hard-coded value hygiene, opt-in | ✓ native | — | — | — | — |
| Code Map: functions, callers, routes / templates | ✓ native | — | ~ call-graph nav | — manual grep | — |
| Remember — ledger, not a chat log | |||||
| Whole tree or git-changed mode | ✓ native | ~ diff mode | ~ | — | — |
| Validator verdicts — must quote source, never invents | ✓ native | ~ revalidate, paid | ~ triage pass | — may invent | — |
| Memory — new / gone, states stick across rescans | ✓ native | ~ state folder | ~ tracked | — none | — |
| Pause / resume — aborted runs keep ledger | ✓ native | ~ resume | — | — lost | — |
| Fit — your setup stays | |||||
| Fix brief + MCP — ledger as context, no repo dump | ✓ native | — | ~ fix guidance | — full dump | — |
| Built-in industry-recognized skills | ✓ native | ~ plugins | — | — | — |
| Scheduled scans + recipes | ✓ native | — | ~ CI runs | — | — |
| Direct BYOK — no gateway hop, keys stay on machine | ✓ direct | ~ gateway default / BYOK | ~ managed platform | — subscription burn | ✓ free, no LLM |
Depth is a dial, cost stays capped. FAST as low as $0, Investigate up to 80 reviews, Deep up to 160 units + 250 reviews (16k files).
Per deepsec docs: full-repo max-thinking audits run hours–days, often $1k+ a pass.Recommended to run Achilles on schedules and/or for every commit. deepsec figures from their public docs + DeepsecBench; Endor characterizations from their public AI SAST benchmark post.
AWS keys, GitHub/GitLab PATs, Slack, Stripe, Google, npm, Hugging Face, Anthropic, Postgres/Mongo URLs, Vercel / Railway / DO, PEM blocks, webhooks. Redacted previews, capped at 200 hits. Full-tree scan also checks local git history — not a vault resolver, not complete coverage.
Regex-lite, line-oriented, extension-tagged for C/C++, Python, JS/TS, Go, PHP, Java, C#, Ruby, Rust. gets/strcpy, eval/pickle/yaml.load, innerHTML, string-built SQL, Runtime.exec, and similar. Explicitly not Joern / CodeQL — no taint, no interprocedural. A first pass you will actually run, not complete coverage.
Reads package-lock / yarn, requirements.txt / Pipfile.lock, Cargo.lock, go.sum, Poetry, Bundler, Composer. Queries OSV, plus pinning (unpinned / missing lockfile) and hygiene (lifecycle scripts, distance-1 typosquat).
Optional with token: Socket supply-chain alerts on the same PURLs (risk / capabilities / quality / license).
Fingerprint inventories what’s in the tree: GitHub Actions, GitLab, Circle, Azure Pipelines, Jenkins, Terraform (AWS/Azure/GCP), K8s/Helm, Docker, Workers, Vercel, Netlify, Railway, Fly, Firebase, Ansible… Surfaces checks those files: pull_request_target, curl-pipe-shell, write-all / persist-credentials, 0.0.0.0/0, public S3, privileged k8s/compose, :latest / root, CORS *. Harden is detect-only (no auto-fix). Not a live posture scan, not Nuclei/DAST by default.
This is a native agent runtime with a local database at the center. Engines run once, findings land with path, line, evidence, severity, and engine name, and stay there.
The transcript runs beside a durable Findings rail. Start a Scan, Rescan, or Scan changed files. Pick Fast, Investigate, or Deep. Toggle vendor or literals, enable the extra catalog for supply-chain alerts when a token is set, and pause or resume anytime.
Triage each finding as confirmed, dismissed, or verified fixed. Achilles remembers your choice, and the ledger tracks everything from open to resolved.
The desktop talks directly to the engine to start, pause, cancel, or list scans and findings. No parsing chat text, no brittle scraping.
Findings tell you what's risky. Code Map shows you where it lives and how it connects. Everything stays local with no chat upload and no invented graph. Built from the same walk that feeds the ledger.
Browse the workspace file by file, functions, exports, and entry points surfaced from the inventory the engines already built. Find the handler before you read the CVE.
Trace caller → callee across the tree. When a finding lands on a sink, walk backwards to the source without grep-spelunking.
Map exposed routes, framework handlers, and template bindings in one view. See which endpoint renders which view, which middleware guards it, and where that XSS sink is actually reachable.
Achilles triages. Your editor or coding agent applies. Copy a fix brief, or let the agent read the ledger directly over MCP, far deeper than a frontier model can do alone, and wildly more token-efficient.
Model Context Protocol lets your coding agent use Achilles as a tool. Findings stay in the local ledger; the agent reads that ledger over MCP instead of you pasting scan output or whole files into chat.
No editor? Same tools headless via achilles appsec {scan, query, investigate, brief, verdict, triage} for CI and scripts.
Installed with the harness, toggle per-model in Skills. The model loads them when the topic matches — how to think about a class of issues, not a second scanner. Each is a SKILL.md playbook.
Authentication and authorization — login, sessions, JWT, permission checks.
Security-minded path or git diff review. No invented CVEs.
Discuss the latest scan. Finding ids only — spell out SAST/SCA.
High-confidence PR / branch / diff review with a path to a sink.
Layout, entry points, how to build and test — no whole-tree dump.
Deploy, CI, and cloud surfaces from fingerprint — nothing invented.
Lightweight model from surfaces + open findings. No invented AWS/K8s.
SCA finding or known-vulnerable library via appsec_intel. No invented scores.
Stack playbooks: JS / Python / Go / Rust / IaC / Actions / auth.
pull_request_target, write-all, persist-credentials, fork-PR secrets.
Patch brief for one finding id. Wait for confirmation before editing.
Remove leaked credential from repo and rotate. Never print the secret.
Hunt the same pattern elsewhere from one finding or file:line.
Shipped in the binary, materialized on first run. Show up in Recipe Library, can’t be deleted. Import extras or run via CLI. Skill = how to think mid-chat · recipe = same job on demand or on a timer.
Fast scan, then walk what’s still open in the ledger.
Runs a fast scan on your workspace, then walks through severity, engine, and triage state for every open finding.
Best for a quick health check after you land changes, or a scheduled nightly recap so nothing new sits unreviewed.
Lockfile CVEs plus sloppy dependency hygiene.
Pulls known-vulnerable packages from your lockfiles and flags unpinned versions, missing locks, risky install scripts, and lookalike names.
Built for weekly dependency review: what’s exploitable today, and what’s sloppy even when it isn’t CVE-tagged yet.
High-confidence review of the PR, branch, or diff you’re on.
Starts from Achilles findings and demands a concrete path to a sink, with no invented issues.
Same judgment as the security-review skill, packaged as a recipe you can run on demand or put on a schedule before merge.
The scheduler only fires recipes — same job on a timer.
Set cadence in Recipe Library: nightly recap, weekly package hygiene, or a pre-merge security review. Achilles runs headless and writes results to the ledger.
FAST mode is extremely token-efficient. Investigate and Deep put the model on ledger rows — path, line, evidence, and severity already in context — not open-ended chat. Keys stay on the machine.
Any provider you already pay for. No scan quota.
A fine-tuned edge model meant to run on the machine, including low-power devices. Lightweight. Free when it ships. The harness is what you install today, also free. Arrav is not in this download.
Installers ship from GitHub Actions. The floating stable tag always tracks the latest build. All releases →