Mythos Agent

English · 简体中文

[mythos-agent — Cerby the guard puppy]

[mythos-agent — 10-second security check demo]

mythos-agent

AI code-review assistant for application security.

Open-source. Reads your code, flags likely security issues, explains its reasoning, suggests fixes.

[CI] [npm] [License] [Discord] [Node] [Wired scanners] [Experimental scanners] [Rules]

mythos-agent.com

Quick Start • How It Works • Commands • Hunt Mode • Variant Analysis • Integrations • Contributing • Vision • Roadmap

mythos-agent reviews your code the way a reviewer on a security-focused team would. It walks through likely issue patterns, checks for variants of known CVEs, ranks findings by confidence, and suggests fixes you can accept or reject. See VISION.md for the full framing.

For new contributors: the active 6-month working plan is in the pinned issue [Roadmap] mythos-agent H1 2026 Goals. Look for 🙋 markers to spot items where help is wanted. New here? See CONTRIBUTING.md for good-first-issue guidance.

For security teams and EU CRA-compliant downstream manufacturers: see SECURITY.md for our vulnerability disclosure SLAs, docs/security/cra-stance.md for our EU CRA role declaration, docs/security/threat-model.md for our public threat model, and RELEASES.md for our versioning, LTS, and EOL policy. OpenSSF Best Practices Badge (Passing) submission targeted June 2026; releases are signed via Sigstore and ship with CycloneDX SBOMs for downstream Manufacturer compliance.

npx mythos-agent hunt

🔐 mythos-agent hunt — AI Code-Review Assistant
✔ Phase 1: Reconnaissance — 12 entry points, express, typescript, postgresql✔ Phase 2: Hypothesis — 8 security hypotheses generated✔ Phase 3: Analysis — 15 findings (semgrep, gitleaks, trivy, built-in), 22 false positives dismissed✔ Phase 4: Reproduction — 2 finding chains, 3 reproductions
🧪 Security Hypotheses
  [HIGH] HYPO-001 — Race condition: concurrent payment requests could double-charge    src/payments.ts:45 (race-condition)  [HIGH] HYPO-002 — Auth bypass: JWT token not validated after password change    src/auth.ts:78 (auth-bypass)
📊 Confidence Summary
  3 confirmed | 8 likely | 4 possible | 22 dismissed
⛓️ FINDING CHAINS
 CRITICAL  SQL Injection → Auth Bypass → Data Exfiltration  ├── src/api/search.ts:45      — unsanitized input in SQL query  ├── src/middleware/auth.ts:88  — JWT verification skippable  └── src/api/export.ts:23      — bulk export has no ACL
🧪 Reproductions
  SPX-0001 — SQL injection in search endpoint    See repro steps in docs/reproductions/SPX-0001.md
  Trust Score: 2.3/10 — critical issues found

Quick Start

# Installnpm install -g mythos-agent
# Quick scan (no API key needed)mythos-agent scan
# Full autonomous hunt (needs API key)mythos-agent initmythos-agent hunt
# Find variants of known CVEsmythos-agent variants CVE-2021-44228
# Ask security questionsmythos-agent ask "are there any auth bypasses?"
# Check available toolsmythos-agent tools

How It Works

mythos-agent combines three things no other open-source tool does together:

1. Hypothesis-Driven Scanning

Instead of matching known patterns, the AI reasons about what COULD go wrong, generating hypotheses like "this transaction doesn't lock the row, potential race condition" or "this auth check uses string comparison, potential timing attack."

2. Variant Analysis (Big Sleep technique)

Given a known CVE, mythos-agent finds structurally similar but syntactically different code in your codebase. Same root cause, different location. This is how Google's Big Sleep found 20 real zero-days.

3. Multi-Stage Verification

Every finding goes through a confidence pipeline:

• Pattern scan → candidate
• AI hypothesis → theoretical risk confirmed
• Smart fuzzer → dynamically tested
• PoC generator → concrete exploit proves it's real

Only findings that survive multiple stages are reported as "confirmed."

Commands

Hunt Mode

mythos-agent hunt runs the full multi-agent pipeline:

┌──────────────┐     ┌──────────────┐     ┌──────────────┐     ┌──────────────┐│    Recon     │ →   │  Hypothesis  │ →   │   Analyze    │ →   │   Exploit    ││    Agent     │     │    Agent     │     │    Agent     │     │    Agent     │├──────────────┤     ├──────────────┤     ├──────────────┤     ├──────────────┤│ Map entry    │     │ Reason about │     │ All scanners │     │ Chain vulns  ││ points, auth │     │ what could   │     │ + external   │     │ + generate   ││ boundaries,  │     │ go wrong per │     │ tools + AI   │     │ PoC exploits ││ data stores  │     │ function     │     │ verification │     │              │└──────────────┘     └──────────────┘     └──────────────┘     └──────────────┘

Variant Analysis

Find code in your project that has the same root cause as known CVEs:

# Search for Log4Shell-like patternsmythos-agent variants CVE-2021-44228
# Auto-detect and scan for variantsmythos-agent variants --auto

The variant analyzer extracts the root cause pattern from the CVE (not the surface syntax) and searches your codebase for structurally similar code.

Scanners (15 wired + 28 experimental, 329+ rules)

The Default scanners run on every mythos-agent scan. Experimental scanners are implemented + unit-tested classes that ship in the tarball but are not yet reachable from any CLI, HTTP, MCP, or agent entry point. They are tracked by KNOWN_EXPERIMENTAL in the wiring-invariant test.

Beyond the scanners above, mythos-agent ships complementary analyses (not counted in the scanner totals): call-graph + taint engine, DAST smart fuzzer, AI hypothesis agent, variant analysis, and git-history mining.

External tool integrations: Semgrep (30+ languages), Gitleaks (100+ patterns), Trivy (SCA + containers), Checkov (1000+ IaC policies), Nuclei (9000+ DAST templates)

Integrations

AI Providers

Pattern scanning, secrets, deps, and IaC work without any API key.

See docs/multi-model.md for the full tier-system policy + the staged rollout (this README is the summary; that doc is the canonical reference).

Comparison

This feature table is a capability comparison, not an accuracy claim. For reproducible, third-party-runnable accuracy numbers vs Semgrep CE / Snyk Code / CodeQL on OWASP Benchmark, CyberSecEval 3, Vul4J, and our CVE replay harness, see docs/benchmarks/external-scores.md.

Contributing

See CONTRIBUTING.md for details.

git clone https://github.com/mythos-agent/mythos-agent.gitcd mythos-agent && npm install && npm run build && npm test

Architecture

src/  agents/         Multi-agent orchestrator + Recon/Hypothesis/Analyzer/Exploit agents  analysis/       Code parser, call graph, taint engine, variant analyzer, service mapper  agent/          AI integration, prompts, tools, fix validator  cli/            44 CLI commands  dast/           Smart fuzzer, PoC generator, payload library  policy/         Policy engine + compliance mapping  report/         Terminal, JSON, HTML, SARIF, dashboard  rules/          Built-in + custom YAML + community registry  scanner/        Pattern, secrets, deps, IaC, diff scanners  store/          Results persistence + incremental cache  tools/          External tool wrappers (Semgrep, Trivy, etc.)vscode-extension/ VS Code extensionaction/           GitHub Actionsbot/              PR Review Bot

License

MIT