Myrqen

Security testing that runs inside the coding agent you already use.

Static analysis finds the candidates. Your coding agent proves or disproves them against the application running on your machine.

No repository upload. No separate model API key. No invented certainty.

[!IMPORTANT] Myrqen is source-available, not open source.

The source is published because software that inspects your code should itself be inspectable. Copyright is retained and redistribution is not granted. See LICENSE for the plain-language terms and full legal text.

Why Myrqen?

Most security scanners have to choose between reading your code and exercising your application.

Myrqen deliberately does both — but gives each job to the part of the system that can actually measure it.

The result is a scanner that distinguishes between "this looks vulnerable" and "we observed this behaving vulnerably."

Quick start

Install the Agent Skill once:

npx myrqen link

Then, from any project:

myrqen auto

Want the entire scan to remain local?

myrqen auto --sync no

--sync no prevents report synchronization with the hosted dashboard. Without it, Myrqen asks whether the report should be synced and remembers that choice for that scan only.

[!NOTE] Myrqen uses the coding agent you are already running. There is no separate model API key to configure or pay for.

How it works

A Myrqen scan has two halves.

1. Myrqen finds candidates

The static pass belongs to Myrqen itself.

It parses TypeScript and JavaScript and follows attacker-controlled data through a function, including patterns that show up in real applications:

• destructured request reads;
• aliases and type assertions;
• values accumulated into arrays and later joined;
• data flowing into security-sensitive sinks.

When tainted input reaches a sink without an intervening protection, Myrqen records a candidate.

That pass runs whether or not an agent is involved, which means its behavior can be benchmarked and regression-tested independently.

2. Your agent settles the claim

Static analysis cannot observe a real HTTP response, browser state, authorization boundary, or runtime side effect.

So a candidate is not automatically promoted to a vulnerability.

The agent exercises the application running on your machine and records what actually happened:

Source code
    │
    ▼
┌──────────────────────┐
│  Myrqen static pass  │
└──────────┬───────────┘
           │
           ▼
      needs_review
           │
           ▼
┌──────────────────────┐
│  Coding agent tests  │
│  the local app       │
└───────┬────────┬─────┘
        │        │
   observed   not reproduced
        │        │
        ▼        ▼
     verify     refute
        │        │
        └───┬────┘
            ▼
          Report

myrqen finding verify attaches the evidence the agent observed and raises the finding to verified.

myrqen finding refute records that the agent could not reproduce the candidate. It stays in the record instead of silently disappearing, so the result can still be reviewed or disputed.

A candidate nobody exercises remains needs_review.

That state is intentional. The report should say what the scanner established — and what it did not.

What Myrqen will not do

It will not tell you that you are secure

Myrqen reports what it was able to establish and explicitly states what it could not reach.

A scanner finding nothing is not a clean bill of health.

It will not test systems you have not authorized

Anything outside your own machine requires explicit, exact authorization.

A grant for:

https://api.example.com

does not authorize:

http://api.example.com
https://example.com
https://api.example.com:8443

Scheme, origin, and port boundaries matter.

It will not perform destructive actions

Myrqen's policy refuses actions such as mass deletion, request flooding, credential spraying, persistence, exfiltration, and authorization-scope expansion.

A refusal is recorded rather than silently ignored.

It will not treat repository text as instructions

Source code, READMEs, comments, fixtures, issue text, and other repository content are data.

If repository content attempts to instruct the scanner to ignore its policies, that attempt is recorded as an observation instead of followed.

It will not print discovered secrets

Credentials are described by location and type, not by value.

Secret values are redacted before being stored anywhere, including locally.

Reproducible benchmarks

Detection claims are only as useful as the corpus behind them.

Myrqen publishes both the corpus and the scorer.

Run the full fixture benchmark:

pnpm benchmark

Or score the vulnerability corpus directly:

pnpm benchmark:corpus

The corpus covers application shapes built with Express, Fastify, Koa, Hono, node:http, Next.js route handlers, Next.js server actions, tRPC, GraphQL resolvers, and FastAPI.

Every vulnerable case has a corresponding safe near-miss: code with the same suspicious surface that performs the same job correctly, differing only in the security decision that matters.

That distinction is important.

A scanner that flags both the vulnerable and correct form of a pattern does not merely have false positives — it trains developers to stop trusting its output.

The corpus is designed to be difficult to game

• File, function, and variable names do not reveal the vulnerability being tested.
• Every case is scanned independently in a temporary directory.
• The engine sees a path it has not seen before.
• Matching is strict: class, route, and line must all be correct.
• A finding in the correct file but at the wrong location is still a miss.
• Cases written in languages the engine does not parse are reported separately and are never counted as recall failures.

Both benchmark commands report recall, precision, per-class results, and the safe-case false-positive rate.

They also exit non-zero when results fall below the release gates or regress against the committed baseline.

The latest passing baselines live in:

benchmark/corpus-baseline.json
benchmark/baseline.json

Run the benchmarks rather than trusting a performance number copied into a README.

Run from source

Development requires Node.js 22 or newer and pnpm.

pnpm install
pnpm build
node apps/cli/dist/myrqen.mjs --help

Run the built CLI against another project:

cd /path/to/your/project

node /path/to/myrqen/apps/cli/dist/myrqen.mjs auto --sync no

Repository structure

The Agent Skill

The portable source of truth lives in:

packages/skill/myrqen

It contains the SKILL.md plus refer