Niro MCP server

Niro Community Edition

Finds security bugs. Ships fixes.

Niro works like an autonomous, two-person team living in your repo — two roles with one goal: real security bugs, found and closed with proof.

Niro sets the stage first — it stands up your app (or points at a target you provide), seeds test state, and creates the users and data an attacker needs, so you skip most of the environment setup. Then the two-person team goes to work:

exploitable bugs and proves each with a working exploit. Never changes your code.

• The attacker agent hits your running app like a real adversary — finds

validation evidence — normally a regression test in the project's suite — so every PR arrives with evidence, not just a claim. Never merges — you do.

• The developer agent patches the bugs it can safely fix and records

Most security tools hand you a backlog of maybes and walk away. Niro doesn't stop at proven findings — in fix mode it turns each into a focused pull request. You review the diffs and decide what ships.

From a three-team relay to one run

Fixing a security bug is a relay across three teams — today's tools each cover one slice, so people stitch the rest together:

1. Set up the test environment — engineering.
2. Attack the app to find and exploit the bugs — security.
3. Triage and fix every finding — developers.

A program manager chases the handoffs, and it's never one clean pass. The pentester needs another test tenant, back to eng. A finding won't reproduce, it ping-pongs between security and dev. A fix ships, security has to re-test. Weeks pass, a dozen people touch it, and the code has already moved on.

Niro collapses that relay into one agent-driven run. Its attacker agent does the security team's job, its developer agent does the dev team's — and it automates the setup engineering used to own. You still set the scope, review the diffs, and decide what merges; Niro handles the back-and-forth in between — so three teams' effort lands in a few hours as review-ready pull requests, grouped by root cause so each is small enough to actually review.

Quickstart

From your project root, check the prerequisites, then install Niro and start a fix run:

curl -fsSL https://raw.githubusercontent.com/apxlabs-ai/niro/main/install.sh | sh
niro fix

niro fix opens the selected agent CLI interactively with Niro's first message already submitted. The agent CLI applies its own sandbox and approval policy; not every operation necessarily prompts. For an intentionally unattended run, --autonomous grants the agent CLI full current-user host access without approval prompts. Read the agent CLI privilege and threat model before using it. Niro opens review-ready fix PRs; you decide what to merge.

See Run Niro for report-only and scoped runs, supported agent CLIs, CI, and interactive developer agent workflows.

What a run actually does

Setup done, Niro works your running app the way a real attacker would — and doesn't stop until each bug is proven:

exploitable bugs.

1. Attack — probes your HTTP surfaces (web apps, APIs, MCP servers) for real,

blocks testing, Niro creates what it needs to keep going instead of silently skipping that part of the app.

1. Unblock — when a login, empty database, disabled feature, or missing tenant

a runnable proof. Doubt is demoted, never inflated.

1. Prove — every finding is a false alarm until Niro reproduces it and leaves

Shortened. The full README is on GitHub.