PM AID Full

PM AID is a self-hosted, zero-retention AI-agent defense scanner. v1.1.1 ships 74 working JS-native modules: Basic = 59 modules / Full = 59+15 modules. The 15 Full-only modules are gated by the engine licenseCapabilities().premiumModules flag.

Headline differentiator: PM AID includes llm-scanner-evasion, a refusal-bait scanner that detects prompts and documents designed to make LLM security tooling refuse, skip, or under-report.

Quick start

Prerequisite: Node.js 20 LTS, Node.js 22 LTS, or Node.js 24 LTS. Future even majors such as Node 26 stay blocked until their own PM AID smoke matrix passes. Odd/current majors such as Node 25 are unsupported.

npm install -g @permanentlymobile/pm-aid
pm-aid license activate <KEY>
pm-aid scan --profile quick --target /path/to/project
pm-aid dashboard start

Exit codes: 0 clean, 1 findings, 2 critical finding or operational error.

Local dashboard

pm-aid dashboard start launches the bundled PM AID dashboard from this package. No companion npm package is required. The dashboard is local-only, binds to 127.0.0.1, and uses port 9135 by default. Set PM_AID_DASHBOARD_PORT to choose another local port.

Dashboard and API routes are protected by a bearer token. If PM_AID_DASHBOARD_TOKEN is not set, the CLI generates a token and prints a local URL such as http://127.0.0.1:9135/?token=.... /healthz is the only unauthenticated route.

The dashboard reads PM AID runtime state under PM_AID_HOME (default ~/.pm-aid), including reports, findings.db, license state, and active scan lock files. findings.db is opened read-only. The dashboard has no telemetry, no phone-home behavior, and no browser CDN dependency. A header toggle switches light and dark themes locally and persists the choice in browser localStorage as pm_aid_dashboard_theme.

Commands:

pm-aid dashboard start
pm-aid dashboard stop

License activation and tier matrix

| Tier / key | Price | Scan rights | Notes | | --- | ---: | --- | --- | | Free | $0 | Download + all-module scan, scoreboard + section rollups only | No license key. No detailed findings, remediation, or report export. | | PM AID Basic | $147 one-time | 59 Basic modules, local-only | Offline ED25519 key. Full details and remediation for Basic modules. No premium modules. | | PM AID Full | $197 one-time | 59 Basic + 15 Full-only premium modules, localhost scan | Bundles PG. Pay once, own the local tool. | | PM AID Full Pro | $595 one-time | All PM AID modules + community suggestions + updates + commercial-use license | Commercial-use license. No recurring term. | | PG standalone | $79 one-time | Tokenizing privacy layer | Secondary product, bundled with PM AID Full. | | Resell key | $50/yr | Not a scan tier | Annual legal grant to redistribute unchanged with attribution. | | Rebrand key | $100/yr | Not a scan tier | Annual legal grant to white-label/rebrand. | | White-Hat | separate | Binary tools like nmap, nuclei, ffuf, semgrep, volatility | Not included in PM AID. |

Resell and rebrand keys validate independently from scan tier and require annual expiry.

Profiles

• baseline-free: Free baseline profile. Basic-safe modules only, designed for summary-only freemium output without premium module leakage. Modules: secret-exposure, prompt-injection-scanner, dependency-audit, weak-crypto-scanner, xss-sink-scanner, eval-shell-scanner, firebase-supabase-audit, edge-credential-hygiene-audit, auth-kdf-posture-audit, tor-socks5-egress-detector, android-tv-iot-posture.
• quick: Fast Basic-safe scan over low-noise local modules. Safe for Basic licenses and known-clean fixture smoke tests. Modules: edge-credential-hygiene-audit, auth-kdf-posture-audit, tor-socks5-egress-detector, android-tv-iot-posture, firebase-supabase-audit.
• osint-light: OSINT modules that hit public APIs only. No binary OSINT chain orchestrator. Modules: osint-footprint, google-dork-scanner, metadata-leak-scanner, deepfake-detection, brand-monitor, whois-monitor, wayback-audit, mail-security, securitytrails-api, breach-watchlist.
• half-deep: PM AID Full shipped surface. Expands to all Basic + Full-only premium modules. Modules: all.

Module catalog

Basic modules (59)

• android-tv-iot-posture: Offline defensive posture analyzer for Android TV and IoT evidence snapshots.
• auth-kdf-posture-audit: Offline defensive posture analyzer for authentication KDF evidence snapshots.
• api-abuse: Tests API rate limits, cost controls, key rotation, model selection, fallback safety, response sanitization, and token budget enforcement
• arp-spoof-detect: ARP spoofing/poisoning detection via ARP table monitoring and gateway MAC validation
• bluetooth-pentest: Bluetooth penetration testing -- Classic and BLE discovery, GATT enumeration, pairing assessment, device fingerprinting
• brand-monitor: Brand impersonation monitor -- tracks username presence across social platforms for impersonation detection
• breach-watchlist: Breach watchlist -- monitors household-tied emails against the HaveIBeenPwned breach corpus.
• browser-version-audit: Browser version audit -- detects Firefox / Tor Browser / Chrome / Chromium installs across hosts and flags anything below the CVE floor
• business-logic: Concurrent requests to state-changing endpoint to detect race conditions
• campaign-progress-monitor: Campaign progress monitor -- loads campaign definitions, verifies
• cloud-misconfig: Multi-cloud misconfiguration scanner -- AWS S3/IAM/SG, GCP Storage/IAM/SA, Azure Blob/NSG audit, credential rotation checks
• context-exploit: Tests context window manipulation, session confusion, memory poisoning, and cross-agent context leaks
• deepfake-detection: No EXIF data at all -- common in AI-generated or scrubbed images
• defensive-sensor-stack: Defensive sensor stack -- incrementally tails Sysmon/auditd events, matches them against
• dependency-audit: Comprehensive dependency auditing: npm audit, outdated packages, lock file integrity, and dependency tree validation
• dependency-confusion: Detects dependency confusion risks: private package hijacking, missing registry scoping, lockfile integrity, typosquatting, and supply chain advisories
• deserialization-vuln-scanner: Static scan for unsafe Python deserialization (pickle/marshal/shelve/yaml/torch/numpy/joblib/pandas). Same-line pm-aid-safe annotation downgrades to INFO.
• edge-credential-hygiene-audit: Offline defensive posture analyzer for edge credential hygiene evidence snapshots.
• dns-footprint: Nameserver records changed -- potential DNS hijacking
• egress-leak-check: Egress leak check -- asserts PM AID
• email-header-forensics: Static analyzer over raw RFC-5322 email headers. Eight finding axes: SPF/DKIM/DMARC verdicts, originating IP + geo + ASN attribution, Received: chain anomalies, From/Reply-To/Return-Path divergence, display-name spoofing, link enumeration + brand-impersonation, 419 scam-pattern heuristic, email-auth-cross-check (EMAIL-AUTH-PASS-WITH-ORIGIN-MISMATCH).
• eval-shell-scanner: Static scan for dangerous eval/shell-exec patterns across JS/TS, Python, Go, PHP, Ruby. Multi-language gated; same-line pm-aid-safe annotation downgrades hits to INFO. Patterns ported verbatim from Anthropic security-guidance (Apache-2.0).
• finding-db: Self-tests finding persistence database: CRUD operations, regression detection, scan history
• firebase-supabase-audit: Supabase project URL exposed in client code
• google-dork-scanner: Exposed .env files containing secrets or configuration
• guardrails: Self-tests PM AID guardrail defenses: injection detection, output validation, homograph detection, base64 decoding
• http-headers: reveals server software
• icmp-posture: ICMP security posture assessment -- verifies owned infrastructure is hardened against ICMP/traceroute reconnaissance
• linux-kernel-version-check: Linux kernel / firmware / microcode posture -- diffs dpkg-installed versions against Ubuntu USN feed; flags running-kernel vs installed mismatch (reboot pending).
• llm-proxy-posture: LLM proxy posture sentinel -- detects any local LLM proxy (LiteLLM, custom routers) via process/socket/npm/docker enumeration, then audits posture (loopback bind, master key, DB key-leak, request-log key-leak) against pm-aid/data/llm-proxy-policy.json. Default deny.
• mail-security: Email infrastructure security validator -- SPF/DKIM/DMARC policy validation, MX record audit, SMTP health probes, and DNSBL blacklist checking
• metadata-leak-scanner: Windows user path reveals internal username and directory structure
• mobile-apk-audit: AWS access key
• osint-chain-orchestrator: crt.sh certificate-transparency subdomain enumeration
• osint-footprint: OSINT digital footprint scanner -- DNS, CT logs, WHOIS, breach checks, local PII leaks
• osint-quarterly: OSINT self-assessment quarterly umbrella scan -- aggregates multiple recon modules into a single exposure report
• paladin-bypass: Tests Paladin security engine for timing attacks, YAML injection, JSON-RPC abuse, connection flood, encoding bypass, directive override, approval relay bypass, and policy reload manipulation
• pam-integrity-monitor: PAM integrity monitor -- walks /etc/pam.d/* and PAM .so modules, diffs sha256/owner/mode/mtime against pm-aid/data/pam-baseline.json, cross-references with dpkg --verify. CRITICAL on .so hash drift confirmed by dpkg-verify.
• payment-flow: Submit order with zero price to test server-side price validation
• prompt-injection: Direct instruction override attempts
• prompt-injection-scanner: Pre-LLM input scanner (Module PP) -- decode-then-scan pipeline, pattern library, optional ML classifier. Exposed as scanInput() utility.
• secret-exposure: AWS access key
• securitytrails-api: SecurityTrails API integration for subdomain enumeration, DNS history, WHOIS, tech stack, and SSL monitoring
• self-osint-audit: Self-OSINT audit (BBB) -- runs whois, crt.sh, and rDNS against operator-seeded identity fields; drift-detects new exposures against a stored snapshot. HIGH severity on new exposures.
• ssh-version-audit: OpenSSH version audit -- banner-grabs each host in inventory, compares parsed version against the cve-floors.json openssh floor.
• ssl-tls-check: TLS version testing, certificate validation, cipher analysis, and HSTS check using Node built-in tls module
• ssrf-scanner: Server-Side Request Forgery testing with cloud metadata, internal service, protocol smuggling, URL parser differential, and DNS rebinding payloads
• subresource-integrity-audit: Scan HTML and template files for remote JS/CSS includes missing SRI posture.
• supply-chain: eval() call -- arbitrary code execution
• tor-socks5-egress-detector: Offline defensive posture analyzer for Tor SOCKS5 egress evidence snapshots.
• traceroute-path: Network path analysis using traceroute (UDP, ICMP, TCP/443) with baseline comparison for routing deviation detection
• vault-access: Tests vault security: path traversal, symlinks, git exposure, permissions, commit injection, workspace isolation, YAML injection
• voice-pipeline: Tests voice pipeline security: TTS injection, filter bypass, audio format abuse, sanitization, model path traversal, DoS, fallback safety, transcription injection
• wayback-audit: Wayback Machine historical URL audit -- discovers forgotten endpoints and sensitive files via Archive.org
• weak-crypto-scanner: Static scan for weak cryptography patterns (no-IV createCipher, AES-ECB, TLS verification disablement, weak hash security use, hardcoded key/IV literals).
• whois-monitor: WHOIS registration monitor -- tracks domain ownership changes, expiry dates, and registrar modifications over time
• wifi-pentest: WiFi penetration testing -- network discovery, encryption assessment, rogue AP detection, WPS testing, signal mapping
• xss-sink-scanner: Static scan for client-side XSS sinks in JS/TS/HTML-family files with same-line pm-aid-safe suppression downgrade.
• xxe-scanner: Static scan for XXE-prone XML parse call sites in Python, Java, and PHP with same-line pm-aid-safe suppression and defusedxml posture downgrade.

Full-only premium modules (15)

• agent-tool-call-principal-binding: Audit agent and tool definitions for confused-deputy principal binding gaps on cross-principal operations.
• config-import-time-code-execution: Detect package, Python, MCP, lockfile, and config import-time code execution primitives without executing them.
• decision-chain-integrity: Decision-chain integrity -- audits whether each agent tool call aligns with the reasoning that preceded it. Read-only.
• defusedxml-adoption-audit: Audit Python XML stdlib imports for project-level defusedxml adoption posture.
• gh-actions-injection-scanner: Scan .github/workflows/*.yml for github.event interpolation directly inside run blocks.
• llm-scanner-evasion: Detects LLM refusal-bait scanner evasion and provides deterministic quarantine transforms.
• markdown-link-scheme-audit: Scan markdown files for javascript:, vbscript:, and risky data: link schemes.
• mcp-transport-integrity: MCP transport integrity -- diffs active MCP servers (~/.claude/settings.json + project .claude/settings.json) against pm-aid/data/mcp-inventory.json. CRITICAL on hash mismatch; HIGH on new/undeclared server or transport change; MEDIUM on token age > 60d or first-run baseline.
• output-pii-scanner: Post-LLM output PII / sensitive-disclosure scanner (Module RR) -- regex PII, confirmation-frame heuristics, redact-and-forward / block decisions. Exposed as scanOutput() utility.
• persona-hardened-egress: Persona-Hardened Egress (CCC) -- detects whether the scan host is exiting via a hardened persona (WireGuard, proxy, or declared persona) or leaking on the bare host IP. Scan-and-report only.
• pre-scan-attack-surface: Pre-scan attack surface -- crawls target hosts with katana, dedupes results,
• rotation-aware-actor-correlation: Rotation-aware actor correlation -- collapses N low-volume events from N Tor-exit IPs into a single
• symjack-mcp-config-guard: SymJack guardrail for MCP config drift and repo poisoning preconditions. Flags symlinked MCP command chains, undeclared server additions, out-of-policy command paths, and repo symlinks/instructions that target agent config files.
• tool-output-poisoning: Poisoned web content fetched by agent
• tool-param-injection: Tests for shell injection via unsanitized parameter interpolation in execSync/spawn calls

Deferred post-launch modules

These 10 partial/TODO modules are deliberately out of v1 shipped profiles and package sync output. They must not emit placeholder findings: cedar-bypass, ai-malware-detect, client-auth-bypass, context-minimiser, editor-extension-audit, git-host-integrity, linux-privesc-surface, patch-verification, ssh-cert-principal-probe, supply-chain-vigilance.

Privacy statement

PM AID runs locally. License validation is offline with embedded public keys. Scans do not phone home. Findings, reports, checkpoints, and dashboard state stay under PM_AID_HOME, default ~/.pm-aid. Dashboard binds to 127.0.0.1 and opens findings.db read-only.

Troubleshooting

• No license: run pm-aid license activate .
• Supported Node.js launch targets are Node 20, Node 22, and Node 24. Node 25 is unsupported as an odd/current major. Node 26 and later future even majors are pending PM AID validation until their own smoke matrix passes.
• Basic skips Full-only modules by design. Upgrade to Full for premium modules.
• External/private network scanning requires a PRO_EXTERNAL-style key.
• OPSEC modules under all are opt-in with PM_AID_OPSEC_MODULES_ENABLED=true.
• decryptAgeFile is a stub. Pre-decrypt age files before scanning.