Penthera: Open-Source Offline Security Scanner for Developers
A rule-based, local-first security tool designed to automate manual penetration testing workflows.
1Automating Manual Security Checks
Penthera is a new open-source, rule-based security scanner designed for local use. Originally developed as a private text file of manual checks, the tool now automates infrastructure protection. It serves as a free alternative for developers who want to perform consistent security audits without relying on opaque, external AI-driven security services.
2Local-First Security Philosophy
The tool emphasizes a local-first architecture, ensuring that codebases remain private and offline. By avoiding external token costs and cloud-based LLM dependencies, Penthera provides a transparent whitebox system. This approach allows developers to maintain full control over their security data while running continuous internal red and blue team penetration tests.
3Integration and Deployment Options
Penthera is accessible through CLI, NPM, and MCP, making it adaptable for various development workflows. It is designed to be integrated directly into pre-commit hooks or CI pipelines for automated scanning. The creator is currently developing a watch function to enable live security monitoring during the active coding and development process.
4Performance and Benchmark Results
Despite being a non-AI solution, Penthera ranks competitively on public benchmarks for detecting NPM malware, PyPI malware, and JS injection vulnerabilities. While it may not outperform state-of-the-art security models from large corporations, its rule-based engine provides a reliable baseline for identifying common attack vectors like SQLi, SSTI, SSRF, and XSS.
5Optional AI-Enhanced Scanning
Users can opt-in to use local Ollama models for more advanced detection capabilities beyond the static ruleset. Crucially, the LLM does not make final decisions on findings; it only assists in identifying potential issues. This hybrid approach allows developers to leverage AI insights while keeping the core decision-making process transparent.
6Community-Driven Security Development
As an open-source project, Penthera encourages community contributions to expand its library of security rules. The creator invites developers to submit pull requests and provide feedback to improve the tool's UX and detection logic. This collaborative model aims to foster a safer internet through shared, transparent, and hackable security infrastructure.
7Addressing Modern Coding Risks
The rise of AI-generated code and automated coding tools has created new security blind spots. Penthera addresses these risks by providing a consistent, rule-based layer of protection that operates independently of the code generation process. It ensures that developers can verify the safety of their applications regardless of how they were built.
8Future Outlook and Accessibility
Penthera is available for immediate use without signups or costs, reflecting a commitment to accessible cybersecurity. Future updates will focus on improving the user experience and refining the live scanning capabilities. By prioritizing local-offline functionality, the project seeks to establish a sustainable standard for continuous security testing in modern software development.