Autonomous pentesting · Verified exploits
Your coding agent shipped it.
Send in the attack agents.
HyperSec provides autonomous AI pentesting for live apps. Paste a URL and it explores the app, safely tests likely weaknesses, and reports only findings backed by confirmed evidence.
Full live-target scan
One scenario.
Three distinct jobs.
The Analyst decides what to test. The Tester executes one scenario against the live target. The Judge challenges the evidence before a finding is saved.
01 · Explore
Signs in and crawls
A browser signs in and crawls the scoped application. Every request is recorded: endpoints, HTTP history and passive anomalies.
Target app.northstar.dev
GET /api/invoices/:id
Anomaly · ownership
02 · Analyst
Writes the scenario
For each endpoint, the Analyst writes concrete test scenarios.
With account A, request
account B’s invoice.
Expected: access denied.
03 · Tester
Runs it, live
Each Tester takes one scenario and drives raw HTTP, or the on-demand intruder, against the live target. Three run in parallel.
GET /api/invoices/inv_9174
as Northstar Coffee → 200 OK
+ body: owner = Orbit Labs
04 · Judge
Challenges it
The Judge returns Confirmed, False positive or Insufficient. Insufficient sends specific feedback back to the Tester for a policy-limited retry.
Insufficient → retry → Confirmed
“Show who owns the returned invoice.”
05 · SaveIDOR
Records it
A confirmed finding is written to the vulnerability record deterministically. No LLM decides what gets saved.
Deterministic save
→ vulnerability record
No LLM persistence decision
One concrete scenario.
Scenario chains run concurrently; Tester execution is pooled at 3 by default.
Started on demand by the Tester; no separate bulk-fuzz phase.
MCP · Read-only platform access
Your findings,
where you already work.
Your coding agent shipped it. Now it can read what the attack agents confirmed. Connect any MCP-compatible client, sign in through browser OAuth or use an API key in CI, then ask for applications, scan status, confirmed vulnerabilities, evidence and recommendations.
The v1 connection is intentionally read-only. Your client can inspect HyperSec data without changing it.
Claude Code · ~/northstar-billing
MCP · hypersec ✔ connected · read-only
- Check HyperSec for confirmed findings on Northstar Billing and fix what’s open.
- hypersec - list_vulnerabilities (MCP)(app: "Northstar Billing", status: "confirmed")1 confirmed · VUL-00421 · HIGH · IDOR
- hypersec - get_vulnerability (MCP)(id: "VUL-00421")Cross-customer invoice access · CWE-639GET /api/invoices/inv_9174 as Northstar Coffee → 200 OK, owner: Orbit Labs
- hypersec - get_recommendations (MCP)(id: "VUL-00421")Require invoice.customer_id to match the authenticated customer.
- Update(app/api/invoices/[id]/route.ts)Added 1 line, removed 1 line2Removed: where: { id: params.id }2Added: where: { id: params.id, customerId: session.customerId }
- Fixed: the route now checks ownership. HyperSec’s MCP access is read-only — request a retest of VUL-00421 from the dashboard to confirm it closes.
- Baked for 38s
⏵⏵ accept edits on (shift+tab to cycle)
Finding evidence
A finding you can inspect,
reproduce, and retest.
Every confirmed finding carries its risk, confidence, CWE, affected request, reproduction steps, machine-captured evidence, remediation guidance, and retest status.
Finding VUL-00421 · Illustrative
Cross-customer invoice access
A signed-in customer can request an invoice owned by another customer by changing the invoice ID.
IDOR · HIGH · CWE-639 · GET /api/invoices/:id · param: id
Confirmed
by the Judge
Fixed
in your repo
Retested
by the Retester
Closed
status: fixed
Baseline · req_8F3C
- Request
- GET /api/invoices/inv_8421
- Signed in as
- Northstar Coffee
- Status
- 200 OK
- Invoice owner
- Northstar Coffee
Proof · req_9A21
- Request
- GET /api/invoices/inv_9174
- Signed in as
- Northstar Coffee
- Status
- 200 OK
- Invoice owner
- Orbit Labs
Retest · after the fix
- Request
- GET /api/invoices/inv_9174
- Signed in as
- Northstar Coffee
- Status
- 403 Forbidden
- Invoice owner
- — access denied
Recommended repair
Constrain the invoice query by both the requested ID and the authenticated customer.
where: { id: invoiceId, customerId: authenticatedCustomerId }Retest outcome
- Fixed
- Still vulnerable
- Partially fixed
- Unexploitable
The Retester re-ran this finding’s stored reproduction steps; the original exploit no longer reproduces.
Also in GitHub · PR review
Catch security defects
before merge.
The attack agents test your live app from the outside. Between scans, mention @hypersec on a pull request and it reviews the changed code, posting focused feedback on the lines that need attention.
PR review reads the diff. Exploits are only confirmed by testing the live application.
Read-only review · PR code is never executed · Feedback stays in GitHub
Suggested change
HyperSec · HIGH · CWE-639
Missing ownership check
This route fetches an invoice by ID but does not verify that it belongs to the signed-in customer.
Posted on line 2
How we handle your data
Trust, stated plainly.
01 · Scope
Testing stays inside what you authorize
Every scan runs against the targets and accounts you approve — nothing outside that scope is touched.
02 · Encryption
Encrypted at rest and in transit
Every scan and finding is encrypted at rest and in transit, on our infrastructure only.
03 · Ownership
We don't resell your data
Scan results are yours. Never sold.
- Target
- app.northstar.dev
- Ownership
- Domain verified
- Test accounts
- Northstar Coffee · Orbit Labs
- Policy
- Standard
Your organization
- Encrypted at rest · in transit
- Row-level security: only your org reads it
- MCP access: read-only
- Never sold
Pricing
Start free.
Scale when you need to.
Surface, Quick and Standard scans are free. Paid plans unlock Thorough and Stealth scans, retests and more AI credits.
Ronin
Freeno card required
500 AI credits / month
Surface, Quick and Standard scans with a security grade and findings list.
- Surface, Quick and Standard scans
- Domain verification
- Findings detail list
Samurai
$15per month
2,000 AI credits / month
Four times the AI credits, plus Thorough and Stealth scans, retests and PDF export.
- Thorough and Stealth scans
- Retests
- PDF export
- 2,000 AI credits per month
Daimyo
Recommended$100per month
15,000 AI credits / month
7.5× the AI credits of Samurai, plus scheduled scans and API access.
- All scan types, including Thorough and Stealth
- Scheduled scans
- API access
- 15,000 AI credits per month
Shogun
Customcontact us
Custom AI credits
Everything in Daimyo, plus white-label reports, analyst commentary, and a dedicated account manager.
- Everything in Daimyo
- White-label reports
- Analyst commentary
- Dedicated account manager
See what an attacker would find first
FAQ
Questions,
answered.
How HyperSec's attack agents test a live app, what they look for, and how your data is handled. If you have any other questions, please don't hesitate to contact us.
01What types of vulnerabilities can HyperSec detect?
HyperSec tests for cross-site scripting (XSS), broken object-level authorization (BOLA/IDOR), server-side request forgery (SSRF), SQL injection, CSRF, XML external entities (XXE), and prompt injection.
02How does the testing actually work?
Each test scenario passes through three roles: an Analyst decides what to test on a given endpoint, a Tester executes that one scenario against your live application, and a Judge reviews the resulting evidence — confirming it, rejecting it as a false positive, or sending specific feedback back to the Tester for a bounded retry. A finding is only saved once the Judge confirms it.
03Is my application data secure?
Your scan data is encrypted at rest and in transit, only your organization can read it, and it is never sold.
04Can I use HyperSec from my coding agent or in GitHub?
Yes, in two separate ways. HyperSec exposes a read-only MCP server — connect Claude Code, Cursor, Codex, or any MCP-compatible client to query your applications, scans, findings, and recommendations without leaving your editor. Separately, on GitHub, mention @hypersec or connect the app to a repository and HyperSec reviews new pull requests for security defects and posts a review comment on the diff.
See it live →05How is HyperSec different from traditional scanners?
Traditional scanners match fixed signatures. HyperSec's agents reason about your application's actual logic — chaining the steps a human attacker would — which surfaces access-control and business-logic flaws that signature-based tools miss. Every finding is reviewed by the Judge, which never approves its own discovery, before it reaches you.