Lorikeet Security

Lorikeet Security
_{Human first. AI-native. One platform for your whole security program.}

Website  ·  Lory  ·  Talon  ·  Docs  ·  Research  ·  LinkedIn  ·  X

We run human-led penetration tests and an autonomous AI pentester against the same scope, and every finding either agent produces is countersigned by a human before it reaches a client. This org is where the open-source half of that lives: the scanner your developers run locally, the cockpit they triage from, the agent you install inside your network, the labs we train on, and the tooling we build for our own engagements.

We test the way attackers think. Then we help you fix it.

Four surfaces, one AI pentester. Scan before you commit, triage findings from the terminal, install the agent so she can reach your internal network, or catch vulnerabilities in the editor.

The scanner and the cockpit are two halves of the same toolchain:

pip install lory-code-security-scanner
pip install "lory-code-security[tui]"

lory-scan sync        # scan this repo
lory tui --cached     # triage what it found

Browse all repositories →

python -m venv .venv && source .venv/bin/activate
pip install lorikeet-security-agent-exporter

lk-exporter validate --config config.yaml   # scope is an allowlist; nothing runs without it
lk-exporter run --agent-mode                # continuous collection + MCP, so Lory can drive it

Scope is enforced as a code-level gate ahead of every collector — an out-of-scope host is never contacted. Standalone mode needs no platform account at all: omit platform_url and findings print as newline-delimited JSON to stdout for your SIEM.

Agent docs · MCP server · API reference

Your security program shouldn't be locked behind our UI. Point Claude, Claude Code, or any MCP client at your own workspace:

{
  "mcpServers": {
    "lorikeet": {
      "type": "http",
      "url": "https://lorikeetsecurity.com/ptaas/mcp/",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Read access to findings, assets, compliance frameworks and control status, and the vulnerability knowledge base. One write action — request a retest. OAuth 2.1 with dynamic client registration, or a workspace API token. Every call is hard-scoped to the company that owns the credential. MCP documentation →

16 CVEs in FastNetMon Community Edition, responsibly disclosed by our research team and indexed by NVD, Snyk, SentinelOne, Ubuntu and Vulners.

Two rated 9.8 Critical — a stack buffer overflow in BGP NLRI parsing (CVE-2026-48686) and an off-by-one heap overflow in dynamic buffer handling (CVE-2026-48689) — alongside command injection in the Juniper and MikroTik plugins, an unauthenticated gRPC control API, NetFlow and BGP parser over-reads, a symlink arbitrary file write as root, and missing TLS certificate validation.

Read the full disclosure series → · White papers

Lory is our AI pentester, not a chatbot with a security theme. She takes a signed scope, runs a deterministic sweep, picks her own attack vectors, gives each one a focused pass with its own budget, validates and chains what she finds, and drafts the finding — then a Lorikeet pentester countersigns it before it ever reaches you.

• 57 attack playbooks, loaded one at a time — depth per vector instead of one giant prompt skimmed thin
• 1,969-entry knowledge base built from OWASP ASVS, WSTG and Top 10, plus MITRE CWE and CAPEC
• Nothing ships unreviewed. Findings sit in pending_review, invisible even to you, until a human approves them
• Every run reports its own gaps — vectors planned, vectors run, and vectors cut short by the depth ceiling, with the reason attached
• Prepaid credits, no seats. $1 = 1 credit; MCP tool calls cost 0.1 credit; engagements bill by depth

Meet Lory · How a run works · Coverage & gaps

Penetration testing and red team · Autonomous testing with Lory · Incident response and digital forensics · MDR and SOC-as-a-Service · SOC 2, ISO 27001, PCI DSS, HIPAA, CMMC · vCISO and VC due diligence

Everything runs through Talon — findings stream in as we test, with evidence, remediation and free retesting. Findings route into Jira, GitHub, GitLab, Azure DevOps, Slack, Teams, Discord or a signed webhook, so the work starts where your engineers already are. Every run publishes what it covered and what it didn't.

See an example report · Our methodology · Integrations · Knowledge base · Book a scoping call

Free, no sign-up: web security scanner · email security scanner · SSL checker · DNS lookup

Issues and pull requests are welcome on any repo here. Keep collectors and rules modular and scope-safe, and include tests where practical.

Found a vulnerability in something we ship? Report it to security@lorikeetsecurity.com — we respond within one business day and we credit researchers. See our Trust Center for scope and policy.

Everything in this org is for assessing systems you own or are explicitly authorized to test.