Pick modules, set the agent’s permissions, optionally turn on exploit verification, run. Output is a markdown report — location, severity, cause, and fix direction for every finding it could ground in your code.

Free install. The first run opens a quick Cosine sign-up — the same login that runs Cosine’s coding agent — and new accounts start with 2M free tokens.

Before the scan runs.

Verify the findings.

Don’t just report a vulnerability — prove it. Turn on Exploit Verification and the agent attempts a safe reproduction of each finding after the initial report, so what lands in front of you is confirmed, not theoretical.

• Docker — reproduction runs inside an ephemeral, isolated container spun up from your repo. Nothing touches your host; the container is torn down when it finishes.
• Live FS — reproduction runs against your actual checkout, for findings that only manifest in a real environment. Your code stays read-only — the Go harness still blocks writes.
• Disabled (default) — report only, no reproduction attempts.

See the output.

Won’t do.

• Won’t modify your code. Read-only is enforced by the Go harness below the model — every tool call is intercepted before execution; mutating ones (file writes, command execution) are deterministically blocked, regardless of what the model wants.
• No fuzzing, no DAST, no live exploitation. Active testing lives in Pen Test mode.
• Won’t include findings it can’t ground in your code. No vibes-based vulnerabilities.

Quick answers.

Same CLI, second tab. The swarm goes offensive against systems you authorise — not just reading the code, attempting the exploits. Gated because the security implications are real; access is via booking, scope and authorisation written down before anything runs.

Before the pen test runs.

See the output.

Won’t do.

• Won’t run without signed authorisation. Booking is the legal step — targets, time-box, and what’s allowed are written down before anything runs.
• Won’t expand scope. Authorised targets only, even if interesting ones show up next door.
• Won’t keep going past the booked time-box. Effort ramps stop where the booking says they stop.
• Doesn’t escalate. If a finding needs deeper access than booked, it stops and notes it in the engagement summary.

Quick answers.