# 0sec

> Open-source AI cybersecurity team (research preview). It scans, reviews, and audits code and targets for vulnerabilities, reproduces what it finds before reporting, and stays inside a scope you define.

Install: `curl -fsSL https://raw.githubusercontent.com/0sec-labs/0sec/main/install.sh | bash`
Command: `0sec` (alias `0`). Container: `ghcr.io/0sec-labs/0sec`.

## Start here

- [Getting started](https://docs.0.security/getting-started/): install and run your first scan
- [Commands](https://docs.0.security/commands/): the full command and flag reference
- [Configuration](https://docs.0.security/configuration/): scope, budgets, and output formats
- [API keys](https://docs.0.security/api-keys/): bring your own model provider
- [Using 0sec from a coding agent](https://0.security/harness/agents): run the CLI directly, or add the MCP server
- [Source](https://github.com/0sec-labs/0sec): the open-source engine and CLI, MIT OR Apache-2.0

## What it does

- `scan`, `eval`, `agent-assure`: Pentest a web app, AI/LLM endpoint, or MCP server
- `review`, `file-review`, `deep-review`, `audit`: Review source, packages, C/C++, or a kernel tree
- `recon`, `js-recon`, `npm-discovery`, `intel`: Recon an attack surface
- `hunt`, `kernel`, `cve`: Hunt a bug class or kernel variants
- `findings`, `history`, `resume`, `replay`, `verify`, `timeline`, `disclose`: Work with the evidence a run produced
- `fix`: Generate and re-test a source fix
- `identity`, `adgraph`, `entragraph`: Assess identity and AD posture, read-only and offline
- `0verse`: Analyze a compiled binary, no source
- `mcp-server`, `console`, `tui`, `dashboard`: Integrate it

## Notes for agents

- Confirm you have authorization and a defined scope before scan, recon, audit, or hunt. Out-of-scope targets are refused by design.
- 0sec re-exploits a finding with a second agent that never saw the first run. Treat unreproduced signals as leads, not results.
- Get human approval before fix writes or changes anything. Prefer proposing the diff first.
- 0sec is a research preview. Its output is evidence to verify, not a certification, and it makes no claim of completeness.

## About 0sec

- [About](https://0.security/about): the lab, and the problem we're building against
- [Research and disclosures](https://0.security/research): verified findings and write-ups