Jikida

[Jikida guardian]

Jikida.io

The hosted AI pentester for people who ship — not just security engineers.
Pentest your live app, scan your repo, protect it with a WAF, and watch its uptime. One account. No Docker, no LLM key, free tier.

[site] [mcp] [sdks] [npm scan] [packagist] [license]

Why it beats Nuclei / Strix / Shannon ↓ · Install · MCP · SDKs · Compare

Install it, scan it, or plug it into your AI editor:

npx @jikida/init      # add the SDK + protection to your app in 30 secondsnpx @jikida/scan      # pentest any site or repo from your terminalnpx -y @jikida/mcp    # security tools inside Claude Code, Cursor, Windsurf

Pentest & scan for developers, AI IDEs & vibe coders

Pentest and scan websites, web apps, code and GitHub for vulnerabilities and exposed keys. Secure vibe-coded apps, monitor uptime, SSL and domains, and rate-limit APIs. One platform.

Website & app pentest · Code & repo scan · Deep pentest · MCP for AI IDEs · Agentic & vibe-coded security · SDKs

Jikida.io is a developer-first security platform. The core is pentest and scanning: it pentests your live website and app, scans your code and connected GitHub/GitLab/Bitbucket repos for exposed secrets and vulnerable dependencies, runs a deeper authenticated pentest, and plugs into your AI IDE (Claude Code, Cursor, Windsurf) over MCP so it guides agentic and vibe-coded work to write secure code and catches mistakes before they ship. Uptime, SSL & domain monitoring, a managed WAF, and a compliance generator come bundled as complementary extras — installed in one line for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno.

Your security layer. Shipped in 30 seconds. One line — npx @jikida/init — and every SDK fails open, so if Jikida.io is ever down your app keeps serving.

Why Jikida beats the other security tools

The strongest open-source security tools are deep but narrow — pentest-only, self-hosted, bring-your-own-LLM-key. Jikida does the deep work and hosts it, runs with no key of your own, and adds a WAF, uptime and repo scan the pentest-only tools skip. ✅ full · ⚠️ partial · ❌ none.

The one axis the AI pentesters still go deeper on is raw exploitation — exactly what our source-to-exploit deep pentest is closing. Everywhere else, the builder who shipped with Cursor last week wins with Jikida: nothing to self-host, no key to buy, the whole stack in one account. Full breakdowns: nuclei · strix · shannon · snyk · cloudflare.

Get started — pick your entry point

Every command below sits in its own copy box. Lines that start with ! are notes, not commands — do not copy those.

Scan a URL or repo — no account needed.

npx @jikida/scan https://your-app.com

! Scan a local repo for committed secrets:

npx @jikida/scan ./

Add the WAF + SDK — auto-detects your framework.

npx @jikida/init

Install a language SDK — Node shown; PHP, Python, Go and the rest are in the SDK table.

npm install @jikida/sdk-node

MCP server for Claude Code, Cursor and Windsurf — add this to ~/.claude/mcp.json:

{ "mcpServers": { "jikida": { "command": "npx", "args": ["-y", "@jikida/mcp"] } } }

Agent skills — copy the skills/ folder into your assistant's skills folder (.claude/skills/, Cursor rules, and the like). Three skills: security, clean-code, UX design — see the table below.

Full details for each are below.

Where things live

Get a token at app.jikida.io/developer. Set it as JIKIDA_TOKEN.

See it in action

One dashboard for a site's whole security posture — protection status, uptime, pentest grade, email security (SPF/DKIM/DMARC) and compliance — with instant alerts to your phone, Slack, Telegram, Discord, email or a webhook.

[Jikida.io dashboard — site overview with protection status, uptime, pentest grade, email security and compliance]

• Uptime & performance — response-time trend, uptime %, P95 and an incident timeline for every page and API you watch.
• API rate-limits & rules — your SDK auto-detects endpoints from real traffic; approve per-endpoint rate caps and WAF rules, or dismiss the ones you don't need.

Table of contents

• Why Jikida beats the other security tools
• Why Jikida.io
• How access works
• What's inside
• Quick install
• Security for your stack
• SDKs — every language
• MCP server for AI IDEs
• Free tools
• Skill for Claude Code
• Standards & mappings
• Threats Jikida.io stops
• Contributing

Why Jikida.io

Most small teams ship without a Web Application Firewall in front of their app. They know they should. They put it on the backlog. Then the free trial ends, or a user reports a slow page, and the WAF ticket rots another quarter.

Jikida.io removes three specific frictions:

1. Install — one line, one language, five minutes.
2. Downside risk — every SDK is fail-open. If Jikida.io is down, your app keeps serving. You lose protection, not availability.
3. Cost — there's a real free tier that protects a hobby project. Plans and current pricing live at jikida.io.

How access works — free, then account-gated, then plan-gated

Everything in this repo is open source, and a lot of Jikida.io is usable before you ever sign up. The model is three tiers of friction, on purpose:

• Free, no account. The SDKs, the WAF rule packs, the CLI scanner and four MCP tools (scan_domain, check_headers, guard_code, check_s3_bucket) run with no login at all — rate-limited by IP. You can protect an app or scan a URL in one command and never create an account. This is the open-source, try-it-now surface.
• Account-gated (still free). Sign up — no card — and the hosted layer turns on: uptime monitoring, one live-site pentest, one repo scan, a basic managed WAF, mobile push, a public status page. This is where a hobby project actually gets protected. The free tier is deliberately useful, not a teaser.
• Plan-gated. The deep, repeated and heavy work sits behind a plan: scheduled deep pentests, the source-to-exploit crawl, more monitors at faster intervals, higher scan quotas, the CNAME edge WAF, team seats and longer log retention. Current caps and pricing live at jikida.io/pricing — plans start at $19/mo billed yearly.

Two different things are hosted, don't confuse them: the pentest and scan analysis runs on Jikida's own servers, which is why you never bring an LLM key for it. The MCP server is the opposite — it calls no model of its own and runs inside your AI editor (Claude Code, Claude chat, Cursor, Windsurf, VS Code), so it spends your editor's AI credits and enforces the same per-site plan quotas. Open where it helps, gated where it costs — usable first, paid when it's worth paying for.

What's inside

Quick install (30 seconds)

npx @jikida/init

The init CLI detects your framework (Next.js, Express, Fastify, Laravel, Symfony, FastAPI, Django, Rails, Go chi, Rust axum, Spring, .NET, Bun, Deno) and adds the right middleware in the right spot. Then set JIKIDA_TOKEN from https://app.jikida.io/developer and ship.

Or, install the SDK for your language directly:

npm install @jikida/sdk-node    # or: bun add / deno add

import { jikida } from '@jikida/sdk-node'app.use(jikida({ token: process.env.JIKIDA_TOKEN }))

composer require jikida/sdk-php

->withMiddleware(function ($middleware) {    $middleware->append(\Jikida\Middleware\JikidaLaravelMiddleware::class);})

Security for your stack

Same platform, framed for what you're building. Each links to the install for that stack:

• Security for AI-generated code — the #1 thing Jikida catches: secrets, open buckets, RLS-off, and injection that AI editors ship. → @jikida/scan + the MCP server in your editor.
• Laravel / PHP security — one middleware for the managed WAF + a repo scan for committed .env / keys. → jikida/sdk-php.
• Next.js / Node / Express security — one-line middleware, fails open. → @jikida/sdk-node.
• Python (Django / FastAPI) security — WAF middleware + secret + dependency (OSV) scan. → jikida (Python).
• Go / Rust / Java / .NET security — the same inspect(request) contract, one line to wire. → sdks/.
• Vibe-coded app security — point it at your live URL + repo; it pentests and flags the insecure defaults. → npx @jikida/scan.

SDKs — every language

All SDKs live in sdks/. The CLI, init and MCP tools live in tools/:

Each SDK:

• Fails open — if the Jikida.io API is unreachable, your app keeps serving.
• Caches policy — 5-minute TTL, refreshed in background.
• Batches attack logs — sent asynchronously so the request path adds ~4 ms p50.
• Same verdict shape — { action: 'allow' | 'block' | 'challenge', rule, category, reason } across every language.

MCP server for AI IDEs

Give Claude Code, Claude chat, Cursor, Windsurf, and VS Code real security tools. The Jikida.io MCP pentests sites, scans domains and repos, checks headers, guards code, lists uptime monitors, adds WAF rules, blocks IPs, and explains WAF verdicts — deterministic, auditable, safe to run inline. Scan output now also surfaces email-security (SPF / DKIM / DMARC) and compliance-style findings alongside the usual header/TLS grade.

Live at mcp.jikida.io. Install via ~/.claude/mcp.json:

{  "mcpServers": {    "jikida": {      "command": "npx",      "args": ["-y", "@jikida/mcp"],      "env": { "JIKIDA_TOKEN": "jk_live_..." }    }  }}

Tools: run_pentest, run_deep_pentest, scan_domain, check_headers, check_s3_bucket, scan_aws, guard_code, scan_repo, run_vibe_scan, verify_finding, pentest_status, list_sites, list_monitors, list_recent_attacks, list_recent_scans, list_cves, explain_verdict, add_waf_rule, block_ip, get_security_preferences, set_security_preference. Four run keyless (scan_domain, check_headers, guard_code, check_s3_bucket) — no token, IP-rate-limited. The MCP calls no LLM of its own: it runs inside your AI editor and uses its credits, enforcing your per-site plan quotas. See tools/mcp for the full tool reference.

Free tools

No login required:

• Free vulnerability / virus scanner — jikida.io/website-app-virus-vulnerability-scanner-online-free
• Uptime monitoring — jikida.io/website-apps-uptime-monitoring
• Website monitor mobile app — jikida.io/website-monitor-app
• Chrome extension — scan any site (including behind your login) from the toolbar — Chrome Web Store

Anthropic Agent Skills — ship secure, non-sloppy apps

Three Anthropic-format Agent Skills you drop in .claude/skills/ (or Cursor rules). Together they turn AI-generated code into an app you'd be proud to ship — secure, maintainable, and usable. Each activates on its own triggers; use them together.

The split is deliberate: secure code can still be slop, and a beautiful UI can still ship a secret in the bundle. Run all three, plus a Jikida scan, before you ship. English + UI copy across all three follow ASD-STE100 (Simplified Technical English) — one idea per sentence, active voice, say what the control does.

Standards & mappings

Every managed WAF rule + skill flow is mapped to industry frameworks. Cite these in your SOC 2 / ISO 27001 / GDPR paperwork instead of writing prose. Flat JSON manifests live under skills/security/mappings/:

Every YAML rule under waf-rules/ also carries inline mitre_attack: [T…], owasp: [A…], and cwe: [n] fields — machine-readable at the rule level too.

Threats Jikida.io stops

SQL injection, XSS (reflected / stored / DOM), CSRF, SSRF, path traversal, XXE, NoSQL / LDAP / command injection, brute force, credential stuffing, account takeover, malicious file uploads (polyglots, PHP-in-PNG, EXIF tampering), bot scrapers, headless browser abuse, TOR exit nodes, ASN-flagged attackers, DDoS L3-L7 (via Cloudflare wrap), API abuse, exposed secrets, open S3 buckets, wide-open Firebase / Supabase rules, .env / .git exposure.

Threat-to-rule mapping is public at jikida.io/threats.

Contributing

Bug in an SDK? Open an issue at https://github.com/unesLam/jikida/issues. Include:

• The SDK + version
• Framework + version
• A minimal reproduction

Security disclosures: mail [email protected] — please don't file public issues for security bugs.

Links

• Landing: https://jikida.io
• App: https://app.jikida.io
• MCP: https://mcp.jikida.io
• Free scanner: https://jikida.io/website-app-virus-vulnerability-scanner-online-free
• Uptime monitoring: https://jikida.io/website-apps-uptime-monitoring
• Docs: https://jikida.io/docs
• Live CVE feed: https://jikida.io/threats

License

Apache-2.0. See LICENSE.