Myrqen

Security testing that runs inside the coding agent you already use.

Static analysis finds the candidates. Your coding agent proves or disproves them against the application running on your machine.

No repository upload. No separate model API key. No invented certainty.

Most security scanners have to choose between reading your code and exercising your application.

Myrqen deliberately does both — but gives each job to the part of the system that can actually measure it.

The result is a scanner that distinguishes between "this looks vulnerable" and "we observed this behaving vulnerably."

Install the Agent Skill once:

npx myrqen link

Then, from any project:

myrqen auto

Want the entire scan to remain local?

myrqen auto --sync no

--sync no prevents report synchronization with the hosted dashboard. Without it, Myrqen asks whether the report should be synced and remembers that choice for that scan only.

A Myrqen scan has two halves.

The static pass belongs to Myrqen itself.

It parses TypeScript and JavaScript and follows attacker-controlled data through a function, including patterns that show up in real applications:

• destructured request reads;
• aliases and type assertions;
• values accumulated into arrays and later joined;
• data flowing into security-sensitive sinks.

When tainted input reaches a sink without an intervening protection, Myrqen records a candidate.

That pass runs whether or not an agent is involved, which means its behavior can be benchmarked and regression-tested independently.

Static analysis cannot observe a real HTTP response, browser state, authorization boundary, or runtime side effect.

So a candidate is not automatically promoted to a vulnerability.

The agent exercises the application running on your machine and records what actually happened:

Source code
    │
    ▼
┌──────────────────────┐
│  Myrqen static pass  │
└──────────┬───────────┘
           │
           ▼
      needs_review
           │
           ▼
┌──────────────────────┐
│  Coding agent tests  │
│  the local app       │
└───────┬────────┬─────┘
        │        │
   observed   not reproduced
        │        │
        ▼        ▼
     verify     refute
        │        │
        └───┬────┘
            ▼
          Report

myrqen finding verify attaches the evidence the agent observed and raises the finding to verified.

myrqen finding refute records that the agent could not reproduce the candidate. It stays in the record instead of silently disappearing, so the result can still be reviewed or disputed.

A candidate nobody exercises remains needs_review.

That state is intentional. The report should say what the scanner established — and what it did not.

Myrqen reports what it was able to establish and explicitly states what it could not reach.

A scanner finding nothing is not a clean bill of health.

Anything outside your own machine requires explicit, exact authorization.

A grant for:

https://api.example.com

does not authorize:

http://api.example.com
https://example.com
https://api.example.com:8443

Scheme, origin, and port boundaries matter.

Myrqen's policy refuses actions such as mass deletion, request flooding, credential spraying, persistence, exfiltration, and authorization-scope expansion.

A refusal is recorded rather than silently ignored.

Source code, READMEs, comments, fixtures, issue text, and other repository content are data.

If repository content attempts to instruct the scanner to ignore its policies, that attempt is recorded as an observation instead of followed.

Credentials are described by location and type, not by value.

Secret values are redacted before being stored anywhere, including locally.

Detection claims are only as useful as the corpus behind them.

Myrqen publishes both the corpus and the scorer.

Run the full fixture benchmark:

pnpm benchmark

Or score the vulnerability corpus directly:

pnpm benchmark:corpus

The corpus covers application shapes built with Express, Fastify, Koa, Hono, node:http, Next.js route handlers, Next.js server actions, tRPC, GraphQL resolvers, and FastAPI.

Every vulnerable case has a corresponding safe near-miss: code with the same suspicious surface that performs the same job correctly, differing only in the security decision that matters.

That distinction is important.

A scanner that flags both the vulnerable and correct form of a pattern does not merely have false positives — it trains developers to stop trusting its output.

• File, function, and variable names do not reveal the vulnerability being tested.
• Every case is scanned independently in a temporary directory.
• The engine sees a path it has not seen before.
• Matching is strict: class, route, and line must all be correct.
• A finding in the correct file but at the wrong location is still a miss.
• Cases written in languages the engine does not parse are reported separately and are never counted as recall failures.

Both benchmark commands report recall, precision, per-class results, and the safe-case false-positive rate.

They also exit non-zero when results fall below the release gates or regress against the committed baseline.

The latest passing baselines live in:

benchmark/corpus-baseline.json
benchmark/baseline.json

Run the benchmarks rather than trusting a performance number copied into a README.

Development requires Node.js 22 or newer and pnpm.

pnpm install
pnpm build
node apps/cli/dist/myrqen.mjs --help

Run the built CLI against another project:

cd /path/to/your/project

node /path/to/myrqen/apps/cli/dist/myrqen.mjs auto --sync no

The portable source of truth lives in:

packages/skill/myrqen

It contains the SKILL.md plus reference documents describing Myrqen's methodology, safety boundaries, finding contract, and CLI.

npx myrqen link

installs the skill for Claude Code, Codex, and OpenCode, and writes it to ~/.agents/skills for other agents that follow the same convention.

It is plain Markdown.

You can — and should — read the instructions your agent will follow before allowing it to run them.

The hosted Myrqen dashboard is a separate application and is not included in this repository.

This source repository is generated from the working monorepo by a publication script with release gates that refuse to publish when:

• an included package depends on an unpublished package;
• a file outside test or fixture paths contains a credential-shaped literal;
• an included file imports from a path that has been excluded.

The goal is for the published source to remain inspectable without accidentally exposing private application code or credentials.

fixtures/vuln-shop is deliberately vulnerable.

It exists exclusively as a test target, binds to localhost, and must never be deployed.

Its committed credential is a canary used to test Myrqen's redaction behavior. The benchmark verifies that the credential never appears in generated report output.

If you find a security issue in this repository, open an issue containing:

• what you found;
• the smallest useful reproduction;
• the minimum source excerpt needed to make the problem clear.

Please do not include a working exploit against infrastructure you do not own or have explicit authorization to test.

If the issue concerns Myrqen's hosted service rather than the published source, say so in the issue without publishing the sensitive details. The hosted application is not part of this repository, and a public issue is not the appropriate place for those details.

Myrqen's production dependencies include:

• typescript — Apache-2.0
• ajv — MIT
• ajv-formats — MIT
• commander — MIT

Their transitive dependencies are licensed under MIT, Apache-2.0, or BSD-3-Clause terms.

Those licenses travel with their respective packages and are unaffected by Myrqen's repository license.

Myrqen is distributed under the Myrqen Source-Available Licence 1.0.

You may read, study, and run the software against systems you are authorized to test, including for internal and commercial work.

You may not redistribute it, publish a fork, or offer it as a service.

It is not OSI approved and is not an open-source licence.

Read the complete terms in LICENSE.