Lorikeet Security

Lorikeet Security
_{Human first. AI-native. One platform for your whole security program.}

Website  ·  Lory  ·  Talon  ·  Docs  ·  Research  ·  LinkedIn  ·  X

We run human-led penetration tests and an autonomous AI pentester against the same scope, and every finding either agent produces is countersigned by a human before it reaches a client. This org is where the open-source half of that lives: the scanner your developers run locally, the cockpit they triage from, the agent you install inside your network, the labs we train on, and the tooling we build for our own engagements.

We test the way attackers think. Then we help you fix it.

Four surfaces, one AI pentester. Scan before you commit, triage findings from your terminal, run in-network posture sensors, or catch vulnerabilities in your editor.

# Install the Lory CLI
curl -fsSL https://lorikeetsecurity.com/install.sh | bash

# Or install via Go
go install github.com/Lorikeet-Security/lory-cli@latest

# Run reviews, target audits, or pre-commit diffs
lory review .         # review current directory for vulnerabilities
lory scan target.com  # audit security headers, SSL/TLS, and posture
lory diff             # inspect staged git changes before commit

Browse all repositories →

Your security program shouldn't be locked behind our UI. Point Claude, Claude Code, or any MCP client at your own workspace:

{
  "mcpServers": {
    "lorikeet": {
      "type": "http",
      "url": "https://lorikeetsecurity.com/ptaas/mcp/",
      "headers": { "Authorization": "Bearer <your-token>" }
    }
  }
}

Read access to findings, assets, compliance frameworks and control status, and the vulnerability knowledge base. One write action — request a retest. OAuth 2.1 with dynamic client registration, or a workspace API token. Every call is hard-scoped to the company that owns the credential. MCP documentation →

16 CVEs in FastNetMon Community Edition, responsibly disclosed by our research team and indexed by NVD, Snyk, SentinelOne, Ubuntu and Vulners.

Two rated 9.8 Critical — a stack buffer overflow in BGP NLRI parsing (CVE-2026-48686) and an off-by-one heap overflow in dynamic buffer handling (CVE-2026-48689) — alongside command injection in the Juniper and MikroTik plugins, an unauthenticated gRPC control API, NetFlow and BGP parser over-reads, a symlink arbitrary file write as root, and missing TLS certificate validation.

Read the full disclosure series → · White papers

Lory is our autonomous AI pentester, not a chatbot with a security theme. She takes a signed scope, runs a deterministic sweep, picks her own attack vectors, gives each one a focused pass with its own budget, validates and chains what she finds, and drafts the finding — then a Lorikeet penetration tester countersigns it before it ever reaches you.

• 104+ attack playbooks, loaded one at a time — depth per vector instead of one giant prompt skimmed thin
• 1,969-entry knowledge base built from OWASP ASVS, WSTG and Top 10, plus MITRE CWE and CAPEC
• Nothing ships unreviewed. Findings sit in pending_review, invisible even to you, until a certified human pentester approves and countersigns them
• Every run reports its own gaps — vectors planned, vectors run, and vectors cut short by the depth ceiling, with the reason attached
• Prepaid credits, no seats. $1 = 1 credit; MCP tool calls cost 0.1 credit; engagements bill by depth

Meet Lory · How a run works · Coverage & gaps

Penetration testing and red team · Autonomous testing with Lory · Incident response and digital forensics · MDR and SOC-as-a-Service · SOC 2, ISO 27001, PCI DSS, HIPAA, CMMC · vCISO and VC due diligence

Everything runs through Talon — findings stream in as we test, with evidence, remediation and free retesting. Findings route into Jira, GitHub, GitLab, Azure DevOps, Slack, Teams, Discord or a signed webhook, so the work starts where your engineers already are. Every run publishes what it covered and what it didn't.

See an example report · Our methodology · Integrations · Knowledge base · Book a scoping call

Free, no sign-up: web security scanner · email security scanner · SSL checker · DNS lookup

Demonstrate continuous security posture and verification on your code repositories. Showcase a verified badge directly in your project README or documentation:

Balanced 28px dual-plate badge with the Talon Claw shield on Navy and verified green plate for READMEs and docs:

[![Secured by Lorikeet Security](https://lorikeetsecurity.com/badges/lorikeet-secured-shield.svg?target=github.com/org/repo)](https://lorikeetsecurity.com/trust-center?target=github.com/org/repo)

Deep Canvas Navy with the official Talon PTaaS Shield & Claw and emerald verification chip:

[![Secured by Lorikeet Security](https://lorikeetsecurity.com/badges/lorikeet-secured-dark.svg?target=github.com/org/repo)](https://lorikeetsecurity.com/trust-center?target=github.com/org/repo)

lory badge github.com/your-org/your-repo

Visit https://lorikeetsecurity.com/trust-center for attestation verification.

Issues and pull requests are welcome on any repo here. Keep collectors and rules modular and scope-safe, and include tests where practical.

Found a vulnerability in something we ship? Report it to security@lorikeetsecurity.com — we respond within one business day and we credit researchers.

Everything in this org is for assessing systems you own or are explicitly authorized to test.