Link once
Installs the portable skill into Claude Code, Codex, or OpenCode and links this machine to your account in the browser. Nothing else to configure.
Runs inside Claude Code, Codex, and OpenCode
Run the pentest where you build.
Myrqen installs a structured security engineer into the coding agent you already use. It maps your app, proves real findings against your local runtime, and hands you a fix your agent can apply. No separate LLM API key.
Depth
$ myrqen autoauto picks a depth from the size and shape of the project.
- Local by defaultNo copy of your repository leaves the machine
- Evidence per findingWith a verification state you can audit
- Cloud sync optionalChosen per scan, never assumed
A finding, and what backs it
This is the output, not a picture of it.
A recorded assessment of the deliberately vulnerable fixture committed in this repository. Nine findings were settled against a running application under three identities. Five were not, and they say so.
myrqen auto
static pass: 2 files, 36 rules
runtime validation: identities user_a, user_b, admin
| Id | Class | Proven at | How | State |
|---|---|---|---|---|
| broken object level authorization | GET /api/orders/102 | identity differential | verified | |
| broken function level authorization | GET /api/admin/users | identity differential | verified | |
| unsafe query composition | GET /api/products/search | runtime probe | verified | |
| server side request forgery | POST /api/import | runtime probe | verified | |
| business logic price manipulation | POST /api/checkout | runtime probe | verified | |
| debug endpoint exposure | GET /debug/config | runtime probe | verified | |
| insecure cookie configuration | POST /api/login | runtime probe | verified | |
| weak session identifier | — | static only | unsettled | |
| hardcoded secret | — | static only | unsettled |
14 findings · 9 verified · 0 refuted · 5 unsettled · 10.9s
4 destructive actions refused · 0 secrets in output
Choose a finding to read the evidence that settled it.
A recorded run against the synthetic fixture committed in this repository. Not a live scan, and not anyone else’s application.
How it works
One command, inside the agent you already pay for.
There is no model key to buy and no runner to provision. The assessment is driven by the agent already sitting in your terminal, which is why it can read your project instead of guessing at it.
Run one command
/myrqen auto where slash commands exist, and myrqen auto everywhere else. Auto picks a depth from the size and shape of the project.
Prove it, then fix it
Every finding carries evidence, a severity, and an independent verification state. Copy the fix prompt, apply it in your agent, and run the assessment again.
- 01
Discover
Routes, identities, secrets, and dependencies, read from your source.
- 02
Probe
Candidates exercised against your running application, never against production.
- 03
Settle
Each candidate verified, refuted, or left explicitly unsettled.
- 04
Fix
A remediation prompt and a test, handed to the agent you are already in.
- 05
Retest
Run it again. The report says what closed and what came back.
What it actually does
Confident about the findings. Honest about the rest.
Every card carries the limit that comes with the capability. A security tool that only advertises its strengths is asking you to discover its gaps in production.
Reads the project first
It maps routes, entry points, identities, and the shape of your data before it probes anything, so a finding is attached to real code rather than to a pattern that happened to match.
Proves it against your runtime
Findings are re-tested against your running application under two identities and an admin, so an authorization bug is demonstrated rather than inferred.
Says when it cannot tell
Every finding carries an independent verification state: verified, strong evidence, or needs review. Nothing is dressed up as certainty to make a report look better.
Refuses the destructive move
Deleting records, flooding a login, enumerating hosts you did not authorize: refused by default, and the refusal is written into the report rather than silently skipped.
Hands your agent the fix
Each finding carries a remediation prompt and the test that should pass afterwards. Apply it in the agent you are already in, then run the assessment again.
Keeps the report yours
The report is written to your machine in HTML, JSON, Markdown, and SARIF. Sending one to the dashboard is a separate, per-scan decision.
Where it runs
It goes where your agent already is.
The skill is portable by design: one bundle, installed into whichever agent you use, with a CLI that behaves identically where slash commands do not exist. Nothing here is a plugin for a platform we hope you adopt.
- Claude Code
/myrqen auto· slash command- Codex CLI
myrqen auto· CLI- OpenCode
myrqen auto· CLI- Any other agent
myrqen auto· portable skill directory
Local first
Your repository is not the payload.
Scanning runs on your machine against your own project. Secrets, .env values, and raw traffic stay local. Cloud sync is a per-scan choice, and what syncs is the report you generated — never a copy of your source tree.
External APIs your project calls are only tested after you authorize that exact origin. Authorizing api.example.com never authorizes example.com or any sibling host.
- Where the model comes from
- Your agent. There is no Myrqen model key, and no prompt of yours reaches a model we operate.
- What can be uploaded
- A report, if you say so. Per scan, never by default, and never the source tree.
- Synced report bodies
- Encrypted at rest. Support cannot read one without a time-boxed grant written to an audit trail.
- Destructive testing
- Refused. The recorded fixture run refused four such actions and allowed none.
- Data residency
- EU first.
Free
The scanner is not the paid part.
Local scans, local reports, and every export format are free and unlimited. The free plan also includes 5 synced cloud reports per day and 15 per week, kept for 21 days, with live progress and controlled sharing. A vulnerability found on your machine is never withheld behind a paywall.
Find it before someone else does.
One command in the agent you already have open. The findings are yours on every plan, including the free one.
- No card required
- No separate model key
- Nothing uploaded unless you ask