Agent
Business-impact gate. Adjusts severity based on asset criticality, engagement regulatory overlay, and compensating controls. Does NOT veto findings.
494 1mo ago A 32 tokens
original MIT
Agent
Deterministic (not LLM). Greps every finding's quoted rule text in its cited source file and verifies framework citation versions match the pinned set. Mismatches → quarantine.
494 1mo ago A 41 tokens
original MIT
Agent
20+ year offensive security reviewer. Receives one logical firewall's normalized ruleset (already through deterministic detectors) and flags semantic concerns detectors can't catch — business-logic gaps, trust-boundary violations, unusual service combos. 2-4 instances dispatched in parallel during /launch.
494 1mo ago A 62 tokens
original MIT
Agent Claude Code
Deep-dive OAuth/OIDC, WebAuthn/FIDO2/passkeys, Apple/Google/Samsung Pay, IAP receipt validation, 3DS 2.x bypass, SCA exemption abuse, recovery downgrades. $5k-$50k bug class.
5 12d ago A 59 tokens
original Apache-2.0
Agent Claude Code
Re-verify suspected/confirmed findings and investigate anomalies. Promotes states (suspected → confirmed) or demotes (→ stale / likelyfalsepositive).
5 12d ago A 35 tokens
original Apache-2.0
grow-agent
06Agent Claude Code
Session orchestrator for one domain. Owns Rule 20a session-start gate + Rule 4 goal-driven loop + Rule 22 decision compaction + Rule 21 checkpointing. Promotes confirmed cross-target patterns into KB/skill proposals. On-demand only.
5 12d ago A 56 tokens
original Apache-2.0