Show HN: Penthera, offline pentest security scanner (open-source, rule-based)

Developer Daan open-sourced Penthera, a rule-based, offline security scanner for apps and websites, runnable via CLI, NPM, MCP or coding-agent skill with the command "npx penthera --repo .". Penthera runs hundreds of manual security checks as a free, non-AI alternative that consumes $0 tokens, supports pre-commit hooks and CI, offers a --deep flag for SQLi, SSTI, SSRF, XSS and command-injection tests, and an --ai flag that opts into a local Ollama model whose findings never override the rules. Daan said the tool scores #1 on some public benchmarks among free tools for npm malware, PyPI malware and JS injection bugs, and is seeking contributions to its rule lists at penthera.org.

local non-AI security for your app/site For years I had a long .txt file with hundreds of manual security checks I ran before pushing a client app/site to live; I am really a rookie compared to the real cyber experts, but just covering the basics has saved us many times from malicious attacks on our infrastructure. With the sprawl of AI generated vibecoded apps I love it, i think creating should be accessible, but so should be cyber safety and AI coding tools, our code goes to LLM providers but we'd never know what exactly happens behind the scene, hype harness is just rules imo. As i've started my phd and not building apps anymore for a living; I'd decided to open source my rule-based system with some easy onboarding; use it through CLI, NPM, MCP, skill/agent whatever they might call it in a few years . Its super helpful as a free, open-source alternative to run these checks in your codebase. Having a non-AI solution that costs $0 tokens might not outperform a SOTA security model of a big company; but running internal blue/red hat pentests 24/7/365 should be the norm for a safer internet; having it open-source making it a whitebox system and I hope many people contribute their lists. Its not bulletproof but we score 1 on some public benchmarks among free tools npm malware, PyPI malware and JS injection bugs so thats encouraging you can run it pre-commit hook, CI etc - working on a "watch" function that runs it live. Have some flags like --deep for a very intense pentest SQLi, SSTI, SSRF, XSS, command injection so be careful and only your own URLs. Also --ai opts-in a local Ollama or if you want paid also fine model to find things beyond my rules the LLM never decides on findings . After you can pass it to you coding agent to fix it; thats up to you. maybe in future ill improve this UX but like to stay local-offline-first anyway feel free to try and give feedback or do a PR if you have some ideas. no signup, $0, local, hackable; read more on the www: penthera.org for some research i've done to make it better/transparent npx penthera --repo . <3 daan Comments URL: https://news.ycombinator.com/item?id=50379624 https://news.ycombinator.com/item?id=50379624 Points: 1 Comments: 0