The open-source AI security harness
Investigate vulnerabilities, review findings, and work on fixes in your browser.
Use your own model provider. Connect coding agents through CLI or MCP.
Get started · Demo · Docs · Research · Releases · 0cloud
Backed by Y Combinator · The Swiss Applied AI & Cybersecurity Research Lab
Get started
Install on Apple Silicon macOS or x64/ARM64 Linux, then run 0:
curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash
export PATH="$HOME/.0/bin:$PATH"
0
0 opens the local browser console without an account. 0 web remains a
compatibility alias. The interactive terminal UI is retired; headless CLI commands
and MCP remain available.
Configure a model provider to run AI workflows. See installation and troubleshooting.
Findings
Review source evidence and organize findings in a queue or on the board.
Security workflows
Chat with 0 in the web UI, investigate findings, and use built-in templates for assessment, verification, fixes, and research. Runs retain results; Learning keeps local activity and source-grounded notes.
For automation and coding agents, the CLI exposes the same workflow runner:
0 workflow list --templates
0 workflow run --template security-research \
--target /absolute/path/to/repo --workspace /absolute/path/to/repo
0 runs list
0 chat --prompt "your request"
Workflow guide · Learning · GitHub Actions
Hosts and plugins
Choose a host for your work. Connect service integrations and manage extensions. Use ⌘K / Ctrl+K to jump between tools.
Skills and memory
Reuse security instructions and retain lessons linked to the source.
0cloud
The hosted version of 0, for managed security workflows on your team's repositories. Access is currently through the 0cloud waitlist. Local use does not require a cloud account.
Connect another agent
Use CLI commands or expose workflows through MCP:
0 mcp-server --workflows --workspace /absolute/path/to/repo
Local MCP requires an explicitly selected host-local execution profile. Browser chat's Connect an external agent provides a setup prompt. CLI and MCP workflow clients can share a running local engine's sessions and runs.
Plugins and MCP setup · Local and remote engines · Plugin development
For AI agents: product index · command reference.
Development
Install dependencies with pnpm install, run npm run dev, and open the printed
browser address. The dashboard updates with hot reload.
See CONTRIBUTING.md.
For local binary analysis, run npm run setup:0verse once. It discovers a local
Ghidra and Java installation, installs the Python analysis/MCP dependencies
without removing existing engines, and verifies the decompiler. In this source
checkout, web and terminal chats automatically connect the local 0verse MCP
server. Nine tools cover scanning, triage, preflight, bug classes, findings,
PoVs, reports, memory recall, and capability discovery. The capability catalog
also lists research CLI commands with their MCP-supported or CLI-only status.
Each chat has its own scan state. 0 binary ./target --mode scan --format ndjson uses the same runtime.
This does not install every platform executor or fuzzing environment. Inspect
0verse's capability report before requesting confirmation; unavailable analysis
is not a clean scan. An explicit ZERO_MCP configuration takes precedence, and
ZERO_0VERSE_MCP=0 disables automatic connection.
Status and safety
Research preview. Assess only authorized systems and review findings and fixes.
Use --mode standard with headless chat for explicit scope checks. The optional
scope plugin enforces target boundaries.
Report vulnerabilities through SECURITY.md. Licensed under MIT OR Apache-2.0.