Indra

Website  · 
  Docs  · 
  Quick start  · 
  Install  · 
  Usage  · 
  Memory & console  · 
  PR review  · 
  CLI docs

indra is a multi-agent application-security review harness for Claude Code and other AI agents.
One request runs a team of specialist agents that map a codebase, hunt vulnerabilities with a
per-class knowledge base, chain findings into escalations, verify real impact, and report to
README, JSON, SARIF, HTML and PDF. Every run remembers what it learned, and the indra CLI gives you
a web console to launch agents and watch them work.

      A review team
      Recon, one hunter per vulnerability class in parallel, an exploit chainer, a verifier that refutes
      first, and a reporter. Each stage runs on the model its job needs.

      Memory that compounds
      indra mem keeps past findings, known guards and confirmed false positives as a graph of
      Markdown notes, and hands them to the next run's hunters.

      Watch it work
      indra serve shows every subagent, its tool calls, refused permissions and cost, live,
      on this machine or remote ones over SSH, and indra run orchestrates them.
Scope: indra performs static analysis (source review, data-flow tracing, PoC and payload
construction) on code you own or are authorized to test. It does not attack live third-party systems.

What's inside

Vulnerability classes covered (the sh-kb-* skills)

access-control (IDOR/BOLA/priv-esc) · sqli · xss · ssrf · injection (cmd/code/SSTI/LDAP) ·
auth (session/JWT) · deserialization · path-traversal (LFI/RFI) · secrets · csrf · xxe ·
open-redirect ·…