Jikida.io

The hosted AI pentester for people who ship — not just security engineers.
Pentest your live app, scan your repo, protect it with a WAF, and watch its uptime. One account. No Docker, no LLM key, free tier.

Why it beats Nuclei / Strix / Shannon ↓ · Install · MCP · SDKs · Compare

Install it, scan it, or plug it into your AI editor:

npx @jikida/init      # add the SDK + protection to your app in 30 seconds
npx @jikida/scan      # pentest any site or repo from your terminal
npx -y @jikida/mcp    # security tools inside Claude Code, Cursor, Windsurf

[object Object],
 pentest · repo scan · uptime · alerts        https://jikida.io

 → scanning example.com …
 ✓ 41 checks · grade B (88/100)

   CRITICAL  Exposed .env file            /.env                 CWE-538
   CRITICAL  Stripe secret key in JS      /app.js:1204          CWE-312
   HIGH      Missing Content-Security-Policy                    CWE-693
   MEDIUM    Cookie without Secure flag   session               CWE-614

 Every finding has a fix. Full report: https://app.jikida.io

Pentest & scan for developers, AI IDEs & vibe coders

Pentest and scan websites, web apps, code and GitHub for vulnerabilities and exposed keys. Secure vibe-coded apps, monitor uptime, SSL and domains, and rate-limit APIs. One platform.

Website & app pentest · Code & repo scan · Deep pentest · MCP for AI IDEs · Agentic & vibe-coded security · SDKs

Jikida.io is a developer-first security platform. The core is pentest and scanning: it pentests your live website and app, scans your code and connected GitHub/GitLab/Bitbucket repos for exposed secrets and vulnerable dependencies, runs a deeper authenticated pentest, and plugs into your AI IDE (Claude Code, Cursor, Windsurf) over MCP so it guides agentic and vibe-coded work to write secure code and catches mistakes before they ship. Uptime, SSL & domain monitoring, a managed WAF, and a compliance generator come bundled as complementary extras — installed in one line for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno.

Your security layer. Shipped in 30 seconds. One line — npx @jikida/init — and every SDK fails open, so if Jikida.io is ever down your app keeps serving.

Why Jikida beats the other security tools

The strongest open-source security tools are deep but narrow — pentest-only, self-hosted, bring-your-own-LLM-key. Jikida does the deep work and hosts it, runs with no key of your own, and adds a WAF, uptime and repo scan the pentest-only tools skip. ✅ full · ⚠️ partial · ❌ none.

The one axis the AI pentesters still go deeper on is raw exploitation — exactly what our source-to-exploit deep pentest is closing. Everywhere else, the builder who shipped with Cursor last week wins with Jikida: nothing to self-host, no key to buy, the whole stack in one account. Full breakdowns: nuclei · strix · shannon · snyk · cloudflare.

Get started — pick your entry point

Every command below sits in its own copy box. Lines that start with ! are notes, not commands — do not copy those.

Scan a URL or repo — no account needed.

npx @jikida/scan https://your-app.com

! Scan a local repo for committed secrets:

npx @jikida/scan ./

Add the WAF + SDK — auto-detects your framework.

npx @jikida/init

Install a language SDK — Node shown; PHP, Python, Go and the rest are in the SDK table.

npm install @jikida/sdk-node

MCP server for Claude Code, Cursor and Windsurf — add this to ~/.claude/mcp.json:

{ "mcpServers": { "jikida": { "command": "npx", "args": ["-y", "@jikida/mcp"] } } }

Agent skills — copy the skills/ folder into your assistant's skills folder (.claude/skills/, Cursor rules, and the like). Three skills: security, clean-code, UX design — see the table below.

Full details for each are below.

Where things live

Get a token at app.jikida.io/developer. Set it as JIKIDA_TOKEN.

See it in action

One dashboard for a site's whole security posture — protection status, uptime, pentest grade, email security (SPF/DKIM/DMARC) and compliance — with instant alerts to your phone, Slack, Telegram, Discord, email or a webhook.

• Uptime & performance — response-time trend, uptime %, P95 and an incident timeline for every page and API you watch.
• API rate-limits & rules — your SDK auto-detects endpoints from real traffic; approve per-endpoint rate caps and WAF rules, or dismiss the ones you don't need.

Table of contents

• Why Jikida beats the other security tools
• Why Jikida.io
• How access works
• What's inside
• Quick install
• Security for your stack
• SDKs — every language
• MCP server for AI IDEs
• Free tools
• Skill for Claude Code
• Standards & mappings
• Threats Jikida.io stops
• Contributing

Why Jikida.io

Most small teams ship without a Web Application Firewall in front of their app. They know they should. They put it on the backlog. Then the free trial ends, or a user reports a slow page, and the WAF ticket rots another quarter.

Jikida.io removes three specific frictions:

1. Install — one line, one language, five minutes.
2. Downside risk — every SDK is fail-open. If Jikida.io is down, your app keeps serving. You lose protection, not availability.
3. Cost — there's a real free tier that protects a hobby project. Plans and current pricing live at jikida.io.

How access works — free, then account-gated, then plan-gated

Everything in this repo is open source, and a lot of Jikida.io is usable before you ever sign up. The model is three tiers of friction, on purpose: