English · 简体中文

Break Anything

You think your service is secure. You've never looked at it the way an attacker would.

Break Anything points your coding agent — or your terminal — at your own code, apps, and infrastructure and hunts them like an attacker: it surfaces what's genuinely exploitable, proves it on your own build, and fixes it. Before someone else finds it first.

Quick start · Example output · Why it's different · CI/CD · The arsenal · FAQ

npx break-anything ci .          # one command: deps + secrets + IaC + SAST, one exit code

"It's probably fine." It shipped, it works, nobody has complained — so you assume it's secure. But "no breach yet" was never a security test. The only honest one is to look at your own service the way an attacker will: which dependency is an open door, what key is still in your git history, which endpoint hands over another user's data.

And you're never done. A critical unauthenticated RCE turned up in PHP itself in October 2026 after years in plain sight — if the language behind much of the web still ships critical holes, so does your app. Every dependency you add widens the surface, and you can't close them all. So fix the few an attacker can reach today.

The economics just flipped, too: the same AI agents that write code now hunt vulnerabilities at scale — and attackers have them. Find your holes first, with the same leverage.

Break Anything gives your agent that attacker's-eye view — in one sentence, on software you own: what's genuinely exploitable, proven on your build, with the fix. Everything runs locally. Nothing is pointed anywhere you don't own.

Quick start

As an agent tool (MCP). One command registers Break Anything into every AI coding agent on your machine:

npx break-anything setup

It auto-detects Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI and Windsurf — backs up every file it touches, preserves your other servers, and is safe to re-run. Restart your agent, then ask:

Use Break Anything on this project. Show me only the vulnerabilities that are
actually reachable in my code, prove the worst one, and give me the fix.

From the terminal. No install, nothing to configure:

npx -y break-anything ci .                 # whole-repo gate: deps + secrets + IaC + SAST, one exit code
npx -y break-anything deps .               # dependency CVEs, ranked by reachability + KEV + EPSS
npx -y break-anything secrets . --history  # leaked keys in the tree and full git history
npx -y break-anything iac ./deploy         # Dockerfile/K8s/Terraform misconfigs — no engine to install
npx -y break-anything sast ./src           # static analysis (needs Semgrep): injection, authz, SSRF…
npx -y break-anything image my-svc:latest  # OS + app CVEs in a container image (needs Trivy)
npx -y break-anything api http://localhost:4000 --config accounts.json  # IDOR/authz on a running API (authorized)
npx -y break-anything fix .                # turn findings into a prioritized upgrade plan
npx -y break-anything sbom . --out bom.json  # CycloneDX SBOM (--diff old.json to gate drift)

Requires Node.js ≥ 18.17. deps/secrets/iac/fix/sbom are fully built in; sast and image wrap Semgrep/Trivy and degrade gracefully if those aren't installed.

Related MCP server: sentrik

Example output

brk ci — the whole repo, one gate, one exit code:

Break Anything · CI security gate
./my-service

  ● deps        9 findings
  ● secrets     1 findings
  ● iac         3 findings
  • sast        skipped (Semgrep not installed)

total 13 findings  ·  CRITICAL 2  HIGH 7  MEDIUM 4

✗ GATE FAILED (fail-on HIGH)
  - 4 reachable HIGH+ dependency vulns
  - 1 known-exploited (KEV) dependency vuln
  - 1 leaked secret
  - 1 HIGH+ IaC issue

brk deps — ranked by what an attacker can actually reach, with the actively-exploited one flagged:

Break Anything · dependency scan
target ./my-service  ·  2 packages scanned  ·  npm:2

HIGH     systeminformation@5.3.0 (npm) [KEV]
  CVE-2021-21315  ·  called  ·  EPSS 90.7%  ·  fix → 5.3.1
  Command Injection Vulnerability
CRITICAL lodash@4.17.4 (npm)
  CVE-2019-10744  ·  called  ·  EPSS 5.0%  ·  fix → 4.17.12
  Prototype Pollution in lodash

summary 12 findings  ·  12 reachable (10 called)  ·  1 KEV  ·  CRITICAL 2  HIGH 8  MEDIUM 2
KEV = CISA Known Exploited: attackers are using this in the wild right now. Fix these first.

brk fix — the minimal upgrade that clears the most CVEs, ordered by reachability:

Break Anything · fix plan
./my-service  ·  2 packages to upgrade  ·  resolves 12 vulnerabilities

1. [called · CRITICAL] [KEV] systeminformation 5.3.0 → 5.31.7  resolves 9 CVEs
   npm install systeminformation@5.31.7
2. [called · CRITICAL] lodash 4.17.4 → 4.18.0  resolves 3 CVEs
   npm install lodash@4.18.0

Why it's different

Every scanner can hand you a list. The list is the problem. Break Anything is built around the three things a list can't do:

• Reachability — it thinks like an attacker. An attacker doesn't work through 400 theoretical CVEs; they go straight for the few they can actually reach. Break Anything ranks the same way: called → imported → direct → transitive. It doesn't just check that a vulnerable package is present — it extracts the symbols you imported from it and checks whether your code actually calls them. The lodash you never invoke is noise; the one you call is the finding. You triage 3, not 400.

• Proof, not prose. Instead of a CVSS paragraph, it builds a proof-of-concept against your build — the exact input or request that breaks it — so "theoretically vulnerable" becomes "here's the repro." The API prober returns the literal request that read another account's data.

• A fix, even when upstream is gone. No patched version because the maintainer vanished? It proposes a patch, a pin, a compatibility shim, or a maintained fork — so an abandoned dependency doesn't become your breach. Hand it to Patch Anything for a merge-ready PR.

It doesn't replace OSV, Trivy, Semgrep or ZAP — it orchestrates them behind one interface (CLI or MCP) and does the reasoning they can't.

How it compares

See it in 30 seconds

Three moments you'll reach for it, each one sentence to your agent:

CI/CD in one line

brk ci returns a non-zero exit code when the gate trips, so it drops straight into any pipeline. Add SARIF and the findings show up inline on the exact file/line in GitHub's Security tab:

# .github/workflows/security.yml
name: security
on: [push, pull_request]
jobs:
  break-anything:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "22" }

      - name: Security gate (fails the build on reachable HIGH+ / KEV / secrets)
        run: npx -y break-anything ci . --fail-on=high

      - name: Export SARIF
        if: always()
        run: npx -y break-anything ci . --sarif > results.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

Any other CI works too — it's just an exit code. GitLab, CircleCI, Jenkins: run npx -y break-anything ci . and check the status.

Output formats

Every finding-producing command speaks the formats your toolchain already reads:

What you point it at

You don't pick a mode. Hand it whatever you have — it detects the form and routes to the right engine.

The arsenal

Organized by scan category — the language security teams speak — each orchestrating tools that already run in real pipelines. ✅ shipped · 🧭 on the roadmap.

✅ Shipped today

• Dependencies (SCA) — known CVEs across your whole tree, ranked by reachability + CISA KEV (known-exploited) + EPSS (exploit probability), with fix versions. Powered by OSV. 8 ecosystems: npm, PyPI, Composer (PHP), Go, Rust (crates.io), Ruby (RubyGems), Maven (Java), NuGet (.NET).

• Secrets — leaked keys/tokens/private keys in the working tree and full git history, redacted in output. Built in; recognizes AWS, GCP, GitHub, GitLab, Slack, Stripe, OpenAI, JWTs, private keys and generic assigned secrets.

• Static code (SAST) — injection, broken access control, insecure deserialization, SSRF, hardcoded secrets — each with file/line, CWE/OWASP tags, and the offending snippet. Engine: Semgrep.

• Infrastructure as Code (IaC) — Dockerfile, Kubernetes, and Terraform misconfigurations (root containers, privileged pods, world-open CIDRs, public buckets, baked-in secrets), each with file/line, CWE, and a fix. Built in — no engine to install.

• Container images — OS + app CVEs, Dockerfile smells, secrets in layers. Engine: Trivy.

• API security (DAST) — probe a running API for broken object-level authorization (IDOR/BOLA), missing auth, and missing security headers, each proven with the reproducing request. Built in; off by default, authorized targets only.

• Fix planning — the minimal safe upgrade that clears the most CVEs per package, ordered by reachability then severity, with the exact npm/pip/composer command. No-fix packages get mitigation guidance.

• Standards output — CycloneDX SBOM generation + diff, and SARIF 2.1.0 for every scanner.

• One-shot CI gate — ci runs deps + secrets + IaC + SAST in one command, one report, one merged SARIF, one exit code.

🧭 On the roadmap

• More SAST engines — CodeQL, Bandit (Python), gosec (Go), Brakeman (Rails), Find-Sec-Bugs (Java), security-code-scan (.NET), retire.js (frontend).

• Deeper IaC & cloud — opt-in Checkov / tfsec / KICS / Kubescape backends; CloudFormation, ARM/Bicep, Ansible; CSPM via Prowler / ScoutSuite.

• More DAST & attack surface — OWASP Top 10, content/parameter discovery, XSS, injection on top of today's authorization prober. OWASP ZAP, Nuclei, sqlmap; surface mapping via Nmap + ProjectDiscovery.

• Call-graph reachability — from "the symbol is called" to "the specific vulnerable function is on a real path."

• AI/LLM · binary · mobile · fuzzing — Garak · Ghidra/angr · MobSF · AFL++.

• Offensive / exploitation — authorized pentest only; gated, off by default, written permission required. Metasploit, Hydra, BloodHound.

Full per-tool catalog and MCP contracts: docs/mcp-tools.md. Every dynamic (traffic-sending) category is off by default and refuses any target not on your allowlist.

Data sources

Break Anything trusts open, authoritative sources — not a closed, proprietary database:

• OSV.dev — vulnerabilities across every major open-source ecosystem, each advisory from an authoritative upstream (GitHub Advisory, RustSec, Ubuntu, etc.).

• CISA KEV — the authoritative catalog of vulnerabilities being exploited in the wild right now.

• EPSS (FIRST.org) — the probability a vulnerability will be exploited in the next 30 days.

Analysis runs on your machine. Nothing is uploaded except the anonymous package-coordinate queries needed to look up advisories.

How it works

Your agent (or the CLI) calls Break Anything to inspect a target you control. It routes to the right engine, confirms reachability, and returns each finding with its evidence and a fix.

Find weaknesses across deps, code, secrets, images, IaC, and running apps → Prove the finding is reachable with a PoC against your target → Fix it inline or via Patch Anything. Absence of a finding is never reported as proof of safety.

Companion: Patch Anything

Break Anything finds it and proves it → Patch Anything fixes it.

Hand any finding over and it drafts the patch, bump, shim, or fork. Discovery and repair, one loop. Use either alone, or run them end to end.

FAQ

They report presence — every vulnerability that exists anywhere in your tree. Break Anything adds reachability (is it actually called), KEV + EPSS ranking (is it exploited in the wild / likely to be), proof (a PoC against your own build), and self-remediation when upstream has no fix — and unifies deps, code, secrets, images, IaC, and runtime behind one interface. See the comparison table.

No — it orchestrates them. Break Anything is the brain and the interface; OSV, Trivy, Semgrep, ZAP are the engines. You get their depth without learning each one.

Yes. The brk CLI does everything the MCP tools do — npx -y break-anything ci . needs no agent, no account, no config. The MCP server just exposes the same capabilities to agents that support it.

No. It's defensive and authorized-targets-only; every PoC runs against your own target and it ships no weaponized exploits. See DISCLAIMER.md. GitHub policy explicitly supports dual-use security research.

Analysis runs locally. Dependency lookups send only package names + versions to OSV. Your agent receives the results; its model provider has its own data policy — review that separately.

Any agent that supports local MCP servers. npx break-anything setup configures the common ones automatically (Claude Desktop, Claude Code, Cursor, Codex, Gemini CLI, Windsurf).

Documentation

Installation · Tool catalog & MCP contracts · Roadmap · Changelog · Security model · Responsible use · Contributing

License

MIT. Break-authored code is MIT; the engines it orchestrates keep their own licenses — see THIRD_PARTY_NOTICES.md.