BreachLabs

Build. Break. Verify. Fix.

An autonomous AI application-security engineer that assesses, verifies, and fixes software inside the build loop.

Live Web App • Interactive Demo • Demo Code Inspector • MCP Gateway • About & Credits

🌟 Overview & Mission

BreachLabs gives every software application its own dedicated security engineer.

Traditional security scanners produce mountains of unranked, noisy alerts that slow down development. BreachLabs operates directly inside your pair-programming and build loop as an autonomous AI agent equipped with controlled Model Context Protocol (MCP) tools, deterministic AST scanners, dynamic HTTP probes, and sandboxed reproduction environments.

It does not stop at detection: it correlates tainted signals, validates reachability with targeted verification probes, drafts precise root-cause patches, and proves resolution with automated retests.

⚡ Quickstart

1. Automated 1-Click Agent Setup (NPX)

Configure your AI coding assistant (Google Antigravity, Claude Desktop, Cursor, Windsurf, or Cline) with zero manual JSON editing:

# Launch interactive installer:
npx breachlabs

# Or configure a specific agent:
npx breachlabs --agent=cursor
npx breachlabs --agent=claude
npx breachlabs --agent=antigravity
npx breachlabs --agent=all

2. Start the Local Engine & MCP Gateway

# Start the local unified server (Web UI + MCP Streamable HTTP on port 8000):
npx breachlabs serve

# Check Python environment, port health & skill installation status:
npx breachlabs check

3. Install Bundled Agent Security Skills

Equip your agent with the autonomous security workflow and secure application guidelines via skills.sh:

npx -y skills add notaayushsrivastava/BreachLabs

🔄 The 9-Phase Autonomous Loop

0. PREREQUISITES ──► 1. INTAKE ──► 2. BUILD & HEALTH ──► 3. RECON ──► 4. STATIC SCAN
                                                                             │
 9. RETEST & FIX ◄── 8. VERIFY ◄── 7. INVESTIGATE ◄── 6. BROWSER ◄── 5. DYNAMIC SCAN

1. Prerequisites: Reciprocally checks MCP server and AI skill installation status.
2. Intake: Maps repository structure, detects frameworks (Python, Node.js, Go, Rust, Java, PHP), and parses dependency manifests.
3. Build & Health: Boots target application in an isolated sandbox and verifies responsiveness.
4. Reconnaissance: Discovers routes, API endpoints, parameters, and authentication flows.
5. Static Analysis (SAST): Multi-language AST taint analysis, secret detection, and syntax diagnostics.
6. Dynamic Analysis (DAST): Executes scoped, passive and active HTTP security checks.
7. Browser Automation: Exercises user authentication workflows and tests DOM reflection.
8. AI Investigation: Correlates multi-source evidence and traces tainted arguments to vulnerable sinks.
9. Verification & Retest: Confirms findings with targeted runtime probes, drafts minimal root-cause patches, and verifies fix closure with automated retests.

🛠️ MCP Toolset Reference

BreachLabs exposes an allowlisted set of structured tools over Streamable HTTP (/mcp) and Server-Sent Events (SSE) (/mcp/sse):

| Tool | Risk Level | Description | | :--- | :--- | :--- | | run_assessment | ACTIVE_SCAN | Executes end-to-end autonomous security assessment and returns full Markdown & JSON report. | | inspect_repository | READ_ONLY | Inspects project directory tree, framework manifests, and entry points across multiple languages. | | list_routes | READ_ONLY | Maps web routes across Flask, FastAPI, Django, Express, Fastify, Go, Rust, Spring, and Laravel. | | run_static_scan | READ_ONLY | Runs deterministic AST taint analysis and multi-language SAST rules. | | scan_secrets | READ_ONLY | Detects committed API keys, AWS credentials, tokens, and plaintext passwords. | | run_dast | ACTIVE_SCAN | Executes scoped HTTP dynamic security probes against target endpoints. | | communicate | READ_ONLY | Direct advisory & triage channel with BreachLabs Security Engine. | | diagnose_error | READ_ONLY | Diagnoses runtime exceptions, syntax errors, and compilation crashes across languages. | | generate_remediation | READ_ONLY | Generates verified root-cause security patches and unified git diffs. | | verify_installation | READ_ONLY | Reciprocal verification of MCP Server and Agent Skill bundle. |

🚀 Deployment

Deploy to Vercel

BreachLabs is fully configured for serverless deployment on Vercel:

# Deploy to production with Vercel CLI:
npx vercel --prod

• Serverless entry point: api/index.py
• Configuration: vercel.json
• Ignore rules: .vercelignore

Run with Docker

docker build -t breachlabs .
docker run -d -p 8000:8000 -e PORT=8000 breachlabs

🎯 Demo Target Applications

BreachLabs includes multi-framework demonstration targets with intentional syntax glitches and OWASP Top 10 vulnerabilities (SQLi, Reflected XSS, IDOR, Command Injection, Prototype Pollution, Hardcoded Secrets):

• Flask (Python): demo/flask_app/vulnerable_app.py
• Django (Python): demo/django_app/
• Node.js (Express): demo/node_app/
• Interactive Code Inspector: Access /demo/code to view syntax-highlighted source code with vulnerability markers and auto-patch diffs.

👤 Author & Engineering Credits

BreachLabs was designed and architected by:

Aayush Srivastava

• GitHub: @notaayushsrivastava
• Portfolio: https://aayushsrivastava.pythonanywhere.com/
• Repository: notaayushsrivastava/BreachLabs

📄 License & Copyright

Distributed under the MIT License. See LICENSE for more information.

Copyright (c) 2026 BreachLabs · Built & Engineered by Aayush Srivastava.
All rights reserved.