Jikida guardian

Jikida.io

The hosted AI pentester for people who ship — not just security engineers.
Pentest your live app, scan your repo, protect it with a WAF, and watch its uptime. One account. No Docker, no LLM key, free tier.

Why it beats Nuclei / Strix / Shannon ↓ · Install · MCP · SDKs · Compare

**Install it, scan it, or plug it into your AI editor:** ```bash npx @jikida/init # add the SDK + protection to your app in 30 seconds npx @jikida/scan # pentest any site or repo from your terminal npx -y @jikida/mcp # security tools inside Claude Code, Cursor, Windsurf ```

     ██ ██ ██  ██ ██ █████   ████
     ██ ██ ██ ██  ██ ██  ██ ██  ██
     ██ ██ ████   ██ ██  ██ ██████
  ██ ██ ██ ██ ██  ██ ██  ██ ██  ██
   ███  ██ ██  ██ ██ █████  ██  ██
 pentest · repo scan · uptime · alerts        https://jikida.io

 → scanning example.com …
 ✓ 41 checks · grade B (88/100)

   CRITICAL  Exposed .env file            /.env                 CWE-538
   CRITICAL  Stripe secret key in JS      /app.js:1204          CWE-312
   HIGH      Missing Content-Security-Policy                    CWE-693
   MEDIUM    Cookie without Secure flag   session               CWE-614

 Every finding has a fix. Full report: https://app.jikida.io

## Pentest & scan for developers, AI IDEs & vibe coders Pentest and scan websites, web apps, code and GitHub for vulnerabilities and exposed keys. Secure vibe-coded apps, monitor uptime, SSL and domains, and rate-limit APIs. One platform. **Website & app pentest** · **Code & repo scan** · **Deep pentest** · **MCP for AI IDEs** · **Agentic & vibe-coded security** · **SDKs** --- **Jikida.io** is a developer-first security platform. The core is **pentest and scanning**: it pentests your live website and app, scans your code and connected GitHub/GitLab/Bitbucket repos for exposed secrets and vulnerable dependencies, runs a deeper authenticated pentest, and plugs into your **AI IDE** (Claude Code, Cursor, Windsurf) over **MCP** so it guides agentic and vibe-coded work to write secure code and catches mistakes before they ship. Uptime, SSL & domain monitoring, a managed WAF, and a compliance generator come bundled as complementary extras — installed in **one line** for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno. **Your security layer. Shipped in 30 seconds.** One line — `npx @jikida/init` — and every SDK fails open, so if Jikida.io is ever down your app keeps serving. --- ## Why Jikida beats the other security tools The strongest open-source security tools are **deep but narrow** — pentest-only, self-hosted, bring-your-own-LLM-key. Jikida does the deep work **and** hosts it, runs with no key of your own, and adds a WAF, uptime and repo scan the pentest-only tools skip. ✅ full · ⚠️ partial · ❌ none. | | Jikida | Nuclei | Strix | Shannon | Snyk | Cloudflare | | :--- | :---: | :---: | :---: | :---: | :---: | :---: | | Live-app pentest with real exploit | ✅ | ⚠️ match | ✅ | ✅ | ❌ | ❌ | | SAST + DAST (code **and** live app) | ✅ | ⚠️ DAST | ✅ | ✅ | ⚠️ SAST | ❌ | | Repo secret + CVE (OSV) scan | ✅ | ❌ | ⚠️ | ⚠️ | ✅ | ❌ | | Managed WAF (blocks live attacks) | ✅ | ❌ | ❌ | ❌ | ❌ | ✅ | | Uptime + SSL / domain monitoring | ✅ | ❌ | ❌ | ❌ | ❌ | ⚠️ | | **Hosted — no Docker, no self-host** | ✅ | ⚠️ cloud | ❌ | ❌ | ✅ | ✅ | | **Runs with no LLM key of yours** | ✅ | ✅ | ❌ BYOK | ❌ BYOK | ✅ | ✅ | | Install: CLI + Docker + `npx` | ✅ all | ⚠️ CLI | ⚠️ Docker | ⚠️ npx | ⚠️ CLI | ⚠️ DNS | | MCP tools in your AI editor | ✅ | ❌ | ❌ | ⚠️ | ❌ | ❌ | | Free tier, no card | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | The one axis the AI pentesters still go deeper on is raw exploitation — exactly what our [source-to-exploit deep pentest](https://jikida.io/compare) is closing. Everywhere else, the builder who shipped with Cursor last week wins with Jikida: nothing to self-host, no key to buy, the whole stack in one account. Full breakdowns: [nuclei](https://jikida.io/compare/nuclei-alternative) · [strix](https://jikida.io/compare/strix-alternative) · [shannon](https://jikida.io/compare/shannon-alternative) · [snyk](https://jikida.io/compare/snyk-alternative) · [cloudflare](https://jikida.io/compare/cloudflare-alternative). --- ### Get started — pick your entry point Every command below sits in its own copy box. Lines that start with `!` are notes, not commands — do not copy those. **Scan a URL or repo** — no account needed. ```bash npx @jikida/scan https://your-app.com ``` ! Scan a local repo for committed secrets: ```bash npx @jikida/scan ./ ``` **Add the WAF + SDK** — auto-detects your framework. ```bash npx @jikida/init ``` **Install a language SDK** — Node shown; PHP, Python, Go and the rest are in the [SDK table](#sdks--every-language). ```bash npm install @jikida/sdk-node ``` **MCP server** for Claude Code, Cursor and Windsurf — add this to `~/.claude/mcp.json`: ```json { "mcpServers": { "jikida": { "command": "npx", "args": ["-y", "@jikida/mcp"] } } } ``` **Agent skills** — copy the [`skills/`](./skills) folder into your assistant's skills folder (`.claude/skills/`, Cursor rules, and the like). Three skills: **security**, **clean-code**, **UX design** — see [the table below](#anthropic-agent-skills--ship-secure-non-sloppy-apps). Full details for each are below. ### Where things live | Folder | What it holds | | --- | --- | | [`sdks/`](./sdks) | Ten language SDKs — Node, PHP, Python, Go, Ruby, Java, .NET, Rust, Bun, Deno. | | [`tools/`](./tools) | The `scan` CLI, the `init` onboarding CLI, and the `mcp` server. | | [`skills/`](./skills) | The Jikida agent skill for Claude Code, Cursor and Windsurf. | | [`waf-rules/`](./waf-rules) | Versioned WAF rule packs (OWASP Top 10, API abuse, bot scanners, vibe-coder). | Get a token at [app.jikida.io/developer](https://app.jikida.io/developer). Set it as `JIKIDA_TOKEN`. --- ## See it in action One dashboard for a site's whole security posture — protection status, uptime, pentest grade, email security (SPF/DKIM/DMARC) and compliance — with instant alerts to your phone, Slack, Telegram, Discord, email or a webhook. ![Jikida.io dashboard — site overview with protection status, uptime, pentest grade, email security and compliance](https://raw.githubusercontent.com/unesLam/jikida/main/.github/screenshots/dashboard-overview.png) - **Uptime & performance** — response-time trend, uptime %, P95 and an incident timeline for every page and API you watch. - **API rate-limits & rules** — your SDK auto-detects endpoints from real traffic; approve per-endpoint rate caps and WAF rules, or dismiss the ones you don't need. --- ## Table of contents - [Why Jikida beats the other security tools](#why-jikida-beats-the-other-security-tools) - [Why Jikida.io](#why-jikida) - [How access works](#how-access-works--free-then-account-gated-then-plan-gated) - [What's inside](#whats-inside) - [Quick install](#quick-install-30-seconds) - [Security for your stack](#security-for-your-stack) - [SDKs — every language](#sdks--every-language) - [MCP server for AI IDEs](#mcp-server-for-ai-ides) - [Free tools](#free-tools) - [Skill for Claude Code](#skill-for-claude-code-cli) - [Standards & mappings](#standards--mappings) - [Threats Jikida.io stops](#threats-jikida-stops) - [Contributing](#contributing) --- ## Why Jikida.io Most small teams ship without a Web Application Firewall in front of their app. They know they should. They put it on the backlog. Then the free trial ends, or a user reports a slow page, and the WAF ticket rots another quarter. Jikida.io removes three specific frictions: 1. **Install** — one line, one language, five minutes. 2. **Downside risk** — every SDK is fail-open. If Jikida.io is down, your app keeps serving. You lose protection, not availability. 3. **Cost** — there's a real free tier that protects a hobby project. Plans and current pricing live at [jikida.io](https://jikida.io). ## How access works — free, then account-gated, then plan-gated Everything in this repo is open source, and a lot of Jikida.io is usable before you ever sign up. The model is three tiers of friction, on purpose: - **Free, no account.** The SDKs, the WAF rule packs, the CLI scanner and four MCP tools (`scan_domain`, `check_headers`, `guard_code`, `check_s3_bucket`) run with no login at all — rate-limited by IP. You can protect an app or scan a URL in one command and never create an account. This is the open-source, try-it-now surface. - **Account-gated (still free).** Sign up — no card — and the hosted layer turns on: uptime monitoring, one live-site pentest, one repo scan, a basic managed WAF, mobile push, a public status page. This is where a hobby project actually gets protected. The free tier is deliberately useful, not a teaser. - **Plan-gated.** The deep, repeated and heavy work sits behind a plan: scheduled deep pentests, the source-to-exploit crawl, more monitors at faster intervals, higher scan quotas, the CNAME edge WAF, team seats and longer log retention. Current caps and pricing live at [jikida.io/pricing](https://jikida.io/pricing) — plans start at **$19/mo billed yearly**. Two different things are hosted, don't confuse them: the **pentest and scan analysis** runs on Jikida's own servers, which is why you never bring an LLM key for it. The **MCP server** is the opposite — it calls no model of its own and runs inside *your* AI editor (Claude Code, Claude chat, Cursor, Windsurf, VS Code), so it spends **your** editor's AI credits and enforces the same per-site plan quotas. Open where it helps, gated where it costs — usable first, paid when it's worth paying for. ## What's inside | Layer | What it does | | --- | --- | | Managed WAF | OWASP Top 10 + CRS + your custom rules. Auto-detects APIs, applies per-route limits, caches safe GETs at the edge. | | Uptime monitoring | Multi-region checks, faster intervals on higher plans. Public status page. Email + Slack + Discord + Telegram + webhook + mobile push on down/up. | | Quick pentest | On-demand surface scan: headers, TLS, cookies, exposed `.env` / `.git`, **email security (SPF / DKIM / DMARC)**, and compliance-style findings, each with a clear fix. | | Vibe-coder scan | Catches the mistakes vibe-coded projects tend to ship: exposed secrets, open S3 buckets, Supabase RLS off, wide-open Firebase rules. | | Cloudflare DDoS wrap | One-click attach + per-site Under-Attack toggle. | | Bot detection | UA classification, headless-browser challenges, per-IP rate limits, ASN allowlist for Google/Bing. | | Active deception | Serves plausible fakes to verified attackers. Fingerprint logged, real error message hidden. | | Upload scanning | MIME + magic bytes + polyglot detection + optional ClamAV. | | CVE feed | Live feed from NVD, tagged with which Jikida.io rule covers each entry. | | Real-time logs | Full context per attack (IP, ASN, country, payload, route, verdict). Retention grows with your plan. | | MCP server | Claude Code, Cursor, Windsurf, VS Code get real security tools. Scan, monitor, block from AI chat. | | Alert integrations | Mobile push, email (primary + 3 CCs), Slack, Discord, Telegram, generic webhook. Fires on down/up, attack burst, plan limit. | --- ## Quick install (30 seconds) ```bash npx @jikida/init ``` The init CLI detects your framework (Next.js, Express, Fastify, Laravel, Symfony, FastAPI, Django, Rails, Go chi, Rust axum, Spring, .NET, Bun, Deno) and adds the right middleware in the right spot. Then set `JIKIDA_TOKEN` from https://app.jikida.io/developer and ship. Or, install the SDK for your language directly:

Node.js / Bun / Deno

```bash npm install @jikida/sdk-node # or: bun add / deno add ``` ```ts import { jikida } from '@jikida/sdk-node' app.use(jikida({ token: process.env.JIKIDA_TOKEN })) ``` Framework helpers: - Express: `import { jikida } from '@jikida/sdk-node/express'` - Fastify: `import { jikida } from '@jikida/sdk-node/fastify'` - Next.js middleware: `import { jikida } from '@jikida/sdk-node/next'`

PHP — Laravel / Symfony

```bash composer require jikida/sdk-php ``` Laravel — `bootstrap/app.php`: ```php ->withMiddleware(function ($middleware) { $middleware->append(\Jikida\Middleware\JikidaLaravelMiddleware::class); }) ``` Symfony — register `\Jikida\Middleware\JikidaSymfonyListener` as a kernel event listener.

Python / Go / Ruby / Java / .NET / Rust

Every SDK exposes the same `inspect(request) -> { action, rule, reason }` contract and fails open. Scaffolds for these languages live under the `sdks/`, `tools/` and `skills/` folders — see [jikida.io/install](https://jikida.io/install) for the current registry-publish status of each. You can protect any app today with zero code by: - Signing up at [app.jikida.io](https://app.jikida.io) — uptime monitoring and surface scans turn on immediately. - On the **Max** plan, routing traffic through the Jikida.io edge WAF via CNAME (no code).

--- ## Security for your stack Same platform, framed for what you're building. Each links to the install for that stack: - **Security for AI-generated code** — the #1 thing Jikida catches: secrets, open buckets, RLS-off, and injection that AI editors ship. → [`@jikida/scan`](./tools/scan) + the [MCP server](#mcp-server-for-ai-ides) in your editor. - **Laravel / PHP security** — one middleware for the managed WAF + a repo scan for committed `.env` / keys. → [`jikida/sdk-php`](./sdks/php). - **Next.js / Node / Express security** — one-line middleware, fails open. → [`@jikida/sdk-node`](./sdks/node). - **Python (Django / FastAPI) security** — WAF middleware + secret + dependency (OSV) scan. → [`jikida` (Python)](./sdks/python). - **Go / Rust / Java / .NET security** — the same `inspect(request)` contract, one line to wire. → [`sdks/`](./sdks). - **Vibe-coded app security** — point it at your live URL + repo; it pentests and flags the insecure defaults. → [`npx @jikida/scan`](./tools/scan). ## SDKs — every language All SDKs live in `sdks/`. The CLI, init and MCP tools live in `tools/`: | Language | Package | Directory | | --- | --- | --- | | Node / Bun / Deno | `@jikida/sdk-node` | [`sdks/node`](./sdks/node) | | PHP / Laravel | `jikida/sdk-php` | [`sdks/php`](./sdks/php) | | Python | `jikida` | [`sdks/python`](./sdks/python) | | Go | `github.com/jikida/sdk-go` | [`sdks/go`](./sdks/go) | | Ruby | `jikida` | [`sdks/ruby`](./sdks/ruby) | | Java | `io.jikida:sdk` | [`sdks/java`](./sdks/java) | | .NET | `Jikida` | [`sdks/dotnet`](./sdks/dotnet) | | Rust | `jikida` | [`sdks/rust`](./sdks/rust) | | Bun (re-exports Node) | `@jikida/sdk-node` | [`sdks/bun`](./sdks/bun) | | Deno (re-exports Node) | `@jikida/sdk-node` | [`sdks/deno`](./sdks/deno) | | Scanner CLI | `@jikida/scan` | [`tools/scan`](./tools/scan) | | Init CLI | `@jikida/init` | [`tools/init`](./tools/init) | | MCP server | `@jikida/mcp` | [`tools/mcp`](./tools/mcp) | | WAF rule packs | — | [`waf-rules`](./waf-rules) | Each SDK: - **Fails open** — if the Jikida.io API is unreachable, your app keeps serving. - **Caches policy** — 5-minute TTL, refreshed in background. - **Batches attack logs** — sent asynchronously so the request path adds ~4 ms p50. - **Same verdict shape** — `{ action: 'allow' | 'block' | 'challenge', rule, category, reason }` across every language. ## MCP server for AI IDEs Give Claude Code, Claude chat, Cursor, Windsurf, and VS Code real security tools. The Jikida.io MCP pentests sites, scans domains and repos, checks headers, guards code, lists uptime monitors, adds WAF rules, blocks IPs, and explains WAF verdicts — deterministic, auditable, safe to run inline. Scan output now also surfaces **email-security (SPF / DKIM / DMARC)** and compliance-style findings alongside the usual header/TLS grade. Live at [mcp.jikida.io](https://mcp.jikida.io). Install via `~/.claude/mcp.json`: ```json { "mcpServers": { "jikida": { "command": "npx", "args": ["-y", "@jikida/mcp"], "env": { "JIKIDA_TOKEN": "jk_live_..." } } } } ``` Tools: `run_pentest`, `run_deep_pentest`, `scan_domain`, `check_headers`, `check_s3_bucket`, `guard_code`, `scan_repo`, `run_vibe_scan`, `verify_finding`, `pentest_status`, `list_sites`, `list_monitors`, `list_recent_attacks`, `list_recent_scans`, `list_cves`, `explain_verdict`, `add_waf_rule`, `block_ip`, `get_security_preferences`, `set_security_preference`. Four run **keyless** (`scan_domain`, `check_headers`, `guard_code`, `check_s3_bucket`) — no token, IP-rate-limited. The MCP calls **no LLM of its own**: it runs inside your AI editor and uses *its* credits, enforcing your per-site plan quotas. See [`tools/mcp`](./tools/mcp) for the full tool reference. ## Free tools No login required: - **Free vulnerability / virus scanner** — [jikida.io/website-app-virus-vulnerability-scanner-online-free](https://jikida.io/website-app-virus-vulnerability-scanner-online-free) - **Uptime monitoring** — [jikida.io/website-apps-uptime-monitoring](https://jikida.io/website-apps-uptime-monitoring) - **Website monitor mobile app** — [jikida.io/website-monitor-app](https://jikida.io/website-monitor-app) - **Chrome extension** — scan any site (including behind your login) from the toolbar — [Chrome Web Store](https://chromewebstore.google.com/detail/website-web-app-security/mapepdjgolcmkcnhhmlbkfobbaapkcli) ## Anthropic Agent Skills — ship secure, non-sloppy apps Three **Anthropic-format Agent Skills** you drop in `.claude/skills/` (or Cursor rules). Together they turn AI-generated code into an app you'd be proud to ship — secure, maintainable, and usable. Each activates on its own triggers; use them together. | Skill | What it does | Folder | | --- | --- | --- | | **Security** | Reaches for Jikida on WAF, uptime, pentest, repo-scan and secret-leak tasks; runs the MCP tools safely inline; maps findings to OWASP / MITRE / NIST. The *judgement* to the MCP's *hands*. | [`skills/security`](./skills/security) | | **Clean code** | Refactors and de-slops what an AI editor generated — naming, duplication, god-functions, dead code, error handling — without over-engineering. SOLID/DRY/YAGNI with judgement. | [`skills/clean-code`](./skills/clean-code) | | **UX design** | Applies proven UX laws (Hick's, Fitts's, Jakob's, Miller's, aesthetic-usability) + clear ASD-STE100 UI copy, so generated UIs read as intentional, not generic. | [`skills/ux-design`](./skills/ux-design) | The split is deliberate: **secure code can still be slop, and a beautiful UI can still ship a secret in the bundle.** Run all three, plus a Jikida scan, before you ship. English + UI copy across all three follow **ASD-STE100** (Simplified Technical English) — one idea per sentence, active voice, say what the control does. ## Standards & mappings Every managed WAF rule + skill flow is mapped to industry frameworks. Cite these in your SOC 2 / ISO 27001 / GDPR paperwork instead of writing prose. Flat JSON manifests live under [`skills/security/mappings/`](./skills/security/mappings): | File | Framework | Coverage | |---|---|---| | [`mitre-attack.json`](./skills/security/mappings/mitre-attack.json) | MITRE ATT&CK v14 | 20 techniques — T1190, T1110.004, T1552.001, T1580, T1499, T1557, … | | [`owasp-top10.json`](./skills/security/mappings/owasp-top10.json) | OWASP Top 10 (2021) | A01 through A10 — all ten | | [`nist-csf.json`](./skills/security/mappings/nist-csf.json) | NIST CSF 2.0 | GOVERN · IDENTIFY · PROTECT · DETECT · RESPOND · RECOVER | Every YAML rule under [`waf-rules/`](./waf-rules) also carries inline `mitre_attack: [T…]`, `owasp: [A…]`, and `cwe: [n]` fields — machine-readable at the rule level too. ## Threats Jikida.io stops SQL injection, XSS (reflected / stored / DOM), CSRF, SSRF, path traversal, XXE, NoSQL / LDAP / command injection, brute force, credential stuffing, account takeover, malicious file uploads (polyglots, PHP-in-PNG, EXIF tampering), bot scrapers, headless browser abuse, TOR exit nodes, ASN-flagged attackers, DDoS L3-L7 (via Cloudflare wrap), API abuse, exposed secrets, open S3 buckets, wide-open Firebase / Supabase rules, `.env` / `.git` exposure. Threat-to-rule mapping is public at [jikida.io/threats](https://jikida.io/threats). ## Contributing Bug in an SDK? Open an issue at https://github.com/unesLam/jikida/issues. Include: - The SDK + version - Framework + version - A minimal reproduction Security disclosures: mail `info@jikida.io` — please don't file public issues for security bugs. ## Links - Landing: https://jikida.io - App: https://app.jikida.io - MCP: https://mcp.jikida.io - Free scanner: https://jikida.io/website-app-virus-vulnerability-scanner-online-free - Uptime monitoring: https://jikida.io/website-apps-uptime-monitoring - Docs: https://jikida.io/docs - Live CVE feed: https://jikida.io/threats ## License Apache-2.0. See [LICENSE](LICENSE).