New & open source · Find → Prove → Fix

Redefining Security with AI.

Proof, not pattern matching. Dual-engine AI security assessment: static AST threat modeling of agent source code (white-box) plus dynamic behavioral probing of live chat APIs (black-box). Runs entirely on your machine.

pip install nethricai

Active Verification Engine

Security Scan & Proof Pipeline

01. INGEST & AST PARSE

Agent Code & Target Ingestion

Python AST maps agent structure, LLM call sites, and tool registrations.

02. WHITE-BOX STRIDE SCAN

Sink & Pattern Discovery

Traces taint paths to dangerous execution sinks (exec, subprocess) and exposed keys.

9 STRIDE Findings Flagged

03. DYNAMIC EXPLOIT PROBE

Behavioral Probing Engine

Fires prompt injection, jailbreak, and system prompt extraction attacks at chat APIs.

4/4 Probes Proven Bypassed

04. THREAT GRAPH & DASHBOARD

Unified STRIDE Provenance

Maps Actor → Trust Boundary → Asset → Threat chains into interactive reports.

Risk Score 100/100 · Dashboard Ready

EvidenceGraded findings

100%Open source

0Cloud dependency

3.11+Python required

1 cmdTo install

5Fix classes

Integrates with the modern devsecops stack

GitHub Actions

Python

PostgreSQL

Python AST

STRIDE

The problem

A scanner reports 247 issues. Nobody can tell you which twelve are actually exploitable.

Pattern matching finds candidates, not vulnerabilities. The triage cost lands on you — and the moment a tool starts writing patches from unverified findings, it will eventually patch the wrong thing and burn your trust permanently.

How it works

One pipeline: Scan → Prove → Report.

Dual-engine AI security assessment: static AST threat modeling of agent source code (white-box) plus dynamic behavioral probing of live chat APIs (black-box). Evaluated against STRIDE and aggregated into actionable reports.

White-Box

Python AST statically walks agent code, inspecting tool decorators, tracking taint flows to dangerous sinks, and mapping to STRIDE.

Zero-token local AST

Black-Box

Dynamic adversarial prober attacks chat API endpoints with prompt injections, jailbreaks, and credential leak probes.

Behavioral verification

Report

Aggregates findings into a unified Actor → Trust Boundary provenance graph and serves an interactive local dashboard.

Actionable remediation

nethricai scan -t examples/target.whitebox.yaml -m whitebox_static -o results/

Explore White-Box & Black-Box Modes ↓

Dual-Engine Assessment

Two assessment modes. One unified threat model.

AI agents cannot be secured from the outside alone. NethricAI unites deep static AST threat modeling of agent source code (white-box) with dynamic behavioral probing of live model endpoints (black-box) — producing actionable STRIDE threat matrices and verifiable proof chains.

White-Box · Static AST Engine

White-Box Threat Modeling

Statically parses Python AI agent codebases using standard Python ast. Traces user input flows, inspects tool decorators, flags dangerous execution sinks, and maps structural vulnerabilities directly to STRIDE — with zero network calls, zero API token costs, and 100% local execution.

Agent AST Ingestion & Tool Inspection

Extracts LLM call sites (llm.invoke), registered tools (@tool), loop constructs, and system prompt strings without executing untrusted code.

Taint Propagation & Dangerous Sink Tracing

Tracks user parameters flowing into dangerous primitives like exec(), eval(), or subprocess.run() inside tools.

Automated STRIDE Threat Categorization

Maps code-level vulnerabilities directly into the six STRIDE threat classes with line numbers and remediation advisories.

Spoofing (S) Hardcoded secrets, API keys (sk-...) in source.

Tampering (T) Permissive prompts ("you can do anything") & raw input to LLM.

Repudiation (R) Missing structured audit logging around LLM invocations.

Info Disclosure (I) Private variables and passwords interpolated into prompts.

Denial of Service (D) Unbounded loops (while True) driving recursive LLM queries.

Elevation of Priv (E) Dangerous tool calls (exec, subprocess) invokable by AI.

nethricai scan -t examples/target.whitebox.yaml -m whitebox_static -o results/

Black-Box · Dynamic API Engine

Black-Box Security Probing

Dynamically probes live HTTP chat endpoints across multiple attack vectors. Uses provider-agnostic request templating and JSON pointer extraction to stress-test refusal guardrails against real-world prompt injection and jailbreak payloads.

Provider-Agnostic Request Templating

Works with OpenAI, Anthropic, Ollama, vLLM, or custom APIs via {{PROMPT}} template injection and dynamic response_path resolution.

Multi-Vector Adversarial Payloads

Executes categorized probes targeting direct injection, persona jailbreaks (DAN), system prompt leakage, and data exfiltration.

Heuristic Refusal & Leak Verification

Evaluates response strings to confirm whether the model genuinely refused the attack or succumbed to instruction hijacking.

Prompt Injection Direct instruction overrides ("ignore all previous instructions").

Jailbreak Personas Role-play and hypothetical framing bypassing alignment filters.

System Prompt Leak Elicitation of confidential developer instructions and tool signatures.

Data Exfiltration Extraction of credentials, API tokens, and private session state.

nethricai scan -t examples/target.mock.yaml -m prompt_injection -o results/

See in action

A full scan, from one command.

216 of 247 candidates did not survive verification. That is the point — the reported number is the number the tool can defend.

nethricai scan -t target.yaml -o results/

Vulnerability Tracer

Click any node in the data-flow path to inspect how NethricAI traces parameters to dangerous query sinks.

nethric-report.json

{
  "$schema": "https://schemastore.org/sarif-2.1.0-rtm.5.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": { "driver": { "name": "NethricAI", "version": "1.0.0" } },
      "results": [
        {
          "ruleId": "NTH-0417",
          "level": "error",
          "message": { "text": "SQL Injection via order-by parameter." },
          "provenExploitable": true,
          "proofArtifact": {
            "type": "Time-based SQLi PoC",
            "triggerUrl": "/v1/orders?sort=id;SELECT pg_sleep(8)--",
            "baselineMs": 42,
            "exploitMs": 8041
          }
        }
      ]
    }
  ]
}

Why proof

Every finding traces back to why.

One unbroken chain per finding — threat model, detection, proof, patch, sandbox result — printed in the CLI and emitted as JSON. NTH-0417, end to end:

Step 01

Threat model · Tampering, Public REST API

STRIDE scoring prioritizes components containing public API routes. The controller at src/api/routes/** is flagged for deep data-flow trace analysis due to high-risk tampering exposure.

Public REST API Boundary → STRIDE Score 8.5 (High) → Deep Context Trace

Step 02

Detection · 6 raw matches

Semgrep matches six potential SQL string concatenations in the target component. Four are immediately discarded as unreachable in the next phase, saving valuable developer triage time.

orders.ts:118 — ORDER BY " + c Proven Candidate
orders.ts:130 — "WHERE merchant_id = " + m Dropped (Safe Bound Variable)
orders.ts:135 — "WHERE active = " + a Dropped (Unreachable Input)

Step 03

Exploitability proof · Reachable Vulnerability

Traced untrusted parameter req.query.sort at orders.ts:118 through helper function at query.ts:44 directly into database execution db.query() at orders.ts:142.

GET /v1/orders?sort=id%3BSELECT%20pg_sleep(8)--

Observed Response Delay: 42ms → 8,041ms. Time-based query injection reproduced successfully inside sandbox.

Step 04

Safe Patch · Allow-listed Column Map

PostgreSQL driver does not support parameter bindings inside ORDER BY clauses. NethricAI generates an allow-list enumeration check to secure the field shape before DB insertion.

- export const orderBy = (c) => " ORDER BY " + c;
+ const SORTABLE = new Set(["created_at", "amount", "status", "id"]);
+ export const orderBy = (c) => {
+   if (!SORTABLE.has(c)) throw new BadRequest("bad sort: " + c);
+   return " ORDER BY " + c;
+ };

Step 05

Sandbox validation · 3 of 4 Gates Green

Tests pass 842/842, the exploit is successfully blocked, and regression checks are clean. However, two behavior changes were detected in undocumented parameters and escalated for human review.

Unit Tests 842/842 Exploit Blocked (400) 0 Regression Drift 2 Behavior Changes (Escalated)

Architecture

Six stages, one threat model.

IngestPython AST & target YAML parser ingests agent codebases and endpoint configs locally.

White-BoxStatically traces taint propagation to dangerous execution sinks (exec, subprocess).

Black-BoxAdversarial prober executes prompt-injection, jailbreak, and secret-leak attacks.

ProveValidates reachability to dangerous sinks and verifies model refusal bypasses.

GraphSynthesizes Actor → Trust Boundary → Asset → Threat provenance chains.

ReportEmits structured JSON reports and serves an interactive zero-dependency dashboard.

Compare

Pattern scanners report what matched. NethricAI reports what is reachable.

	NethricAI	Pattern SAST	Dependency SCA
What it reports	Proven exploitable paths	Rule matches	Known-vulnerable versions
Core question	Can this be reached and exploited?	Does this pattern appear?	Is this version affected?
Proof artifact	PoC or reasoning chain	—	—
Drops unverified findings	Yes — 216 of 247	—	—
Sandbox-validated fixes	Yes, gated on tests + exploit re-check	—	Version bump only
Runs locally	Yes, no telemetry	Varies	Varies

Categories, not specific vendors — capabilities differ between products and change over time. Benchmark against your own toolchain before drawing conclusions.

Language support

One engine, expanding coverage.

Supported now

TypeScript · JavaScript · Python

Next up

Go · Java

On the roadmap

Ruby · PHP · C#

Fix classes in v1

Dependency bumps · Hardcoded secrets · Simple injection

Deferred to v2

Cloud config audit · DAST · Attack graphs · Runtime analysis

Prove what is exploitable in your own repository.

Runs entirely on your machine. No account, no telemetry.