nox/reachability ✓ Verified Multi-language reachability analysis. Annotates VULN findings as unreachable, reachable or undetermined across Go, PyPI, npm, Cargo, Maven, RubyGems and NuGet. Bundled in the nox release archive.
Open-source · Apache-2.0 · Offline-first
The security scanner that understands your AI app.
For teams shipping LLM features — `chat.completions.create`, RAG ingest, agents with tool calls, MCP servers — Nox catches what every other scanner misses, plus secrets, deps, IaC, and containers in one deterministic pass.
- Full MCP threat coverage — tool poisoning, rug-pull, auth / SSRF, and shadow servers, mapped to the OWASP MCP Top 10. The MCP scanner that never sees your code:
nox scan . --offline, no API, no token, no telemetry. - Prompt injection at the call site (OWASP LLM01)
- Embedding leakage when secrets / PII reach vector stores (LLM06)
- Agent over-privilege when `file_read` + `http_request` share an agent context (LLM07)
- Cross-file AI taint — `request.json` → service hop → `chat.completions.create` across functions and files
- Slopsquatting & CVE variants — hallucinated-package imports and first-party code reproducing known-CVE root causes, deterministic and offline
- Taint analysis across 21 languages — source to sink, deterministic, no tree-sitter and no CGo
- It tells you what it could not check — an OSV outage or a dead plugin is reported, not silently passed
- Cosign-signed plugin marketplace — every official plugin verified via Sigstore keyless OIDC
- Sigstore
- GitHub Actions
- MCP
- SARIF
- CycloneDX
- SPDX
- OWASP MCP Top 10
- OWASP LLM Top 10
- OWASP Agentic
Cosign-signed plugin marketplace
Plugins you can trust by default.
Every plugin in the official registry ships with a Sigstore keyless signature tied to its release.yml workflow. Nox refuses install on unsigned drops unless you explicitly relax the policy. Trust chain: `cosign(checksums.txt) ⇒ tarball SHA-256 ⇒ registry digest`.
nox/taint-analysis ✓ Verified Cross-file and interprocedural taint flow, including AI source-to-sink paths, on top of the taint engine in core.
nox/container ✓ Verified Dockerfile linting, image vulnerability scanning and container SBOM (22 rules).
nox/dast ✓ Verified DAST web/API probes for HTTP misconfiguration — headers, CORS, TLS, cookies, rate limiting, open redirect — plus opt-in AI-DAST: prompt injection, system-prompt leak, tool smuggling, cost amplification.
nox/k8s-runtime ✓ Verified Inspects running Kubernetes workloads for security misconfigurations and drift.
nox/red-team ✓ Verified Attack-path analysis and exploit validation. Declares per-tool safety: analyze is passive, validate is active and requires confirmation.
nox/ai-eval ✓ Verified Adversarial prompt corpus runner. Fires a bundled jailbreak / prompt-leak / role-confusion corpus at a configured chat endpoint and reports which attacks succeeded.
nox/llm-triage ✓ Verified Optional LLM second opinion. Sends each finding plus a code snippet to a configured chat endpoint and attaches a true/false-positive verdict as an enrichment. Never gates the scan — the deterministic core is unaffected.
nox/api-abuse ✓ Verified API authorization testing for BOLA, BFLA, rate-limit and abuse patterns in server code (5 rules).
nox/attack-surface ✓ Verified Static endpoint extraction and exposure mapping across Go (net/http, Gin, Echo, Chi), Python (Flask, Django, FastAPI) and JavaScript/TypeScript (Express, Koa, Fastify).
nox/depconfusion ✓ Verified Dependency confusion detection across npm, PyPI, RubyGems and Maven (3 rules).
nox/grc ✓ Verified Governance, Risk & Compliance assessment across 10 frameworks with gap analysis and evidence collection.
nox/threat-model ✓ Verified STRIDE-based threat pattern detection in source code, with opt-in AI threat modeling via ai_model: true (5 rules + LLM).
nox/threat-explain ✓ Verified LLM-enhanced finding explanations and impact analysis with audience targeting (8 rules + LLM).
nox/risk-score ✓ Verified EPSS / KEV vulnerability prioritization and severity scoring with environmental risk amplification (5 rules).
nox/threat-enrich ✓ Verified CVE enrichment, CWE mapping and MITRE ATT&CK correlation (13 rules).
nox/triage-agent ✓ Verified LLM-powered finding prioritization and false-positive reduction (4 rules + 7 providers: openai, anthropic, gemini, ollama, cohere, bedrock, copilot).
nox/remediate ✓ Verified Deterministic remediation planning and application for code findings. Its apply_code and verify_code tools are declared non-read-only and are blocked under the default passive policy until explicitly opted in.
Detection coverage
What Nox detects
1,528 catalog rules plus a dataflow engine, across six analyzer suites covering the full attack surface of modern applications.
913 Secrets
API keys, tokens, and credentials across major cloud, SaaS, and CI providers. Vendor rules require the keyword near the match plus credential-grade entropy and shape, so they stay quiet on ordinary code.
88 AI & MCP Security
Prompt injection at the call site, embedding leakage, agent over-privilege, and agent-config execution surface — plus MCP threat coverage (tool poisoning, rug-pull, auth/SSRF, shadow servers) mapped to the OWASP MCP Top 10, OWASP LLM Top 10, and Agentic ASI01–ASI10.
500 Infrastructure
Terraform, Kubernetes, Docker, GitHub Actions, Helm, Ansible, Kustomize, Serverless, plus cross-resource graph analysis.
21 Taint & dataflow
SQL injection, command injection, XSS, path traversal, unsafe deserialization, SSRF and open redirect tracked from source to sink across 21 languages — plus AGENTFLOW rules for untrusted input reaching a prompt and LLM output reaching a dangerous sink.
SCA Dependencies
OSV.dev lookups with real CVSS v3 base scores across 7 ecosystems and 13 lockfile formats, per-package advisory matching, reachability filtering, and license compliance.
12 Data Protection
PII detection for email, SSN, credit card, phone numbers, and healthcare identifiers.
90-second tour
See what Nox catches.
A short walkthrough of the marketplace, the comparison pages, and the trust model. No audio — keep your headphones on whatever you were already listening to.
In action
Fast, focused output
Nox completes a full scan in seconds and writes machine-readable artifacts. No configuration required for a first run.
$ nox scan .
nox — scanning .
[discover] 847 files, 12 lockfiles, 3 AI components
[analyze] secrets, iac, deps, taint, ai, data
[results] 12 findings (3 suppressed), 47 dependencies, 3 AI components
[degraded] vulnerability lookup failed for 1 package
impact: dependency vulnerabilities are under-reported
[done] wrote findings.json, results.sarif, sbom.cdx.json
$ nox plugin install nox/reachability
Trust: community (signer: cosign-keyless:.../release.yml@.*)
Installed nox/[email protected] (community)Deterministic by design
Same inputs produce same outputs across local development and CI. No hidden state, no external service dependencies, no flaky results.
AI security is not an afterthought
First-class OWASP LLM Top 10 and OWASP Agentic coverage alongside traditional AppSec. Prompt injection, tool safety, and model provenance are built into the core engine.
Agent-native via MCP
Built-in MCP server with 22 read-only tools and 8 resources. AI agents can query scan results safely without write access or code execution, under workspace allowlisting and a 1 MB output cap.
Standard artifacts
Six output formats, zero vendor lock-in
Every scan produces standard artifacts that integrate with existing security tooling and compliance workflows.
findings.json JSON Canonical findings schema for automation
results.sarif SARIF GitHub Code Scanning compatible (SARIF 2.1.0)
sbom.cdx.json CycloneDX Primary SBOM format with vulnerability data
sbom.spdx.json SPDX Secondary SBOM format for license compliance
report.html HTML Standalone dark-theme dashboard with filtering
ai.inventory.json AI Inventory AI component inventory with provenance
Adoption workflow
From first scan to full enforcement in three steps.
Install and scan
brew install felixgeelhaar/tap/nox
nox scan .Declare plugins (.nox.yaml)
# .nox.yaml — package.json for security
plugins:
required:
- nox/reachability
- nox/taint-analysis
- nox/grc
# Anyone cloning your repo gets the right
# verified plugins on first scan.Enforce in CI
- uses: nox-hq/nox@v1
with:
path: '.'
format: sarif
annotate: 'true'
severity-threshold: high
fail-on-degraded: 'true'
- uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarifOpen source under Apache 2.0
Nox is free to use, modify, and distribute. Contributions welcome.