Unclecheng-li/DeepSec

DeepSec — AI Security Offense & Defense Platform. Shield audits AI-generated code for hallucinated packages, missing safeguards & AI pattern errors in real time. Spear automates authorized penetration testing with 40+ skill packs, from recon to PoC.

What it solves

DeepSec provides a unified platform for AI-driven security, combining automated code auditing (Shield) and authorized penetration testing (Spear). It specifically targets vulnerabilities in AI-generated code and helps developers and security professionals find security gaps—such as hardcoded keys, SQL injection, and semantic flaws—before attackers do.

How it works

DeepSec operates through three primary components:

  • Shield (Code Audit): Uses a three-layer detection architecture. Layer 1 uses regex and entropy analysis for fast checks (secrets, hallucinated packages); Layer 2 uses Tree-sitter WASM AST analysis for common vulnerabilities (XSS, SSRF); and Layer 3 leverages LLMs (like DeepSeek, Claude, or OpenAI) for deep semantic analysis of logic flaws.
  • Spear (Penetration Testing): An automated engine that follows a full lifecycle (Recon $\rightarrow$ Explore $\rightarrow$ Fact $\rightarrow$ Reflect $\rightarrow$ Report $\rightarrow$ PoC). It utilizes over 40 built-in tool packages (e.g., nmap, sqlmap, nuclei) and operates under a strict "Signed Scope" whitelist to ensure tests are only performed on authorized targets.
  • TUI & IDE Integration: A Rust-based terminal workbench (TUI) for managing sessions and scans, and plugins for VSCode and JetBrains that provide real-time diagnostics and "Quick Fix" suggestions directly in the editor.

Who it’s for

  • Developers who use AI to generate code and need to ensure the output is secure.
  • Security Auditors and Red Teams who require an automated framework for authorized penetration testing.
  • DevSecOps Engineers looking to integrate AI-powered security scanning into their workflow via CLI or MCP server.

Highlights

  • Multi-layered Scanning: Combines fast pattern matching with deep LLM-based semantic reasoning.
  • Authorized Testing: Strict whitelist management via scope.json to prevent unauthorized attacks.
  • Cross-Platform Interface: Available as a CLI, a high-performance Rust TUI, and IDE plugins.
  • Extensive LLM Support: Compatible with 13+ providers including DeepSeek, OpenAI, and Anthropic.
  • MCP Server Integration: Can be connected to MCP-compatible clients like Claude Desktop or Cursor.

Related

  • Project
    OWASP/DockSec

    An AI-powered Docker security scanner that integrates local scanners like Trivy and Hadolint to provide plain-English vulnerability explanations and actionable fixes.

  • Project
    vercel-labs/deepsec

    An agent-powered vulnerability scanner for large-scale repositories that uses AI to find and verify deep-seated security issues.

  • Project
    0x4m4/hexstrike-ai

    An AI-powered cybersecurity automation platform that integrates 150+ security tools into an MCP framework for autonomous penetration testing.

  • Project
    yashab-cyber/HackGpt

    An AI-powered penetration testing platform for enterprise security teams that automates vulnerability assessments and compliance mapping using a multi-provider AI engine.

  • Project
    cdxiaodong/cain-agent

    An AI penetration testing engineer for authorized security assessments that automates vulnerability discovery and cloud misconfiguration analysis with strict scope enforcement.