Mythos Agent MCP server

English · 简体中文

mythos-agent AI code-review assistant for application security. Open-source. Reads your code, flags likely security issues, explains its reasoning, suggests fixes.

mythos-agent.com

Quick Start • How It Works • Commands • Hunt Mode • Variant Analysis • Integrations • Contributing • Vision • Roadmap

mythos-agent reviews your code the way a reviewer on a security-focused team would. It walks through likely issue patterns, checks for variants of known CVEs, ranks findings by confidence, and suggests fixes you can accept or reject. See VISION.md for the full framing.

For new contributors: the active 6-month working plan is in the pinned issue [Roadmap] mythos-agent H1 2026 Goals. Look for 🙋 markers to spot items where help is wanted. New here? See CONTRIBUTING.md for good-first-issue guidance.

For security teams and EU CRA-compliant downstream manufacturers: see SECURITY.md for our vulnerability disclosure SLAs, docs/security/cra-stance.md for our EU CRA role declaration, docs/security/threat-model.md for our public threat model, and RELEASES.md for our versioning, LTS, and EOL policy. OpenSSF Best Practices Badge (Passing) submission targeted June 2026; releases are signed via Sigstore and ship with CycloneDX SBOMs for downstream Manufacturer compliance.

npx mythos-agent hunt

🔐 mythos-agent hunt — AI Code-Review Assistant

✔ Phase 1: Reconnaissance — 12 entry points, express, typescript, postgresql
✔ Phase 2: Hypothesis — 8 security hypotheses generated
✔ Phase 3: Analysis — 15 findings (semgrep, gitleaks, trivy, built-in), 22 false positives dismissed
✔ Phase 4: Reproduction — 2 finding chains, 3 reproductions

🧪 Security Hypotheses

  [HIGH] HYPO-001 — Race condition: concurrent payment requests could double-charge
    src/payments.ts:45 (race-condition)
  [HIGH] HYPO-002 — Auth bypass: JWT token not validated after password change
    src/auth.ts:78 (auth-bypass)

📊 Confidence Summary

Shortened. The full README is on GitHub.