Security Monitor
You fixed it in the repo. Is production still vulnerable?
Security Monitor matches your dependencies against vulnerability advisories on your own machine, then checks what actually runs on your Linux servers, so a fix that never got deployed does not look finished. There is no account and no cloud dashboard, and missing or stale data is always shown as could not verify, never as safe.
Status: pre-release. v1.0 is code complete and signed installers are being prepared. Until then, build from source as described in Getting started.
What it does
Section titled “What it does”- Finds vulnerable dependencies locally from lockfiles, offline OSV data, GHSA, CISA KEV and EPSS, with OSV-Scanner, Trivy and Semgrep adapters.
- Compares the repository with production. A read-only Linux agent or agentless SSH reports installed packages, running kernels and processes that still use deleted libraries; linked projects show “fixed in repo, still running in production”.
- Warns before vulnerable code is pushed with a Git hook that checks only changed lockfiles, offline.
- Works with coding agents through a local MCP server and skills for Claude Code, Codex and OpenCode.
- Prepares fixes you approve in an isolated Git worktree with network-disabled sandbox tests.
Where to go next
Section titled “Where to go next”- New here: Getting started
- Trust and data handling: Privacy and Threat model
- Servers: Linux agent and Deploy ID
- Command line and automation: CLI and Coding-agent integrations
A missing finding is not proof that software or an environment is secure. Verify results against the original advisory and your own environment before making security decisions.