zoroo2626/crysa

Crysa is a command line tool built to catch security problems in code, but it takes a different approach than typical scanning tools. Rather than matching known bad patterns with regular expressions, it sends your code to a large language model and asks it to reason about the code the way a human bug bounty hunter would, thinking about what an attacker could actually do with it. The README explains that this matters because AI coding assistants can write functional code quickly while still missing subtle logic mistakes, such as forgetting to check whether a user actually owns the item they are updating, or accepting more fields in a request than the developer intended. These are the kinds of bugs a traditional pattern based scanner tends to miss, since they require understanding what the code is supposed to do rather than just its syntax. Before reviewing files, Crysa first builds an internal snapshot of the project, learning what web framework is used, how authentication works, what routes exist, and what user roles are defined, so its later reasoning about each file has real context. Installation is a simple pip install, with no Docker container or database required, and it can connect to any API service that follows the OpenAI request format. Once installed, a user can scan a whole folder or a single file, watch a folder continuously while an AI coding agent is actively writing code, or scan just the changes in a git diff before committing. Results can be shown directly in the terminal, saved as JSON, or exported in the SARIF format used by GitHub's code scanning feature, which makes it usable inside a continuous integration pipeline. There is also a mode that runs Crysa as an MCP server so AI coding tools like Claude Code or Cursor can call it directly, and a command that generates a detailed writeup and proof of concept for any single finding.