Security.Run
SECURITY TOOLS. READY FOR AGENTS.

Give your agent
tools that can act.

Scan code. Inspect files. Check a target.
Run the right security tool in an isolated environment and get back evidence your agent can use.

Get started Read the docs

Your commands. Your files. Original tool output.

security.runSIMULATED EXAMPLE
REQUESTbandit
{
  "tool": "bandit",
  "invocation": {
    "args": ["-r", "src", "-f", "json"]
  }
}
Request acceptedqueued
Isolated environment readyready
Tool executingrunning
Output capturedverified
Environment destroyedcomplete
RESULTWaiting for the simulated run…
Illustrative output. No tool is executed here.
66 prepared tools, including
YARASemgrepNmapGrypeGhidraZeekExplore all tools ↗

FROM QUESTION TO CHECK

Put your agent’s next step
within reach.

Use a familiar tool and its native arguments.
Keep the reasoning in your agent.

01 / CODE & DEPENDENCIES

Check the change
before it ships.

Apply a source rule, find a leaked secret, or inspect a dependency inventory. Give the agent a report with filenames and findings to work from.

SemgrepBanditGitleaksGrype
Run a source check →
Example · source scanPython → JSON
$ bandit -r src -f json -o report.json

{
  "filename": "src/handler.py",
  "test_id": "B307",
  "issue_text": "Use of eval detected."
}
Pass the finding to the agent. Keep the original report.
02 / FILES & EVIDENCE

Give an unfamiliar file
a closer look.

Match a YARA rule, extract strings, inspect metadata, or analyze an event log. Send the file once, then reuse it across focused checks.

YARAFLOSSExifToolChainsaw
Scan your first file →
Example · file inspectionFile + rule → matches
$ yara -s rules.yar sample.bin

example sample.bin
0x6:$marker: security.run

input_sha256  →  verified
native_output →  retained
Follow the evidence without losing the underlying bytes.
03 / APPLICATIONS & NETWORKS

Ask a target
what’s actually there.

Check an open port, inspect HTTP behavior, or run a TLS assessment. Start with an isolated example target, then use the routes allowed by your deployment.

NmaphttpxNucleitestssl.sh
Run a target check →
Example · isolated targetHost → port inventory
$ nmap -sT -Pn -p 8000,8001 -oX report.xml 127.0.0.1

PORT       STATE
8000/tcp   open
8001/tcp   closed

report.xml → ready to download
Explicit target scope. Inspectable results.

ONE WORKFLOW, MANY TOOLS

Make a call.
Keep the useful parts.

01

Choose the tool

Find the capability you need. Inspect commands, inputs and readiness before you run it.

02

Send the work

Supply files, native arguments and a deadline through HTTP or MCP. Each run gets a fresh environment.

03

Use the result

Read progress, retrieve the exit code and download outputs. The execution environment is cleaned up.

Try the end-to-end example →

YOUR ENVIRONMENT

Sensitive work belongs
in your cloud.

Deploy execution in your AWS account, with your network access and artifact storage. The same tool-call contract follows the workload.

Explore Enterprise →
BUILT AROUND THE RUN

Native tool usageNormal arguments, files, configuration and stdin.

Visible executionProgress, exit codes, original output and artifacts.

Fresh environmentsOn-demand runs, explicit teardown, no warm pools.

Give the next question
a tool to work with.

Start with a small check. Build from the result.

Get started ↗Read the docs →