{"slug": "show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it", "title": "Show HN: Sabba, a security bug finder that proves every finding by running it", "summary": "Sabba, a new open-source security bug finder from developer 8NobleTruths, proves every finding by running an exploit and only reports bugs that reproduce, using an execution oracle instead of unverified language-model guesses. The tool, which runs as an MCP server for coding agents like Claude Code, Codex, OpenCode, Cursor, and Hermes, ships with two reproduced cJSON vulnerabilities (CWE-674 stack exhaustion fixed in 2017 and CWE-125 heap over-read fixed in 2024) as re-runnable proof bundles. Sabba supports C/C++, Solidity/EVM, Python, and Go, with a registry of provers that mint findings only from real, security-relevant crashes inside the target.", "body_md": "**Security Templates CLI & MCP Server for coding agents** that **prove every finding by running it**.\n\nClaude Code, Codex, OpenCode, Cursor, and Hermes call Sabba to prove a change, find and prove\nbugs, vet a skill, and drive the security toolchain, authorized-scope-only.\n\nIf it does not run, Sabba does not report it.\n\n**Two real cJSON vulnerabilities, reproduced and proved by running them:** a stack exhaustion\n(CWE-674, fixed upstream in 2017) and a heap over-read in `parse_object`\n\n(CWE-125, fixed in\n2024). Both came out of variant analysis from the upstream fix commits, so they are\nreproductions of known bugs and not new discoveries. What Sabba contributes is the proof: each\nwrite-up in [docs/scans](/8NobleTruths/sabba/blob/main/docs/scans) carries the exact input and a bundle you can re-run on your\nown machine to watch AddressSanitizer fire. Novel zero-day discovery is a later phase and is not\nsomething this repository claims yet.\n\nThat is the whole design. Most tools that use a language model ask it \"is this function\nvulnerable?\" That is close to a coin flip, even for large models, and unverified guesses bury\nmaintainers in false positives. Sabba takes the opposite stance: a model proposes candidates,\nbut an **execution oracle runs an exploit** and decides whether a security property actually\nbroke. Nothing is reported unless the exploit reproduces. A finding is not a score, it is a\nre-runnable proof.\n\nSabba runs as an MCP server, so Claude Code, Codex, OpenCode, Cursor, and Hermes can call it.\nFor **Codex CLI**, add it to `~/.codex/config.toml`\n\n:\n\n```\n[mcp_servers.sabba]\ncommand = \"sabba\"\nargs = [\"mcp\"]\n```\n\nFor **Claude Code**:\n\n```\nclaude mcp add sabba -- sabba mcp        # after installing; see Install below\n```\n\nFourteen tools, most token-free: ** verify_change** (prove a change works in any of 16\nlanguages: a new test fails on the base and passes on the head, via the bundled Magga engine)\nand\n\n**(the same differential, run natively for C/C++/EVM),**\n\n`prove`\n\n`verify`\n\n/ `solve`\n\n/\n`hunt`\n\n/ `scan`\n\n(find and prove bugs), **(vet a skill by running it under observation),**\n\n`security_scan`\n\n`rank`\n\n, `run_sandboxed`\n\n, and **(drive nmap / nuclei / ffuf / sqlmap and the rest, scope-enforced and sandboxed). Install the security command templates with**\n\n`kali_run`\n\n`sabba templates install`\n\n. Full catalog and per-client configs in\n[docs/AGENT_INTEGRATION.md](/8NobleTruths/sabba/blob/main/docs/AGENT_INTEGRATION.md).\n\n**Correctness and security in one server.** `verify_change`\n\nproves the change does what it\nclaims; `prove`\n\n/ `hunt`\n\n/ `scan`\n\nprove it added no new bug. The change-verification engine is\n[Magga](https://github.com/8NobleTruths/magga), vendored as a submodule under `magga/`\n\nand\ndriven through `npx`\n\n, so both halves ship as one tool.\n\n**Find a real bug and hand you the proof, not a hunch.** Every finding ships as a bundle: the\ninput that triggers it, the target, the command that reproduces it, and the sanitizer output\nit produced. You do not have to trust the report, you can re-run it. The cJSON bugs above are\ntwo of these bundles.\n\n**Work across languages and across chains, with one rule.** The oracle started on C and C++\nmemory safety and generalized into a registry of provers, one per runtime and vulnerability\nclass. Every prover obeys the same contract: a finding is minted only from a verdict that a\nreal, security-relevant crash happened *inside the target*.\n\n| Domain | Runtime it proves on | What counts as proven | Examples |\n|---|---|---|---|\nC / C++ |\nclang + AddressSanitizer / UBSan | the sanitizer reports a real memory error | heap / stack overflow, use-after-free |\nSolidity / EVM |\nFoundry mainnet fork | attacker ETH profit or a broken solvency invariant, measured on-chain | reentrancy fund-drain |\nPython |\natheris | a crash raised in the target, not the harness | stack exhaustion, C-extension segfault |\nGo |\n`go test -fuzz` |\na recovered runtime panic at a target frame | index / slice out of range, nil deref |\nJava / JVM |\nJazzer | a target throwable or a bug-detector finding | stack overflow, injection detectors |\nNode JS / TS |\nJazzer.js | a target crash or a bug-detector finding | prototype pollution, ReDoS, path traversal |\n\n**Refuse to be fooled, even by a hostile harness.** When a model writes the fuzz harness, a\nhostile target could try to steer it into faking a crash. Sabba's fuzzing provers are\n*harness-untrusted*: the fuzzer only discovers a candidate input, then a Sabba-owned\nreproducer re-runs it and reads the verdict from channels the harness cannot forge (a real\nexception's structured stack, or the parent's own measurement of a killed child). It reads\nno stdout, no artifact file, no magic phrase. The full model is in\n[docs/PROVER_SOUNDNESS.md](/8NobleTruths/sabba/blob/main/docs/PROVER_SOUNDNESS.md).\n\n**Prefer soundness over coverage, and say so.** Where a crash cannot be soundly pinned to the\ntarget (a hang or an out-of-memory that could just as easily be the harness spinning or\npre-filling the heap), Sabba surfaces it as an unverified candidate for a human, but never\nmints it as a finding. It would rather miss a bug than report one that did not happen.\n\n**Meet you where you work.** One command, several surfaces: a scriptable CLI (`verify`\n\n,\n`solve`\n\n, `hunt`\n\n) and an interactive REPL (pictured above) that streams the model, runs tools,\nand renders each proof as a card. Running `sabba`\n\nwith no arguments opens the REPL.\n\nThe oracle and provers never needed a model, and the model-driven parts can run on your own\nmachine too. Point the reasoning at a local, OpenAI-compatible endpoint with\n`SABBA_LLM_BACKEND=local`\n\n, and train a small CPU risk ranker so retrieval looks at the risky\nfunctions first:\n\n```\nsabba mltrain          # trains a risk ranker (TF-IDF + logistic), saved to ~/.sabba\n```\n\nA three-tier cascade keeps work cheap: Reflex (no model: the ranker, Z3, the oracle), Resident\n(the local model), and Teacher (a frontier model) only for the hard cases. The verdict rule\nholds across tiers, so a cheaper tier costs coverage, never soundness. See\n[docs/LOCAL_ML.md](/8NobleTruths/sabba/blob/main/docs/LOCAL_ML.md).\n\n``` php\n                 model / z3 / retrieval  ->  candidate input\n                                                   |\n                                                   v\n                     +---------------------------------------+\n                     |   execution oracle  /  prover         |\n                     |   compile, run the exploit, measure   |\n                     +---------------------------------------+\n                                    |            |\n                              reproduces     does not\n                                    |            |\n                                  FINDING     dropped\n```\n\nThe oracle is the one gate. Whether a candidate came from the Z3 synthesizer or from the\nmodel, it is compiled and run before anything is reported. Z3 proposes an input, the oracle\ndecides. The model proposes an input, the oracle decides. The same discipline carries to\nevery domain in the table above: on an EVM fork the *chain* measures the attacker's profit,\nnot the model, so the model cannot grade its own work.\n\n```\npip install sabba          # or: pipx install sabba / uvx sabba mcp\n```\n\nThen run `sabba doctor`\n\nto see what the toolchain can prove on this machine. `verify_change`\n\nshells out to the Magga engine over `npx`\n\n, so it needs Node on your PATH but no extra install\nstep.\n\nTo work on Sabba itself, clone it with the submodule and use the installer, which sets up an\nisolated environment under `~/.sabba`\n\nand puts a `sabba`\n\ncommand on your PATH:\n\n```\ngit clone --recurse-submodules https://github.com/8NobleTruths/sabba.git\ncd sabba\n./install.sh\n```\n\nUpdate later with `sabba update`\n\n, remove with `sabba uninstall`\n\n.\n\nProvers use the toolchain of the domain you target: clang with AddressSanitizer for C and\nC++, Foundry for EVM, and atheris, `go`\n\n, Jazzer, or Jazzer.js for the managed languages.\n`sabba doctor`\n\nreports what is present.\n\n```\nsabba                                     # opens the REPL; type /setup for guided first-run setup\n\n# no model needed, prove a known target:\nsabba verify cwe121_stack_overflow\nsabba solve  cwe121_stack_overflow\n```\n\nThose two names are demo targets that ship inside the package, so an installed Sabba can prove\na real bug on the first command, with no clone, no model, and no API key. Point the same\ncommands at a directory of your own holding a `target.json`\n\nto work on your code instead.\n\nFirst run opens a guided setup: `/setup`\n\nshows a checklist, and each step explains why it is\nworth doing, what happens if you skip it, and what happens when you do it. `/local-llm-config`\n\ndetects your CPU and RAM, recommends a Qwen2.5-Coder size, and pulls it with Ollama so the\nmodel runs on your machine; `/add-model-key`\n\nuses a cloud model instead; `/ml-config`\n\ntrains\nthe risk ranker. You can select any command from the `/`\n\nmenu. `/solve`\n\nand `/verify`\n\nprove\nbugs with no model at all, so they work before any setup.\n\nBring in a model through OpenRouter (or any OpenAI-compatible endpoint) to hunt fresh code:\n\n```\nexport SABBA_LLM_BACKEND=openrouter\nexport OPENROUTER_API_KEY=...             # from openrouter.ai/keys\nsabba hunt cwe122_heap_overflow --model qwen/qwen-2.5-coder-32b-instruct\n```\n\nKeys are read from the environment, never stored in the repo, and a pre-commit hook blocks\nanything that looks like a credential (see [CONTRIBUTING.md](/8NobleTruths/sabba/blob/main/CONTRIBUTING.md)).\n\n[docs/SABBA_AGENT_DESIGN.md](/8NobleTruths/sabba/blob/main/docs/SABBA_AGENT_DESIGN.md)- the C and C++ bug-finder: the oracle, retrieval, the Z3 synthesizer, and the reasoning agent.[docs/PROVERS_MULTI_DOMAIN_DESIGN.md](/8NobleTruths/sabba/blob/main/docs/PROVERS_MULTI_DOMAIN_DESIGN.md)- how the oracle generalizes into the prover registry, including Web3 and Solidity.[docs/PROVER_SOUNDNESS.md](/8NobleTruths/sabba/blob/main/docs/PROVER_SOUNDNESS.md)- the harness-untrusted verification model that makes the fuzzing provers sound against an adversarial harness.[docs/WATER_LAYER_DESIGN.md](/8NobleTruths/sabba/blob/main/docs/WATER_LAYER_DESIGN.md)- the next layer: an agent that keeps its skills as runnable code, runs without a frontier model, and can be rebuilt from a seed. Provers are the skills it accumulates.\n\nThe native oracle, retrieval, Z3 synthesis, the reasoning agent, and the full prover registry across C/C++, Solidity/EVM, Python, Go, Java, and Node run today, each with live proofs. The Water Layer and a broader symbolic-execution pass are next.\n\nApache-2.0. See [LICENSE](/8NobleTruths/sabba/blob/main/LICENSE). The framework is open source. Trained model weights and\ndatasets are developed separately and are not part of this repository.", "url": "https://wpnews.pro/news/show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it", "canonical_source": "https://github.com/8NobleTruths/sabba", "published_at": "2026-07-27 05:57:53+00:00", "updated_at": "2026-07-27 06:22:09.907825+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents"], "entities": ["Sabba", "8NobleTruths", "Claude Code", "Codex", "OpenCode", "Cursor", "Hermes", "cJSON"], "alternates": {"html": "https://wpnews.pro/news/show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it", "markdown": "https://wpnews.pro/news/show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it.md", "text": "https://wpnews.pro/news/show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it.txt", "jsonld": "https://wpnews.pro/news/show-hn-sabba-a-security-bug-finder-that-proves-every-finding-by-running-it.jsonld"}}