Write security tests as executable templates in 12 languages, run them against your targets, and keep evidence you can replay after every fix.
Most scanners ask you to describe a vulnerability in their own rule format. That works for a version banner or a single request. It falls short when the check has to hold a conversation with the target, speak a binary protocol or pick its next step from the last reply. Cert-X-Gen lets you write that check as a template, in YAML when it is simple and in Python, Go, Rust, C or another of its twelve languages when it needs real code. cxg runs it against your target and records a verdict for every run, with evidence behind every finding: confirmed redis-unauthenticated-python → 10.0.4.12 Fix the issue, replay the same template, and the verdict changes. And when the target is an app you build, cxg pentest goes further. An AI agent reads your source, writes the probes itself and runs them logged in as your users. Every check becomes a test you can run again after the next release.
Live from GitHub and crates.io, refreshed every hour. Each figure links to its source.
Cert-X-Gen ships two workflows in one binary. Template scans test infrastructure you point them at. The AI pentest starts from your source code and tests the app it builds.
cxg scanRun checks written as code against hosts, files of targets, CIDR ranges or URLs. Use the community template library or write your own in YAML or any of twelve languages.
You need: A target you are allowed to test.
$ cxg scan --scope 10.0.4.12 --templates redis*.pycxg pentestAn AI agent reads your source, writes a probe for each threat in your threat model and runs every probe logged in to your running app. Each threat ends confirmed, refuted or ambiguous.
You need: Your repository with a GuardLink threat model, and a running web or Electron app.
$ cxg pentest run --codebase ./repo --target https://staging.app --auth admin --ai --goal "test for IDOR"A scan picks templates by glob, tag or severity, runs them across a host, a file of targets, a CIDR range or a URL, and writes a report you can keep.
██████╗███████╗██████╗ ████████╗ ██╗ ██╗ ██████╗ ███████╗███╗ ██╗ ██╔════╝██╔════╝██╔══██╗╚══██╔══╝ ╚██╗██╔╝ ██╔════╝ ██╔════╝████╗ ██║ ██║ █████╗ ██████╔╝ ██║ █████╗ ╚███╔╝█████╗██║ ███╗█████╗ ██╔██╗ ██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚════╝ ██╔██╗╚════╝██║ ██║██╔══╝ ██║╚██╗██║ ╚██████╗███████╗██║ ██║ ██║ ██╔╝ ██╗ ╚██████╔╝███████╗██║ ╚████║ ╚═════╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═══╝
Example output: hosts, timings and findings are illustrative.
Templates and targets run in parallel, with rate limiting.
cxg template update pulls the library. Your own templates live in your own repository.
JSON, SARIF, HTML, CSV and Markdown, several at once if you like.
Exit codes and SARIF output, so a pipeline can fail on a finding.
A rule file can match a banner or a single response. Many real vulnerabilities need more than that. Cert-X-Gen runs the check as code, so it can do whatever the protocol demands.
A conversation with branches: EHLO, then MAIL FROM, then RCPT TO, each step decided by the last reply.
smtp-open-relay.pyThe PostgreSQL wire protocol and its MD5 challenge-response, spoken directly.
postgresql-default-credentials.goCalls snmpwalk, the tool you already trust, instead of re-implementing it.
snmp-default-community.shParses the binary RFB handshake byte by byte.
vnc-no-auth.c
Python
Go
Rust
C
C++
Java
JavaScript
Ruby
Perl
PHP
Shell
YAMLEvery template follows one contract: read the target from the environment, run the check, print JSON findings. See the template skeleton.
cxg ai generate writes a template from a prompt, in the language you pick, and validates it before saving. Ollama is the default and runs on your own machine with no API key.
Qwengpt-oss
Gemma
Llama
MistralDeepSeekPick any model your provider serves with --model.
cxg pentest runs the whole test by itself. Point it at a repository with a GuardLink threat model and a running copy of the app, give it a goal, and it reads the code, writes the probes, runs them as your real users and writes down what it proved.
Loads the threats GuardLink recorded in your code, from its SARIF export and the annotations themselves.
Scores every threat against the goal you give it in plain English and keeps the ones worth testing.
An AI coding agent opens your route handlers, validators and middleware, then writes a probe for that exact code.
Runs the probes in parallel browser sessions, one per user you captured, so an IDOR test runs as the low-privilege user.
Classifies every result as confirmed, refuted or ambiguous, and retries an ambiguous one with a new payload when the payload was the problem.
# Log in once, in a real browser cxg pentest auth --target https://app.example.com --profile admin # Rank the threats, write the probes, run them logged in cxg pentest run --codebase ./repo --target https://app.example.com \ --auth admin --ai --ai-provider claude \ --goal "test for IDOR in the records and transactions APIs"
Every finding carries the GuardLink threat it tested, so guardlink hypothesis confirm --from-scan report.json writes each result back next to the code it is about.
Capture a session by logging in yourself in a real browser. SSO, MFA, magic links and OAuth popups all work.
A scope file sets allowed methods and URLs, request budgets and a stop after repeated server errors. An unreadable scope file stops the run.
Replay a saved session without a browser. With --ci, an expired session fails the job, so it never probes logged out.
Tests web apps through Chromium and Electron apps over their own IPC channels.
Claude Code
Codex
Gemini CLI
Anthropic API
OpenAI APIThe Claude Code, Codex and Gemini CLIs need no API key.
cxg mcp serves twelve tools over the Model Context Protocol. One command finds the clients on your machine and configures them.
Claude Desktop
Claude Code
Cursor
Windsurf
VS Code with Copilot
Zed
Antigravity
Codex
Gemini CLI
Cline
Roo Code
Kiro
Goose
Amp
TraeFor these, add cxg mcp as a stdio server in the client's MCP settings.
cxg_scanRun security scans against targetscxg_ai_generateGenerate templates from natural languagecxg_searchSearch templates by query and filterscxg_template_listList available templatescxg_template_infoGet detailed template informationcxg_template_createScaffold a new templatecxg_template_writeValidate and save a templatecxg_template_testTest a template against a targetcxg_template_validateValidate template syntaxcxg_template_statsGet collection statisticscxg_template_updatePull latest templatescxg_template_get_notesGet AI generation guidecxg build compiles your target with sanitizers switched on, so a scan reports what actually broke inside it.
Builds a compiled target with sanitizer instrumentation, so a scan reports what the sanitizer saw instead of guessing from output. Point a scan at the build with the cli:// scope.
$ cxg scan --scope cli://$(cxg build --instrument --project . -q)Bravos, Bugb's whitebox pentesting product, drives two open-source tools we build. Point it at a repository and it writes a threat model into your code with GuardLink, attacks a running copy of your app through Cert-X-Gen with real logins, and ends every threat with a verdict and the reason for it.
GuardLink
Writes a threat model into your code: the assets, the threats each one is exposed to, and how data flows between them.
Cert-X-Gen
Attacks the running app. Bravos runs every probe through Cert-X-Gen, as the user each test calls for.
GuardLink
Confirmed findings become @confirmed annotations beside the vulnerable line, on a branch you can review or revert.
Every threat ends with one of four verdicts, each with its reason. A threat Bravos could not reach stays open instead of reading as clean.
Want to see the first half on your own code? Send a public GitHub repository and the Bugb team runs GuardLink on it, then emails you the threat model it finds. It is a starting threat model from reading the code, not a penetration test.
It costs nothing and takes one click, and for a project this size it does two useful things.
Install the CLI, pull the templates, then scan a target you are allowed to test. No configuration needed to start.
cargo install cert-x-genbrew tap bugb-technologies/cxg && brew install cxgcurl -fsSL https://raw.githubusercontent.com/Bugb-Technologies/cert-x-gen/main/install.sh | bashdocker run --rm ghcr.io/bugb-technologies/cert-x-gen:latest --help$ cxg template update && cxg scan --scope example.comTemplates install into ~/.cert-x-gen/templates/. Pass --scope a host, a file, a CIDR range or a URL.