# Insidia Labs

> Insidia is a free, Apache-2.0 CLI and agent skill for security testing of AI apps, agents, web apps, and APIs. Run it locally or in CI and review HTML, JSON, and SARIF reports. No Insidia account is required.

The CLI is the contract. An agent installs it from GitHub, keeps the scan inside the hosts named in `insidia.yaml`, and opens the report.

## Availability and limits

Python 3.12+ is required. Install from GitHub with uv or pipx; Insidia is not published on PyPI. The agent skill installer needs Node.js 22+.

L1 is the available baseline policy and needs no model or model API key. L2 and L3 are not available. Checks requiring a model are skipped unless one is configured. Coverage depends on the target and installed engines; some checks work only on project test apps and external engine integrations are experimental. A skip is not a pass, and no findings does not establish that an app is secure.

The CLI sends no telemetry. Scans contact the configured target and any chosen model endpoint; reports stay on the machine. Localhost is the default scope. Every other host needs permission, `authorized: true`, and confirmation with `--yes`.

The CLI and agent skill are free; chosen model services may charge separately. Insidia Cloud is in development, with design-partner access planned for December 2026 and pricing unannounced.

## Start

- [Use a coding agent](https://www.insidialabs.com/docs/start/agent/): skill install, the prompt to paste, and the rules for scope
- [Install](https://www.insidialabs.com/docs/start/install/): `uv tool install` or `pipx` from the git URL
- [Quickstart](https://www.insidialabs.com/docs/start/quickstart/): init, doctor, scan, report
- [Scope](https://www.insidialabs.com/docs/start/scope/): localhost is the default. Other hosts need `authorized: true`

## Reference

- [CLI](https://www.insidialabs.com/docs/reference/cli/): commands, exit codes, and `insidia mcp`
- [Run in CI](https://www.insidialabs.com/docs/guides/ci/): install the CLI, run a scan, and preserve reports
- [Configuration](https://www.insidialabs.com/docs/start/config/): targets, credentials, and model endpoints

## Concepts

- [What it tests](https://www.insidialabs.com/docs/concepts/what-it-tests/)
- [Engines](https://www.insidialabs.com/docs/concepts/engines/)
- [Report](https://www.insidialabs.com/docs/concepts/report/)
- [Benchmark](https://www.insidialabs.com/docs/concepts/benchmark/)
- [Data handling](https://www.insidialabs.com/docs/security/data/)

## Project

- [Website and frequently asked questions](https://www.insidialabs.com/#faq)
- [Pricing and availability](https://www.insidialabs.com/pricing/)
- [Source code and Apache-2.0 license](https://github.com/Rushi-Balapure/Insidia-Labs)
- [Complete documentation as plain text](https://www.insidialabs.com/llms-full.txt)