New · a version tag publishes a signed wheel and the container image

Your AI agent is your newest attack surface.

Test your AI app and the API behind it. Review findings, trace the evidence, and check your fixes before you ship.

uv tool install "git+https://github.com/Rushi-Balapure/Insidia-Labs#subdirectory=core"

Runs on your machine · No account

Free CLI · Python 3.12 or newer. Follow the quickstart to configure your app and run your first scan.

FINDING a1b2c3 · Fig. 1 — an injection, traced

Representativeinsidia · scan · policy L1 · coverage standard · 2 targets

support-bot

✔ai.prompt_injection_directpassgarak2.1s

✘ai.prompt_injection_indirectFAILinsidia1.4s

✔ai.data_leakagepasspromptfoo3.0s

orders-api

✔api.bola_idorpassinsidia0.6s

✔web.ssrfpassnuclei0.9s

ROOT CAUSE

retrieval.py puts uploaded text into the system prompt.

The planted canary came back in reply 3.

Representative. These rows stand in until a sanitized run of the demo app replaces this file.

How to use Insidia

Fits the stack you already ship

Claude Code
Cursor
Codex
GitHub Actions
OpenAI
Anthropic
Gemini
Ollama

Runs the engines you already trust

promptfoo
PyRIT
DeepTeam
ZAP
Nuclei
Trivy
gitleaks

Your chatbot passed review. It also obeys the PDF.

support_bot/retrieval.py

def build_prompt(question, docs):
    context = "\n".join(d.text for d in docs)   # uploaded files, unfiltered
    return SYSTEM + context + question

Uploaded text is mixed with trusted instructions. An attacker can use it to redirect the bot.

01

No error.

The bot answers politely. Logs look clean.
02

Two halves, two tools.

The model call and the API it drives usually get tested by different tools, on different days.
03

It ships.

The instruction in the document reaches production with everything else.

Point it at your app. Get the finding, the evidence, and the fix.

Scope in one file.

insidia init writes insidia.yaml. Only hosts you list get tested. Anything other than localhost needs authorized: true.

insidia.yaml

scope:
  - host: 127.0.0.1
  - host: staging.example.com
    authorized: true

Scan both layers.

insidia scan runs AI and app checks in one pass and names the engine behind every result. A check that couldn't run is marked incomplete, never passed.

insidia scan Representative

support-bot
  ✔ ai.prompt_injection_direct     pass
  ✘ ai.prompt_injection_indirect   FAIL
  ✔ ai.data_leakage                pass

Fix it. Run the checks again.

Use the scan's exit code as a CI gate: 1 for a completed policy failure, 2 for an incomplete run. After fixing the code, insidia rerun repeats the checks with the recorded policy and coverage.

insidia rerun Representative

$ insidia rerun
  ✔ ai.prompt_injection_indirect   pass   insidia
POLICY PASSED · exit 0

Built for how AI apps break

Scope guard

scope:
  - host: staging.example.com
    authorized: true

It refuses to test a host you didn't list.

Findings with evidence

engine: insidia
probe: prompt-injection.indirect
evidence: [AWS_ACCESS_KEY len=20 fp=3f9a1c07]
fix: keep uploaded text out of the system prompt

Review the available evidence, remediation guidance, and the engine behind each finding.

Hand it to your coding agent

Test this app with Insidia. Only scan localhost.

Claude Code, Cursor, or Codex runs it. You confirm the hosts.

Local, your keys

models:
  attacker:
    provider: openai-compatible
    base_url: http://127.0.0.1:11434/v1
    model: llama3.1

Scans run on your machine. Use a supported model endpoint, or run the baseline without a model.

FAQ

What does Insidia test?

AI and agent checks, plus app and API checks, in one scan. Each result names the check and the engine. The support notes are in the docs. See what it tests.

Does anything leave my machine?

Traffic goes to the target you configured and, if you set one, to your model. There is no telemetry.

Which engines does it run?

A finding names the engine that produced it. The list, with each engine's license, is on the Credits page. See Credits.

Can my coding agent run it?

Install the skill, or paste: Test this app with Insidia. Only scan localhost. Claude Code, Cursor, or Codex can run it. You confirm the hosts.

Will it test production?

Only hosts you list in insidia.yaml. Anything other than localhost needs authorized: true, which you set.

What does it cost?

The CLI is free. It runs on your machine and does not need an account. Insidia Cloud is in development, with design-partner access planned for December 2026. Cloud pricing has not been announced.

Find the weaknesses before you ship.

Scan your app, review the evidence, and rerun the checks after each fix.

Get started Book a call

FINDING a1b2c3 · Fig. 1 — the same check, after the fix

Representativeinsidia · rerun · policy L1 · coverage standard · 2 targets