Cortex is an AI application security analyst that scans your GitHub repository for security vulnerabilities, architecture issues, and code quality problems. It uses a 7-agent AI pipeline inspired by neuroscience to analyze your entire codebase in 2–5 minutes and generates a detailed security report with fix suggestions.

Is AI-generated code secure?

Studies show that 40–45% of AI-generated code contains at least one security vulnerability. AI coding tools like Cursor, GitHub Copilot, and ChatGPT generate code that often includes SQL injection, hardcoded API keys, insecure authentication, and XSS vulnerabilities. Cortex was built specifically to detect and fix these AI-generated code patterns.

How does Cortex scan my code?

Paste your GitHub repository URL into Cortex. Seven specialized AI agents run in sequence: (1) Git Connect clones the repo, (2) Reconnaissance maps the codebase, (3) Security Scanner finds vulnerabilities, (4) Architecture Analyzer reviews design patterns, (5) Code Quality Agent checks best practices, (6) Technical Debt Agent finds maintenance issues, (7) AI-Specific Agent detects AI-generated code patterns. The Orchestrator synthesizes all findings into a single scored report.

What security vulnerabilities does Cortex detect?

Cortex detects SQL injection, XSS (Cross-Site Scripting), CSRF, SSRF, hardcoded API keys and secrets, insecure authentication, weak encryption, path traversal, command injection, and more. All findings are mapped to OWASP Top 10 and CWE standards with exact file locations and fix suggestions.

How much does Cortex cost?

Cortex offers a free tier with 5 security scans per month. Paid plans start at $9/month (Starter, 25 scans) and $49/month (Team, 100 scans). Enterprise pricing is available for unlimited scans with custom integrations.

Does Cortex store my source code?

No. Cortex temporarily clones your repository to perform the security analysis, but does not permanently store your source code. Only the security report and findings are saved to your account. Your code is never used to train AI models.

How is Cortex different from Snyk or Checkmarx?

Snyk and Checkmarx are enterprise tools costing $500–$2,000/month, built for large security teams. Cortex is built for indie developers, startups, and teams shipping AI-generated code. Key differences: Cortex uses a 7-agent AI pipeline (not single-model scanning), includes an AI chat advisor that understands your codebase, detects AI-generated code patterns specifically, and starts free at $9/month.

What programming languages does Cortex support?

Cortex supports JavaScript, TypeScript, Python, Go, Java, Ruby, PHP, and more. It analyzes any GitHub repository regardless of language, detecting security vulnerabilities and code quality issues across the entire codebase.

Command Line Interface

Run audits local.
Zero Cloud Sync.

Analyze code from your own developer terminal. Run local vulnerability scanning, identify hardcoded API credentials, and verify code stability offline.

npm i -g @cortex-attack/cli

cortex-cli

$ npm i -g @cortex-attack/cli

added 142 packages, and audited 143 packages in 4s

✓ Installed cortex-cli successfully. Ready to run 'cortex --help'

Pre-commit Hooks

Connect the CLI to your local git hooks. Prevent commits containing high severity issues or exposed credentials from ever being registered.

Offline Credentials Hunt

Finds AWS secret keys, database logins, SSH certificates, and auth configuration tokens fully offline without exposing your keys to API routes.

Custom Profiles

Configure custom profiles to selectively target folders, ignore test suites, parse custom frameworks, or specify JSON summary report paths.

Start auditing locally today

Cortex CLI is open source and completely free to run on your local machines.

Run audits local.Zero Cloud Sync.

Pre-commit Hooks

Offline Credentials Hunt

Custom Profiles

Start auditing locally today

Run audits local.
Zero Cloud Sync.