0sec

Source and live targets

0sec investigates repositories, packages, web applications, AI endpoints, and MCP servers within an explicit scope.

Compiled programs without source

0verse is a separate evidence producer. 0sec accepts only its versioned, verified receipts.

Reproduce before trusting

Models can propose and explore. Findings become real only when retained evidence and verification support them.

Use the model host you need

Run the native loop or use a narrow MCP boundary with an optional compatible host.

Explore the docs

How it works

• Architecture — the 5-stage pipeline, runtime adapters, and MCP integration
• Agent Loop — how the autonomous loop thinks, calls tools, reflects, and stops
• Improvement Plane — how future worker artifacts are evaluated without mutating a live engagement
• Finding Triage — the multi-layer pipeline between research and verify agents
• Blind Verification — why findings are re-exploited before they count
• Adversarial Evals — how 0sec extends beyond classic pentesting into attack-driven evaluation of AI systems

For enterprise buyers

• Enterprise readiness — SSO, BYOK, deployment options, data residency, audit, SLA, and compliance posture. The single source of truth for enterprise capability claims.

Research and benchmark analysis

• Research overview — the index of design notes and experiments
• FP Reduction Moat — the full false-positive reduction stack
• Finding Triage ML — the shipped triage layers and why they exist
• XBOW Analysis — what moved the score and what still blocks the remaining challenges
• Benchmark — current results, caveats, and historical context