Application security for teams that ship fast
Hivexly attacks your running apps and scans your code for issues that are actually exploitable — every finding backed by evidence, every fix ready for you or your AI agent to apply.
Dynamic tests only run on targets you've verified you own.
Dashboard
23 open findings, 6 critical or high — every one backed by evidence.
23
−15 vs 30 days ago
6
Fix these first
5
4 ownership-verified
31
Resolved 41 findings
SQL injection in search parameter
Staging web · GET /search?q=
Private key committed to the repository
NodeGoat · artifacts/cert/server.key:1
IDOR exposes other tenants' invoices
Public API · GET /api/invoices/{id}
Prompt injection via retrieved document
Support assistant · POST /chat
Stored XSS in comment body
Portal · POST /projects/:id/comments
Two engines, one queue
Dynamic testing proves what an attacker can actually reach. Repository scanning catches what's hiding in source, dependencies and history. Both land in the same validated findings list.
Engine 01
Point Hivexly at a running web app or API you've verified you own. It probes within the scope you set and only reports what it can prove.
Engine 02
Connect a GitHub repository — or scan a public one — and Hivexly checks the code, its dependencies and its entire git history.
Features
A findings workflow built for teams who'd rather ship than triage: triage, resolve, dismiss, retest — and let rescans close what's already fixed.
A finding reaches you only when it's backed by a stored proof receipt, so your queue is signal, not noise.
Every finding is tagged to its OWASP category, with a coverage dashboard showing where you stand.
Keys and tokens are found in the current tree and in old commits — and redacted before they're stored.
Checks your dependency tree against the OSV database and flags packages known to be malicious.
Inline review comments, a required status to gate merges, and one-click pull requests that patch vulnerable dependencies.
An MCP server, a zero-dependency CLI, a GitHub Action and a REST API — so agents can scan, read fixes and check the gate.
Dynamic tests start only after DNS or well-known verification, within the hosts, rate cap and window you agree.
Multi-tenant organizations with role-based access, and an audit log of who did what.
Put scans on a schedule, auto-resolve what's fixed on rescan, and get email when something new appears.
How it works
Nothing gets tested until you've proven it's yours and agreed how hard to push.
Enter the URL of a running web app or API, connect a GitHub repository, or point Hivexly at a public repo.
Prove you own the target with a DNS record or a well-known file, then agree the allowed hosts, a rate cap and a testing window.
Run on demand or on a schedule. Hivexly attacks the app within scope and checks code, dependencies and history — surfacing only what it can prove.
Merge a one-click fix PR, gate merges on a required check, or let your AI agent read the fix instructions over MCP — then retest.
For developers and their agents
Hivexly speaks MCP, so Claude Code, Cursor and other agents can work your findings directly. Prefer scripts? Use the CLI, the GitHub Action or the public REST API.
Pull the validated findings for any repo or target.
Get remediation guidance the agent can apply straight to your code.
Kick off a scan after a change, then check the results.
Ask whether the merge gate passes before opening the PR.
terminal
claude mcp add --transport http hivexly \ https://app.hivexly.io/api/mcp \ --header "Authorization: Bearer $HIVEXLY_API_KEY"Adds Hivexly as a remote MCP server. Your agent can now list findings, read fixes and start scans.
OWASP Top 10 · 2025
Findings are mapped to the OWASP Top 10 (2025) as they're created, and the coverage dashboard shows open issues per category at a glance.
IDOR/BOLA across tenants, CSRF, SSRF
Dynamic
Exposed GraphQL, gRPC and API surface
DynamicRepository
Vulnerable dependencies (OSV), malicious packages
Repository
Weak JWT handling, secrets committed to code
DynamicRepository
SQL & NoSQL, XSS, SSTI, LFI, prompt injection
DynamicRepository
Business-logic flaws, race conditions, mass assignment
Dynamic
Session & JWT weaknesses, missing login rate-limits
Dynamic
Unverified token signatures, unsafe code patterns
DynamicRepository
Unthrottled brute-force attempts, sensitive data in logs
DynamicRepository
Leaky errors and stack traces, fail-open handling
DynamicRepository
Examples are representative, not exhaustive.
Pricing
Every plan includes validated-only findings and both scanning engines.
For individuals and open-source projects getting started.
Free forever
For teams shipping every day who want security in the loop.
Per month, billed monthly
Everything in Free, plus:
For organizations running security across many teams.
Per month, billed monthly
Everything in Pro, plus:
[placeholder] Prices, plan limits and feature allocation are pending final launch pricing.
FAQ
No. Dynamic testing works from the outside against your running app — you only need to prove you own it. Repository scanning is optional: connect a GitHub repo, or scan a public one, when you also want secrets, dependency and static-analysis coverage plus pull-request checks.
Hivexly only tests hosts you've verified you own, and only within the scope you agree: the allowed hosts, a request-rate cap and a testing window. Dynamic testing does send real attack payloads, so many teams start on staging and then schedule production scans inside a quiet window.
A code scanner reads source and guesses what might be exploitable. Hivexly does that too — and it also attacks the running app, which is how it finds broken access control, authentication weaknesses, business-logic flaws and race conditions that don't show up in code alone. Findings are only shown when there's stored evidence behind them.
No. For each repository scan, your code is cloned into a temporary workspace and deleted when the scan finishes. It's never used to train anything. When a secret is detected, it's redacted before the finding is stored.
Yes. Hivexly runs an MCP server, so agents like Claude Code and Cursor can list findings, read fix instructions, start scans and check the merge gate. There's also a zero-dependency CLI, a GitHub Action and a public REST API.
Verify a target or connect a repository and get validated findings from your first scan.