HEXORA — Universal Security Engine

HEXORA is a new generation security engine that combines source code analysis with AI-driven adversarial verification to assist developers in discovering, assessing, and fixing security vulnerabilities in a single process.

While many tools focus on scanning and listing alerts, HEXORA follows the Detect → Verify → Fix process — from identifying issues to verifying results and supporting patch creation. The project aims to reduce noise in scan results, shorten assessment time, and integrate security directly into the software development process.

Key Features

• Real-Time File Watch: Monitors source code changes during development.
• Multi-Layer Scanning: Combines SAST, secret detection, SCA, and checks for unsafe configurations.
• Dual-Agent Adversarial Verification: Challenges and reevaluates findings to reduce false alerts.
• Automated PoC & Patch Generation: Supports creating non-intrusive PoCs and unified diff patches.
• AI Agent Integration: Provides 14 MCP tools along with agent skills to integrate security into AI coding agent workflows.
• Developer Workflow Integration: Supports CLI, VS Code, Git pre-commit hooks, and CI/CD.
• Threat Intelligence Learning: Ingests CVEs and security write-ups to expand detection knowledge.

Benchmark and Differentiators

In an internal benchmark released, HEXORA recorded 11/11 detection cases and 100% elimination of false alerts on the corresponding test set. This result is within the scope of that benchmark and does not guarantee accuracy across all projects.

HEXORA's advantage lies in its combination of deterministic analysis, adversarial verification, and remediation support, while also providing security functions through CLI, MCP, and CI/CD processes. Rather than just generating additional alerts, HEXORA aims to help developers and AI agents address security issues directly during the software building process.

Target Users: Programmers, AppSec engineers, cybersecurity researchers, and product development teams using AI coding agents.

Getting Started: Access the GitHub repository, prepare the Node.js environment according to the instructions, and run HEXORA from the terminal.

HEXORA — Detect. Verify. Fix. Security for the AI era.