Tudor B.

AI Security Toolkit V4

30+ security tools,
one AI brain

Claude is the orchestrator. Semgrep, ZAP, Trivy, Nuclei, and 26 more tools are the sensors. 13 specialist agents coordinate them in a 7-phase pipeline, then cross-pollinate findings to build attack chains no single tool would catch.

Request Security Assessment

13 AI Agents

30+ Security Tools

7 Phase Pipeline

8 Security Pillars

ai-security-scan-v4

$ /ai-security-scan-v4 --repo github.com/client/webapp

[V4] Initializing 13 specialist agents...

[SURFACE] 23 endpoints, 4 auth flows, 2 file uploads

[SAST] Semgrep + Bearer: 3 findings in 847 files

[SCA] CVE-2024-3241 (jsonwebtoken 8.5.1) HIGH

[DAST] ZAP + Nuclei probing 23 endpoints...

[AGENT:auth-bypass] Session fixation in /api/oauth/call

[CHAIN] SCA CVE + DAST endpoint = token forge → admin

[AUDIT] Coverage map: 12 WSTG categories, 3 gaps flagged

[REPORT] 7 phases complete → 14 findings, 2 attack chains

Section 01

13 Specialist Agents

Each agent focuses on a specific attack class. They run in parallel, share findings, and build multi-step attack chains that individual tools would never detect.

CLAUDE

AuthZ

BaaS Posture

Chains

Coverage

Cross-Poll

DAST

Exploit

Feature Scan

Gap Filler

Mobile

Prompt Inj

Silent Fail

SOC2

AuthZ Specialist

IDOR, privilege escalation, multi-tenancy, and broken object-level authorization.

BaaS Posture

Read-only Supabase/PostgREST checks: anon-readable tables (RLS gaps), exposed RPCs, PII exposure.

Chain Constructor

Correlates single findings into multi-step exploitation paths.

Coverage Auditor

Audits the enumerated attack surface for untested endpoints, methods, and auth states.

Cross-Pollinator

Feeds one agent's findings to another so a single signal seeds a deeper probe.

DAST Orchestrator

Drives Nuclei, sqlmap, ffuf, and Wapiti against the running application.

Exploit Confirmer

Reproduces findings with concrete proof to eliminate false positives.

Feature Scan

Targeted DAST from a HAR or Postman capture of a specific user flow.

Gap Filler

Runs focused probes against the coverage gaps the auditor flags.

Mobile Security

APK and IPA analysis via MobSF for mobile app targets.

Prompt Injection

Tests LLM endpoints for jailbreaks, injection, and data exfiltration.

Silent Failure

Finds 200-OK-with-degraded-status responses and swallowed-error bugs.

SOC2 Compliance

Maps findings to Trust Service Criteria for SOC2 readiness gaps.

Section 02

What Makes This Different

Capability	Description	Example
SPEC-01 Cross-Pollination	When one agent finds something, it tells related agents to focus there. SCA finds vulnerable JWT library → DAST agent targets auth endpoints using that library.	SCA CVE → DAST focus
SPEC-02 Attack Chains	Individual findings are medium severity. Combined, they're critical. The toolkit links SCA + DAST + Auth findings into full exploitation paths. In the Gin & Juice benchmark it found 6 attack chains; Burp Pro found 0.	JWT vuln + /api/refresh → admin
SPEC-03 Coverage Audit	Every scan maps findings to OWASP Top 10 categories. If any category has zero coverage, gap-fill scans run before the final report.	Gap: SSRF → run nuclei ssrf
SPEC-04 Human Review	AI finds and correlates. Humans verify and prioritize. Every critical finding is manually validated before it appears in your report.	AI: 14 findings → Human: 9 valid

Section 03

7-Phase Pipeline

1

Surface

Map attack surface: endpoints, auth, uploads

2

Parallel

13 agents run concurrently

3

Cross-Pollinate

Share findings between agents

4

Chain

Build multi-step attack paths

5

Coverage

Check OWASP Top 10 coverage

6

Gap-Fill

Target zero-coverage areas

7

Report

Human-reviewed findings

Section 04