Offense

Offense provides security tools that AI coding agents can discover, call, and verify.

Offense provides security tools your AI coding agent can discover, call, and verify. It gives coding agents the ability to audit dependencies, inspect source and workflows, and test proposed fixes. The platform returns structured security evidence through CLI, MCP, and HTTP. Your agent reads this evidence, investigates your code, makes authorized changes, and runs tests. It works with coding agents like Pi, OMP, Hermes, Codex, Claude Code, and Crush. It offers a local dependency engine, self-hosted platform, and hosted service modes.

Offense at a glance

Best for: Software engineer
Runs on: macOS, Linux, CLI, API, self-hosted, open source
Pricing: Open-source software, optional paid hosting.
Released: October 2026
Category: AI coding tool
Website: github.com/offense-research/offense

Key features

Find vulnerable dependencies
Produce structured findings and remediation prompts
Check source and GitHub Actions workflows
Discover tools before running them
Submit bounded jobs via CLI, MCP, or HTTP API
Retrieve results and preserve partial outcomes

Use it for

Audit dependencies and verify reviewed upgrades
Review a PR with source evidence
Check staged or tracked contents
Trace request input, parameterize and test SQL-injection
Exercise a disposable local API with bounded requests

Alternatives to Offense

AI Crimes — Practice catching real-world AI coding mistakes on anonymized snippets.
Harden — Runs locally on your machine to check coding-agent tool calls.
AgentGuard — Get a security and quality assessment of AI skills in seconds without an account.
Mantis — Automates vulnerability discovery and patching using AI agents.
Stop That Shit — Enforces task boundaries to stop unnecessary AI agent actions.
Agent Skills — Encodes senior-engineer workflows and quality gates into 24 skills.
Security Audit Skill — Automated multi-stage security auditing with independent verification.
Uber ADR — It secures enterprise AI agents through threat detection and benchmarking.
Arcjet — Enforces security policies directly at the action boundary inside your application code.
ARTEX — Runs autonomous multi-agent penetration testing with a dual-graph architecture.
PentAGI — It autonomously manages penetration testing workflows within a secure Docker sandbox.
CodeAnt AI — It uses agentic testing to prove exploitability with actionable reproduction steps.

All Offense alternatives