APEX

Authorized security automation for modern web and AI systems.

APEX is a scope-first security automation platform that combines reconnaissance, web checks, secrets analysis, mobile analysis, LLM red-team testing, evidence collection and reporting behind explicit authorization gates.

Authorized use only. APEX is designed for bug-bounty programs, VDPs and engagements where the operator has explicit permission to test the target.

Why it matters

Security automation becomes dangerous when scope and authorization are treated as an afterthought. APEX makes them part of the execution model:

• explicit scope definition

• fail-closed target validation

• authorization confirmation before active testing

• per-host rate limiting

• reproducible findings and evidence

• Markdown/HTML reporting

• MCP interface for AI-assisted workflows

The result is not just a collection of scanners, but an orchestration layer around specialized security agents and tools.

Related MCP server: keel

Architecture

                    ┌─────────────────────┐
                    │   Scope / Policy    │
                    │     fail-closed     │
                    └──────────┬──────────┘
                               │
                     ┌─────────▼─────────┐
                     │    Orchestrator   │
                     └─────────┬─────────┘
                               │
          ┌────────────────────┼────────────────────┐
          ▼                    ▼                    ▼
       Recon                Web / API          AI Security
          │                    │                    │
       Assets             Findings             agentstrike
          └────────────────────┼────────────────────┘
                               ▼
                    ┌─────────────────────┐
                    │ Evidence / Quality  │
                    │       / CVSS        │
                    └──────────┬──────────┘
                               ▼
                    Markdown / HTML / MCP

Core capabilities

Install

# recommended: isolated CLI install
pipx install apex-bounty

# or into the current environment
pip install apex-bounty

# with the optional MCP bridge
pip install "apex-bounty[mcp]"

This installs the apex and apex-auto commands. The core has zero dependencies (pure stdlib); [mcp] and [browser] extras are optional.

From source (development)

git clone https://github.com/nadirzhon/apex
cd apex
python3 -m apex.cli --help
pip install -e '.[dev]'     # editable install + pytest/ruff

Quick start

Create an explicit scope:

{
  "program": "Example Corp",
  "authorized": true,
  "rate_limit_rps": 2,
  "in_scope": ["*.example.com", "api.example.com"],
  "out_of_scope": ["staging.example.com"]
}

Run a baseline workflow:

apex --scope program.json scope
apex --scope program.json --i-am-authorized orchestrate --profile baseline --json
apex --scope program.json report

Without authorization or when a target is outside scope, active execution fails closed.

New here? Follow the reproducible, offline demo walkthrough — it needs no network access or credentials.

MCP interface

APEX exposes controlled operations through MCP so an AI assistant can work with the same authorization boundary:

APEX_SCOPE=program.json APEX_AUTHORIZED=1 python -m apex.mcp_server

The MCP layer can inspect scope, run authorized modules, review findings and generate reports without bypassing the policy gate.

Engineering highlights

• Python standard-library core with optional integrations

• Go concurrent network core for performance-sensitive workloads

• deterministic scope enforcement

• isolated modules and agent specifications

• JSON state and JSONL event contracts

• CVSS 3.1 scoring

• evidence-quality validation

• CLI + MCP interfaces

• designed for reproducible security research rather than blind scanning

Related projects

• agentstrike — LLM-agent red-team fuzzer

• mcpscan — MCP security scanner

• offsec-mcp — authorized security tools exposed to AI agents

License

MIT. The license does not remove the operator's responsibility to test only systems they are authorized to test.