OpenCyber is a free, open source agent that runs in your terminal. Give it a web app, an API, a server or a codebase. It maps the target, tests one hypothesis after another, and writes up every finding with the evidence.
curl -fsSL https://opencyber.tech/install | bash Linux x64. On Windows: irm https://opencyber.tech/install.ps1 | iex source on GitHub
Audit https://staging.acme.example. The web app and its API are in scope. I own this target.
Example session, shortened.
How it works
Tell it the target and what is in bounds, in plain English. Only test systems you own or have written permission to test.
The agent maps the target, writes down what could break, and tests each hypothesis.
Add a prompt at any point. Give it a login, send it deeper into one endpoint, or ask for a class of bug. It carries on from where it was.
You get every confirmed finding with severity, evidence, steps to reproduce and a fix, plus the hypotheses it tested and ruled out.
The report
Each finding comes with the request that proved it. The hypotheses that led nowhere are listed too, so you can see what the agent tested.
Two ways to use it
Need something more specific? Tell us what it is.
Free
Contact us
FAQ
OpenCyber uses your opencode setup. That covers the free models opencode offers at the time, the models included in OpenCode Go if you subscribe, and every provider opencode can connect to.
OpenCyber is free. With a free model the whole audit costs nothing. With a paid model you pay that provider for what you use.
Yes. A stronger model finds more. OpenCyber gives any model the same method, which is to scope the target, write hypotheses, test them and report, so you get more out of whichever one you use.
OpenCyber runs on your machine. There is no account and nothing to sign up for. What the agent reads during an audit goes to the model provider you chose, so pick one whose data terms you accept.
A scanner runs a fixed list of checks. OpenCyber looks at how your target behaves, works out what could go wrong in it, and tests that. You can also redirect it mid-run with a prompt.
No. It does the first pass in less time and leaves a written record of what it tested. If you need findings checked by a person and a signed report, ask for a managed audit.
Yes, on systems you own or have written permission to test. Testing anything else is illegal in most countries. The authorized use policy has the details.
Install it, open a terminal and name a target you are allowed to test.
curl -fsSL https://opencyber.tech/install | bash Read the authorized use policy before you start.