Back to packageRELEASE DETAILS

0.24.1

npm

0sec-cli

Your self-improving, open-source cybersecurity team.

All keywords (17)

Published14 Oct 2026

Direct dependencies9

Transitive dependenciesNot calculated

README

Current package documentation

0security

Open-source security workflows in your browser or coding agent.
_{Backed by Y Combinator · The Swiss Applied AI & Cybersecurity Research Lab}
0.security · Documentation · FoxGuard

Latest release

Zero manifesto movement

Get started

Install on Apple Silicon macOS or x64/ARM64 Linux:

curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash
export PATH="$HOME/.0/bin:$PATH"
0 web

Command Center (browser): 0 web · Terminal: 0

Configure a model provider before running AI workflows.

Workflows

Browser, CLI, and MCP share one workflow runner with retained results.

Findings are prioritized by business impact: affected customers and data, fraud, critical services, and disruption. Each priority includes a rationale; missing context stays Not assessed. CVSS remains available as technical severity.

Work	Built-in templates
Assess	Repositories, dependencies, APIs, web configuration, scoped penetration tests, package behavior, smart contracts, native code
Verify	Findings with replay evidence
Fix	Candidates with regression tests
Research	Security research, deep source investigation

Start from 12 templates, customize steps, and run manually or with browser triggers and schedules. Template: starting point · Workflow: reusable steps · Run: one execution.

Learning retains local run activity, source-grounded notes and evaluated improvement history. Saved workflows keep immutable revisions and support restore. Use 0 learning status or open Learning in the browser. Learning documentation.

0 workflow list --templates
0 workflow run --template security-research \
  --target /absolute/path/to/repo --workspace /absolute/path/to/repo \
  --format json > run.json
0 runs list

Workflow guide: inputs, limits, and results.

See Zero at work

A source review of the included demo API, with code locations and suggested fixes.

Demo API source review in Zero

Start a workflow from a template and edit its steps.

Workflow editor in Zero

Use 0 from another agent

Use the CLI commands above, or MCP to discover templates, create workflows, and manage runs:

0 mcp-server --workflows --workspace /absolute/path/to/repo

Local MCP requires an explicitly selected host-local execution profile. For a registered remote engine, use 0 mcp-server --workflows --backend production. 0's model provider is separate from the connecting agent's session.

Browser chat's Connect an external agent copies a setup prompt. CLI and MCP workflow clients automatically attach to a running local web engine for the same workspace and control database. To attach explicitly to the sessions and runs already open in an engine:

0 mcp-server --workflows --engine-url http://127.0.0.1:3000 \
  --engine-token-env ENGINE_TOKEN --session SESSION_ID
0 sessions list --engine-url http://127.0.0.1:3000 --engine-token-env ENGINE_TOKEN

Set ENGINE_TOKEN to the engine's configured bearer credential. Attached clients share the browser's session and run lifecycle; disconnecting leaves the engine running. Omit --session to create a session under the engine's admission grants.

See MCP setup and individual tools or local and remote engines.

Plugins

Connect GitHub, Elastic, Semgrep, Snyk, Linear, Jira, Cloudflare, Slack, and Teams through plugins and MCP.

More guides: installation · GitHub Actions · plugin development · troubleshooting.

Development

Install dependencies, run npm run dev, and open the printed browser address. See CONTRIBUTING.md.

Status and safety

Research preview. Assess authorized systems and review findings and fixes. Run 0 or 0 web to open the browser console without an account. The interactive terminal UI is retired; headless CLI, automation, MCP and binary commands remain available. Use 0 chat --prompt "your request" for one-shot automation; set --mode standard for explicit scope checks. The optional scope plugin enforces target boundaries.

Report vulnerabilities through SECURITY.md. Licensed under MIT OR Apache-2.0.

Public disclosures and upstream fixes. Thanks to OpenTUI, Bun, React, Models.dev, LiteLLM, and our contributors.

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 9

Native requirements

9 direct targetsNot calculated transitive count

Package / target	Requirement	Relationship
drizzle-orm Environment { "local_name": "drizzle-orm", "alias": false, "peer_metadata": null }	`^0.45.2`	runtime
node-sqlite3-wasm Environment { "local_name": "node-sqlite3-wasm", "alias": false, "peer_metadata": null }	`^0.8.55`	runtime
pdfkit Environment { "local_name": "pdfkit", "alias": false, "peer_metadata": null }	`^0.15.2`	runtime
playwright Environment { "local_name": "playwright", "alias": false, "peer_metadata": null }	`1.60.0`	runtime
tree-sitter Environment { "local_name": "tree-sitter", "alias": false, "peer_metadata": null }	`file:vendor/tree-sitter-0.21.1-node24.tgz`	runtime
tree-sitter-c Environment { "local_name": "tree-sitter-c", "alias": false, "peer_metadata": null }	`0.21.4`	runtime
@opentui/core Environment { "local_name": "@opentui/core", "alias": false, "peer_metadata": null }	`0.5.4`	runtime
@opentui/react Environment { "local_name": "@opentui/react", "alias": false, "peer_metadata": null }	`0.5.4`	runtime
react Environment { "local_name": "react", "alias": false, "peer_metadata": null }	`^19.2.4`	runtime

Distribution files

1 collected

Distribution 1

Source distribution

Source file

Checksums from source

{
  "integrity": "sha512-EsH9U8LdKUBMro0kNOm5Sb414bg6EniFVlQwebzf7i9nUtWDyGIzrdG7Z30T2339SCYB/Zrh6KI+kZgnrME/1w==",
  "shasum": "7baa65596e273ebb9c8bee72aee3c27960268434",
  "tarball": "https://registry.npmjs.org/0sec-cli/-/0sec-cli-0.24.1.tgz",
  "fileCount": 445,
  "unpackedSize": 29488739,
  "signatures": [
    {
      "keyid": "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U",
      "sig": "MEUCIF+eXT8m7G7TrmYAUiBun84Zw9QuX482x56JHiZjE91hAiEA5+ABky+WBUi3o8ZTAI7L4U2tKben+cAXLP0sb6BymjY="
    }
  ]
}