SHIELD://CODE_AUDIT SPEAR://AUTHORIZED_PENTEST L1://HEURISTIC L2://AST_SAST L3://SEMANTIC HALLUCINATION_DETECTION 5_REGISTRIES 40+_SKILLS VSCODE+JETBRAINS TUI_WORKBENCH 100%_OPEN_SOURCE
SYSTEM ONLINE
OPEN SOURCE // MIT LICENSE

Catch what AI missed
in your code

AI Security Platform — Shield code audit + Spear authorized penetration testing

>_ Catch what AI missed. Penetrate what others can't.

Install DeepSec View on GitHub
0
Detection Layers
0
Security Skills
0
Platforms
0
Open Source
deepsec@localhost: ~/project LIVE
$ pip install deepsec
[OK] deepsec 2.4.1 installed
$ deepsec shield scan . --fail-on high
[SHIELD] L1 heuristic scan ......... 12 findings (0.04s)
[SHIELD] L2 AST/SAST analysis ...... 4 findings (1.8s)
[SHIELD] L3 semantic audit ......... 2 findings (4.2s)
[CRITICAL] hardcoded secret src/config.ts:12
[HIGH] SQL injection api/query.py:87
[OK] Scan complete — exit code 1 (--fail-on high)
$ deepsec spear run --target example.com --authorized
[SPEAR] Phase 1/4 Recon ............ done
[SPEAR] Phase 2/4 Fingerprint ...... done
[SPEAR] Phase 3/4 Exploit .......... 5 vulns confirmed
[SPEAR] Phase 4/4 Report ........... spear-report.md
[OK] Penetration test complete — 5 confirmed vulnerabilities
// LIVE_DEMO

TUI workbench in action

Watch the DeepSec TUI terminal workbench — Shield scan, Spear penetration, live animations, all inside your terminal.

deepsec-tui.mp4 REC ●
// CORE_MODULES

Dual-engine security arsenal

Shield defends your codebase. Spear breaks it (with permission). Together they close the loop on AI-era application security.

01

Shield 3-Layer Code Audit

L1 heuristic pattern matching, L2 Tree-sitter AST/SAST analysis, and L3 LLM-powered semantic audit — escalating depth, millisecond to seconds.

L1 <50msL2 ASTL3 LLM
02

Spear Authorized Pentest Engine

Recon, fingerprinting, exploitation and reporting — an autonomous penetration pipeline gated behind explicit signed authorization.

ReconExploitReport
03

AI Hallucination Detection

Verifies every AI-suggested package against npm, PyPI, Cargo, Go and Maven registries before slopsquatting malware reaches your supply chain.

npmPyPICargoGoMaven
04

Multi-Platform IDE Integration

Real-time diagnostics, hover explanations and one-click quick fixes in VSCode and JetBrains IDEs via a bundled Rust LSP server.

VSCodeJetBrainsLSP
05

TUI Terminal Workbench

A full keyboard-driven terminal UI for triaging findings, launching Spear phases and reviewing diffs — without leaving your shell.

TriageDiffsHotkeys
06

Enterprise Dashboard & Compliance

Deployable team dashboard with developer risk trends, audit logs and exportable compliance evidence for SOC 2 / ISO 27001.

SOC 2ISO 27001Audit
// QUICK_START

Zero to secured in four steps

Install, configure, scan, fix. DeepSec fits into your existing workflow in under two minutes.

01

Install

One pip package. No daemon, no agent.

pip install deepsec
02

Configure

Pick your LLM provider and severity policy.

deepsec init --provider openai
03

Scan

Audit the whole repo; fail CI on high severity.

deepsec shield scan . --fail-on high
04

Fix

Apply safe mechanical fixes and verify with Spear.

deepsec shield fix --auto
deepsec — full workflow DEMO
# 1. Install DeepSec
$ pip install deepsec
[OK] Successfully installed deepsec-2.4.1
 
# 2. Initialize config + LLM provider
$ deepsec init --provider openai
[OK] .deepsec/config.toml created — provider: openai, policy: fail-on=high
 
# 3. Run Shield audit (L1 → L2 → L3)
$ deepsec shield scan . --fail-on high
[SHIELD] L1 heuristics → 12 findings (0.04s)
[SHIELD] L2 AST/SAST → 4 findings (1.8s)
[SHIELD] L3 semantic → 2 findings (4.2s)
[HIGH] hallucinated package "react-virtualized-auto-sizer"
 
# 4. Auto-fix, then verify exploitability with Spear
$ deepsec shield fix --auto
[OK] 9 fixes applied, 3 need review (open TUI: deepsec tui)
$ deepsec spear run --target example.com --authorized
[SPEAR] Recon → Fingerprint → Exploit → Report
[OK] 0 exploitable paths remain — attack surface clean
// ARCHITECTURE

Shield defends. Spear penetrates.

A closed-loop workflow: Shield audits code in depth, Spear validates real-world exploitability — every finding flows into one report.

SHIELD // Defense in Depth

L1
Heuristic Sweep Secrets, hallucinated packages, unsafe configs, 31 AI error patterns
< 50ms
L2
AST / SAST Analysis Tree-sitter WASM: injection, XSS, SSRF, traversal, deserialization
< 2s
L3
Semantic Audit LLM-assisted: missing auth, rate limits, validation gaps
< 5s
findings.db · SARIF · IDE diagnostics

SPEAR // Authorized Offense

01
Recon Subdomain enum, port scan, tech fingerprinting, OSINT
auto
02
Fingerprint Service & framework mapping, attack-surface graph
auto
03
Exploit 40+ skill modules: web, API, auth, cloud — proof-of-concept validation
gated
04
Report Evidence chain, CVSS scoring, remediation playbook
auto
signed authorization required before launch
// ECOSYSTEM

One platform, every surface

DeepSec meets you where you work — editors, terminals, CI pipelines — and plugs into the LLM providers you already use.

0
Detection Layers
0
Platforms
0
Pentest Skills
0
Package Registries
0
Open Source

Supported LLM Providers

OpenAI Anthropic Claude DeepSeek Qwen Moonshot Kimi Zhipu GLM Azure OpenAI Ollama (Local)

Runs On

VSCode JetBrains CLI / TUI Docker GitHub Actions
// INIT_SEQUENCE

Ready to catch what AI missed?

One command. Full-stack AI security. Catch what AI missed. Penetrate what others can't.

$ pip install deepsec
Star on GitHub Read the Docs
// OPEN_SOURCE

Live from GitHub

Real-time repository signals from Unclecheng-li/DeepSec.

—
Stars
—
Forks
—
Watchers
—
Open Issues
// COMMUNITY

Join the DeepSec network

Scan a QR code to enter the community chat or the developer group — report issues, swap payloads, shape the roadmap.

DeepSec Community Chat QR Code

Community Chat

Connect with DeepSec users, get support and share findings in real time.

SCAN TO JOIN // 社区交流群
DeepSec Developer Group QR Code

Developer Group

Discuss internals, contribute code and build Shield rules & Spear skills together.

SCAN TO JOIN // 开发者群聊
Report Issues Contribute Code
Copied to clipboard