All plugins

penthera

Offline, rule-based security checks run through the terminal: a repo scan, dependency capabilities, a passive scan of a URL you own, and an audit of your AI agent config (skills, MCP servers, hooks, permissions). A skill only: no tools, hooks, middleware or MCP server. It runs the pinned penthera npm package with npx, which downloads that package on first use (Node.js 22 or later). Rules decide every finding; a model never does. No telemetry, no stored credentials, no background process, no self-updater. Disclosure — the skill runs the third-party `penthera` npm CLI pinned at 2.4.0 through `npx -y`, which downloads it from the npm registry on first use and runs it on the host outside Hermes' sandbox; it reads repo files and local agent configs (`~/.claude`, `~/.cursor`, `.mcp.json`), makes passive requests to URLs the user names, and, when the user approves, edits code on a local branch or installs a `.git/hooks/pre-commit` hook.

danoszzToolsv2.4.0Updated 24 minutes ago

About

Offline, rule-based security checks run through the terminal: a repo scan, dependency capabilities, a passive scan of a URL you own, and an audit of your AI agent config (skills, MCP servers, hooks, permissions). A skill only: no tools, hooks, middleware or MCP server. It runs the pinned penthera npm package with npx, which downloads that package on first use (Node.js 22 or later). Rules decide every finding; a model never does. No telemetry, no stored credentials, no background process, no self-updater. Disclosure — the skill runs the third-party `penthera` npm CLI pinned at 2.4.0 through `npx -y`, which downloads it from the npm registry on first use and runs it on the host outside Hermes' sandbox; it reads repo files and local agent configs (`~/.claude`, `~/.cursor`, `.mcp.json`), makes passive requests to URLs the user names, and, when the user approves, edits code on a local branch or installs a `.git/hooks/pre-commit` hook.

Penthera plugin

Penthera is an offline, rule-based cyber security agent for your own apps and AI
coding tools. Every finding comes from a rule you can read, and you can check
each one yourself. MIT licensed.

This folder is the plugin for Claude Code and Cowork. It holds the
Penthera skill (skills/penthera), which tells Claude how to scan your own
app, live URL, dependencies and agent setup with the Penthera CLI
(npx -y penthera@2.4.0), explain the findings and fix them with your approval.

The plugin starts no MCP server. To use Penthera's read-only MCP tools as well,
add the server yourself:

claude mcp add penthera -- npx -y penthera@2.4.0 mcp

The tools scan inside your project, never apply fixes and run no shell. Other
agents: see the MCP docs.

Install

In Claude Code:

/plugin marketplace add danoszz/penthera
/plugin install penthera@penthera

Penthera needs Node.js 22 or later. The first run downloads the penthera package
from npm; after that it runs offline.

What it may do without asking

The skill pre-approves only reading files. Claude asks you before it runs any
command, Penthera's own included, and before it edits a file.

Data

Penthera reads your project on your machine and uploads nothing. A scan of a live
URL contacts only that URL, and only one you are allowed to test.

More

  • Website and public benchmark results: https://penthera.org
  • Source and docs: https://github.com/danoszz/penthera
  • Security policy: https://github.com/danoszz/penthera/blob/main/SECURITY.md

README from the reviewed commit e3c6211; it updates when the author re-pins.

Developer Mode

Explore built-in Hermes toolsets and actions.

HermesAgent

Developer?

Create a Hermes extension for Desktop or agent workflows.

Developer Section