Mako

Local-first AI pentest CLI.
Install once → open any project → type mako.

Stack: Rust TUI (crossterm / ratatui) + Python agent.

Install

Needs Node 18+ and Python 3.11+.

Use a global install (-g). A plain npm i mako-security only puts mako in node_modules/.bin (not on your PATH), so the shell cannot find it.

Recommended (no sudo)

mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

npm install -g mako-security
mako

Alternatives

# one-shot without global install
npx mako-security

# if you already installed locally in ~
~/node_modules/.bin/mako

If npm install -g fails with EACCES (prefix is /usr/local), use the user-prefix steps above — do not use sudo npm.

| | | |--|--| | npm package | mako-security | | Command you type | mako |

Use

cd any-project
mako

1. Trust folder → set a real model if asked
2. Type: hi · pentest this · demo · /model · /exit

| In chat | Action | |---------|--------| | pentest this | Hunt this project (localhost only) | | demo | VulnShop sample | | /model | Change provider / key | | /status | Findings | | /exit | Quit |

| CLI | Action | |-----|--------| | mako ci | CI mode | | mako model | Model wizard only |

Force Python UI: MAKO_FORCE_PYTHON_TUI=1 mako

Runtime installs under ~/.mako-cli/ (venv + TUI).

Maintainers

cd mako-tui && cargo build --release
cd .. && npm run prepack
npm publish          # package: mako-security

Principles

| Law | Meaning | |-----|---------| | Sandbox only | Localhost attacks by default | | PoC or it didn’t happen | No verified finding without replay | | Simple UX | npm install -g mako-security → mako |

License

Apache-2.0