{
  "markdown": "<p align=\"center\">\n  <picture>\n    <source media=\"(prefers-color-scheme: dark)\" srcset=\"assets/niro-logo-dark.png\">\n    <img src=\"assets/niro-logo-light.png\" alt=\"Niro\" width=\"280\">\n  </picture>\n</p>\n\n# Niro Community Edition\n\n> Finds security bugs. Ships fixes.\n\n[![Latest stable release](https://img.shields.io/github/v/release/apxlabs-ai/niro)](https://github.com/apxlabs-ai/niro/releases/latest)\n\nNiro works like an autonomous, two-person team living in your repo — two roles\nwith one goal: real security bugs, found and closed with proof.\n\nNiro sets the stage first — it stands up your app (or points at a target you\nprovide), seeds test state, and creates the users and data an attacker needs, so\nyou skip most of the environment setup. Then the two-person team goes to work:\n\n- **The attacker agent** hits your running app like a real adversary — finds\n  exploitable bugs and proves each with a working exploit. Never changes your\n  code.\n- **The developer agent** patches the bugs it can safely fix and records\n  validation evidence — normally a regression test in the project's suite — so\n  every PR arrives with evidence, not just a claim. Never merges — you do.\n\nMost security tools hand you a backlog of maybes and walk away. Niro doesn't stop\nat proven findings — in fix mode it turns each into a focused **pull request**.\nYou review the diffs and decide what ships.\n\n## From a three-team relay to one run\n\nFixing a security bug is a **relay across three teams** — today's tools each\ncover one slice, so people stitch the rest together:\n\n1. **Set up** the test environment — *engineering.*\n2. **Attack** the app to find and exploit the bugs — *security.*\n3. **Triage and fix** every finding — *developers.*\n\nA **program manager** chases the handoffs, and it's never one clean pass. The\npentester needs another test tenant, back to eng. A finding won't reproduce, it\nping-pongs between security and dev. A fix ships, security has to re-test. Weeks\npass, a dozen people touch it, and the code has already moved on.\n\n**Niro collapses that relay into one agent-driven run.** Its **attacker agent**\ndoes the security team's job, its **developer agent** does the dev team's — and\nit *automates the setup* engineering used to own. You still set the scope,\nreview the diffs, and decide what merges; Niro handles the back-and-forth in\nbetween — so three teams' effort lands in a few hours as review-ready pull\nrequests, grouped by root cause so each is small enough to actually review.\n\n## Quickstart\n\nFrom your project root, [check the prerequisites](docs/prerequisites.md), then\ninstall Niro and start a fix run:\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/apxlabs-ai/niro/main/install.sh | sh\nniro fix\n```\n\n`niro fix` opens the selected agent CLI interactively with Niro's first message\nalready submitted. The agent CLI applies its own sandbox and approval policy;\nnot every operation necessarily prompts. For an intentionally unattended run,\n`--autonomous` grants the agent CLI full current-user host access without\napproval prompts. Read the [agent CLI privilege and threat\nmodel](docs/agent-cli-security.md) before using it. Niro opens review-ready fix\nPRs; you decide what to merge.\n\nSee [Run Niro](docs/run-niro.md) for report-only and scoped runs, supported\nagent CLIs, CI, and interactive developer agent workflows.\n\n## What a run actually does\n\nSetup done, Niro works your running app the way a real attacker would — and\ndoesn't stop until each bug is proven:\n\n1. **Attack** — probes your HTTP surfaces (web apps, APIs, MCP servers) for real,\n   exploitable bugs.\n2. **Unblock** — when a login, empty database, disabled feature, or missing tenant\n   blocks testing, Niro creates what it needs to keep going instead of silently\n   skipping that part of the app.\n3. **Prove** — every finding is a false alarm until Niro reproduces it and leaves\n   a runnable proof. Doubt is demoted, never inflated.\n\nProven bugs are grouped by root cause into focused, review-ready PRs — one per\ncause, each with its own validation evidence.\n\n## Don't take our word for it\n\nHere is a complete Niro run you can inspect yourself — from the pinned source\nand public workflow to the unedited report and every proposed code change.\nNiro tested a public Casdoor demo fork at this\n[exact commit](https://github.com/niro-demos/casdoor/commit/0c7f4748f83ab07fdd74ccd2f79a90b1bf8073d7)\nand recorded 33 confirmed findings (9 critical, 12 high, and 12 medium), 3\ncoverage gaps, and 28 draft remediation PRs.\n\n- **[Read the full penetration-test report (PDF, 64\n  pages)](https://github.com/niro-demos/niro-configs/blob/0e2a5d498875e46c719a619e92693e57a72029e7/reports/casdoor.pdf)**\n- **[Inspect the exact GitHub Actions\n  run](https://github.com/niro-demos/casdoor/actions/runs/32054406790)**\n- **[Browse all 28 draft remediation\n  PRs](https://github.com/niro-demos/casdoor/pulls?q=is%3Apr+created%3A2026-08-17T08%3A52%3A00Z..2026-08-17T22%3A15%3A00Z)**\n\nThree representative fixes:\n\n- **Multi-step attack chain:** [Read and hijack another tenant's LDAP\n  configuration](https://github.com/niro-demos/casdoor/pull/247) — chains a\n  forged owner segment into cross-tenant configuration disclosure, then\n  overwrites the same record to redirect the victim's LDAP integration to\n  attacker-controlled infrastructure.\n- [Derive authorization from the resource actually being\n  accessed](https://github.com/niro-demos/casdoor/pull/245) — closes tenant\n  boundary bypasses caused by validating different identifiers from those the\n  controller used.\n- [Stop returning replayable session\n  credentials](https://github.com/niro-demos/casdoor/pull/271) — prevents an\n  organization administrator from replaying another user's live session ID.\n\n## Built for trust\n\nAI makes code faster to ship and harder to trust. Niro is built to earn that\ntrust back:\n\n- **Your environment, your provider.** Niro does not proxy model requests or\n  require uploading your repository, credentials, findings, or logs to a Niro\n  backend. See [Security and data](docs/security-and-data.md) for AI-provider\n  boundaries, telemetry, and opt-out controls.\n- **Host authority is explicit.** Local runs are interactive by default;\n  unattended execution requires `--autonomous` and the full host authority it\n  grants is documented in the [agent CLI threat\n  model](docs/agent-cli-security.md).\n- **You set the blast radius.** Attack tools run in a sandbox with kernel-level\n  egress control — they can reach *only* the targets you authorize in\n  `scope.yaml`, enforced at the network layer.\n- **Transparent coverage.** Niro reports what it *couldn't* reach on every run, so\n  coverage is never a black box — and it remembers intended behavior so it won't\n  keep flagging it. Strongest on the everyday exploitable class; novel,\n  multi-step business logic stays yours.\n\nNiro Enterprise is planned separately for organization-scale governance, audit,\ncompliance, deployment, and commercial support.\n\n## Docs\n\n- **[Get started](docs/getting-started.md)** — prerequisites, installation, and\n  your first run.\n- **[Prepare your app](docs/prepare-your-app.md)** — targets, scope, credentials,\n  fixtures, and test state.\n- **[Run Niro](docs/run-niro.md)** — find or fix, local or CI, whole-app or\n  focused.\n- **[Review the results](docs/review-results.md)** — findings, exploits,\n  validation evidence, and fix PRs.\n- **[Security and data](docs/security-and-data.md)** — data flow, AI providers,\n  sandboxing, egress, and telemetry.\n- **[Agent CLI security](docs/agent-cli-security.md)** — filesystem, command,\n  environment, egress, and prompt-injection boundaries for interactive and\n  autonomous execution.\n- **[Security policy](SECURITY.md)** — supported versions and private\n  vulnerability reporting.\n- **[Releases and verification](docs/releases-and-verification.md)** — support\n  lifecycle, version pinning, checksums, image digests, and release notes.\n- **[Coverage and limitations](docs/coverage-and-limitations.md)** — what Niro\n  tests, what it reports, and where humans remain responsible.\n- **[Reference](docs/cli-and-config-reference.md)** — commands, flags, and\n  configuration.\n- **[Troubleshooting](docs/troubleshooting.md)** — common failures, diagnostics,\n  and support artifacts.\n\n## Edition and license\n\nNiro Community Edition is free-of-charge, proprietary software distributed as a\nprebuilt binary. Source code is not provided, and \"Community Edition\" does not\nmean open source or source available. This public repository is the\ndocumentation and binary-distribution surface; it does not contain Niro product\nsource code.\n\nYou may install and use Niro, keep backup copies, and mirror the unmodified\nbinary inside your organization under the [Niro Community Edition License\nAgreement](LICENSE). Public redistribution, resale, modification, and reverse\nengineering are not permitted. Third-party components remain under their own\nlicenses; see [NOTICE](NOTICE).\n\n## Issues\n\n<https://github.com/apxlabs-ai/niro/issues>\n",
  "bytes": 9000,
  "sha": "56a22e4118a55ed66d6d964a9a3d7ab3c9ac69eaa86c27400fc40e647b205514",
  "repo_slug": "apxlabs-ai/niro",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_apxlabs_ai_niro_ddac025d/readme"
}