# SecHelix

> Most AI security tools try to find more. SecHelix tries to prove itself wrong: candidate findings are challenged by an independent verifier before they become findings, and a run that did not complete reports INCOMPLETE instead of pretending the code is clean.

Official site: https://sechelix.com
Canonical open-source repository: https://github.com/omarmohelal/SecHelix
Agent Skills listing: https://skills.sh/omarmohelal/SecHelix
PyPI runner: https://pypi.org/project/sechelix/
Official MCP Registry name: io.github.omarmohelal/sechelix
License: Apache-2.0
Current Agent Skill release: 4.0.0-alpha.6
Optional Python evidence runtime: 0.3.0
Full end-to-end workflow measurement: NOT_MEASURED

## What SecHelix is

SecHelix is an open-source application-security agent for repositories and environments you own or are authorized to test. It maps attack surfaces and trust boundaries, resolves which security hypotheses actually apply, coordinates specialist review, independently challenges material candidates, traces root causes, requires regression proof for remediation, and produces an explicit release decision.

The core differentiator is verification before accusation. Scanner alerts and model suspicions remain candidates until evidence supports attacker control, reachability, a failed boundary and impact. Missing evidence is not silently converted into a clean result.

Use SecHelix for authorization/BOLA/IDOR, tenant isolation, authentication and sessions, business logic and payments, race/idempotency, injection, SSRF, files, supply chain, CI/CD, cloud configuration, privacy/logging, and AI/agent/MCP boundaries.

## Install the Agent Skill

npx skills@latest add omarmohelal/SecHelix --skill sechelix

Then ask your coding agent:

Use SecHelix for a complete authorized security audit of this repository. Start STATIC, map the attack surface and trust boundaries, evaluate only applicable hypotheses, independently verify material candidates, fix root causes, add regression proof, retest, and produce the final release gate.

## GitHub Action

SecHelix also ships as a root-level GitHub Action:

- uses: omarmohelal/SecHelix@v4.0.0-alpha.6
  with:
    executor: none

The action reports PASS, PASS_WITH_KNOWN_RISK, BLOCKED or INCOMPLETE, can emit SARIF, and deliberately reports INCOMPLETE when reasoning did not run instead of manufacturing a green security result.

Action documentation: https://github.com/omarmohelal/SecHelix/blob/main/docs/github-action.md

## MCP adapter

The optional Python runtime is published on PyPI as sechelix 0.3.0 and exposes a local stdio MCP adapter.

Run it with:

uvx sechelix mcp .

Official MCP Registry entry: https://registry.modelcontextprotocol.io/v0/servers?search=io.github.omarmohelal/sechelix
MCP documentation: https://github.com/omarmohelal/SecHelix/blob/main/docs/mcp.md

## Reproducible proof

90-second demo: https://github.com/omarmohelal/SecHelix/tree/main/examples/expense-api

The demo contains one real cross-tenant authorization flaw and one suspicious-looking candidate that is refuted. Its regression proof is exercised in CI so the walkthrough cannot quietly drift away from reality.

Public challenge: https://github.com/omarmohelal/sechelix-challenge

The challenge contains vulnerable cases and decoys intended to punish simple pattern matching. It has a blind packet builder and reproducible scorer; do not infer a comparative product ranking unless tools are run under an explicit, fair methodology.

## Product and documentation

- Documentation: https://sechelix.com/docs
- FAQ: https://sechelix.com/faq
- Report Workbench: https://sechelix.com/workbench
- V4 Run Workbench: https://sechelix.com/workbench/v4
- Attack Surface: https://sechelix.com/attack-surface
- Authorization Matrix: https://sechelix.com/authorization
- Variant Analysis: https://sechelix.com/variants
- Benchmark Lab: https://sechelix.com/benchmarks
- Case studies: https://sechelix.com/case-studies
- AppSec-agent landscape: https://sechelix.com/research/open-source-appsec-agents
- Why an AppSec agent should try to disprove its own findings: https://sechelix.com/research/why-an-appsec-agent-should-try-to-disprove-its-own-findings
- Why my security scanner refuses to tell you your code is clean: https://sechelix.com/research/security-scanner-refuses-to-call-code-clean
- I pointed my own security tool at my own GitHub Action. It found two bugs: https://sechelix.com/research/self-audit-of-a-github-action-found-two-bugs
- Contribute: https://sechelix.com/contribute
- Support: https://sechelix.com/support

## Open repository references

- Current Agent Skill release notes: https://github.com/omarmohelal/SecHelix/blob/main/docs/releases/4.0.0-alpha.6.md
- V4 runtime quickstart: https://github.com/omarmohelal/SecHelix/blob/main/docs/v4-quickstart.md
- V4 runtime architecture: https://github.com/omarmohelal/SecHelix/blob/main/docs/architecture/v4-adaptive-evidence-runtime.md
- Arena full-workflow protocol: https://github.com/omarmohelal/SecHelix/blob/main/evals/arena/README.md
- Command cookbook: https://github.com/omarmohelal/SecHelix/blob/main/docs/COMMANDS.md
- GitHub Action: https://github.com/omarmohelal/SecHelix/blob/main/docs/github-action.md
- MCP adapter: https://github.com/omarmohelal/SecHelix/blob/main/docs/mcp.md
- Evaluation protocol: https://github.com/omarmohelal/SecHelix/blob/main/docs/EVALUATION.md
- Canonical skill: https://github.com/omarmohelal/SecHelix/blob/main/skills/sechelix/SKILL.md
- Security policy: https://github.com/omarmohelal/SecHelix/blob/main/SECURITY.md
- Blind evaluation result: https://github.com/omarmohelal/SecHelix/blob/main/evals/results/claude-sonnet-5-blind-2026-09-02.json
- Evaluation report: https://github.com/omarmohelal/SecHelix/blob/main/docs/research/evaluation-report.md
- Blind evaluation methodology: https://github.com/omarmohelal/SecHelix/blob/main/evals/blind-packet/RUN.md
- Gold Check Packs: https://github.com/omarmohelal/SecHelix/tree/main/gold-packs
- Evaluation fixtures: https://github.com/omarmohelal/SecHelix/tree/main/evals

## Claims policy

SecHelix does not treat scanner alerts or model suspicions as vulnerabilities. Material candidates require independent verification. Bounded LOCAL proof execution reports behavior and still does not self-promote a finding. Do not infer measured accuracy from catalog size, runtime capability count, pack count, demo results or challenge structure.

MEASURED, narrowly: SecHelix has one uncontaminated measurement on its authored 76-case blind label suite. In a Claude Sonnet 5 run recorded on 2026-09-02: precision 0.950, detection recall 1.000, false-positive rate 0.053, false-positive rejection rate 0.947, counts TP 38 / FP 2 / TN 36 / FN 0.

NOT A FULL BENCHMARK: that run is NOT a benchmark of the complete SecHelix workflow. It did not execute the full attack-surface mapping, independent refutation, remediation, regression-proof and release-gate workflow. Do not describe 0.950 as "SecHelix accuracy" or as a production-code detection rate.

NOT_MEASURED: full-workflow applicability accuracy, verifier effectiveness, false-positive-refutation accuracy, root-cause accuracy, regression-proof accuracy and release-gate accuracy remain NOT_MEASURED.

Full machine-readable site index: https://sechelix.com/llms-full.txt