We never receive your code. RedMirror is one binary that runs on your machine and calls whatever model you choose. Pair it with a local model and nothing ever goes on the wire; point it at a cloud model and the only thing sent is what that model reads, to the provider you already trust.
A command-line binary that runs as an MCP server for your coding agent, right on your machine. Point it at your code and your own model (local or cloud), and it finds real security bugs and proves each one.
Finding real bugs · 440 CVEs
96% / 54%
real bugs caught, verified vs the model’s own word
1.8×
more found than the same model alone
16
real bugs the benchmark marked safe
Model alone + RedMirror
OpenSSF benchmark, 440 real CVEs, each paired with its fix. Same result on gpt-oss-120b and gpt-oss-20b: big model or small, RedMirror catches the same real bugs.
Exploiting a live app · real CVE
100% / 60%
real exploits landed on a running server, guided vs on its own
~30%
fewer steps to reach the exploit
10
runs, one live server, one real path-traversal bug
Model alone + RedMirror
The same model against a running server with a real path-traversal CVE, five runs each. Pointed at the reachable sink, it landed the exploit every time and in fewer steps; on its own it got there 3 times in 5.
An AI reviewer gives an opinion. This gives a proof.
Pick a real bug from a real scan, hit verify, and watch the kernel return the exact reachable path that breaks it. Nothing to install, it runs right here.
Must hold
your coding agent · redmirror (MCP)
That path is replayable. A language model would just say “this looks risky” and move on.
Free 7-day trial, no card. We never receive your code.
Real findings, replayed: RedMirror scans of OWASP Juice Shop and Microsoft Contoso University. The code shown is the actual vulnerable code; the path is the counterexample the kernel returns.
7-day free trial
No card, no account. We email your 7-day activation licence.
Check your email. We just sent your 7-day activation licence to . Open it for the three setup commands. The first one installs it:
$ curl -fsSL https://dist.redmirror.io/install.sh | sh
The email has your license activate key and the init command. Not there? Check spam. Ready to keep it? Subscribe →
Real bugs RedMirror surfaced and we reported in open-source projects. The public ones link to the fix and a walkthrough.
sipsorcery-org/sipsorcery, GHSA-28gm-jrmw-xx93 (advisory, High): a pre-auth one-packet DoS, where a single malformed UDP packet tears down the RTP/ICE channel; fixed in #1677 (merged) · write-up
google/osv-scanner, #2882 (PR, maintainer-approved; re-submitted as osv-scalibr #2429 after the matcher moved): an advisory carrying an unrecognized ecosystem panicked the matcher and aborted the entire offline scan; fixed by skipping the unknown ecosystem instead of crashing (#2867) · write-up
jaqx0r/mtail, #476 (PR, merged): enforce a per-metric cardinality limit at datum creation, capping unbounded metric growth (google/mtail #1006) · write-up
apache/airflow, #67076 (merged): leftover temp report file in BidManager download
apache/airflow, #67075 (merged): IMAP hook hardened against symlink-followed writes
apache/airflow, #67074 (merged): Kubernetes executor config isolated from the global default
portainer/portainer, under coordinated disclosure
ory/polis, under coordinated disclosure
nltk, under coordinated disclosure
Beyond the public fixes above, many findings have been disclosed privately and will be public once fixed.
Finds the bug, and proves it
Most tools that read your code do one of two things. A scanner matches patterns it has seen before, so it misses anything shaped a little differently and raises false alarms on the rest. A model reading the code on its own just gives an opinion: fluent and sure of itself, whether or not it’s right. Either way, you’re the one left deciding which warnings are real.
Model alone
Reads it, guesses
→ vulnerable: true / false (unverified)
+ RedMirror
Finds it, proves it
→ vulnerable: true · witness confirmed ✓
RedMirror is built the other way around. It brings the tactics of formal verification, the methods used to validate safety-critical systems, to everyday code. Rather than a verdict you take on trust, it gives you something you can check: the concrete steps that should trigger the bug, so you can run them against your own code and confirm it for yourself. If it can’t back a finding with those steps, it doesn’t raise it. The goal is a short, checkable list you can act on, not a pile of maybes to triage.
Install
Reflection is a single binary that is an MCP server, redmirror-reflect mcp, which your coding agent connects to and drives. No runtime, no dependencies, no scan command, and no model to configure: guided by RedMirror, your agent finds real bugs and the kernel proves them.
1 · Install puts redmirror-reflect on your PATH
macOS · Linux
$ curl -fsSL https://dist.redmirror.io/install.sh | sh
3 · Add it to your coding agent installs the tools, skill & gate
one line
$ redmirror-reflect init <agent>
<agent> is one of claude · cursor · jcode · windsurf · codex · gemini · pi · dsh (or ci for a pipeline gate). Using something else? init with its name still works, it prints the manual MCP wiring for any agent.
4 · Use it
Just ask your agent to scan a file, a change, or the whole repo for real bugs. Guided by RedMirror it finds the risky relations, then the kernel proves each one with a replayable attack path (or a bounded proof there's none), and your agent reports only what's grounded.
Setting this up with a coding agent? Tell it “install RedMirror” and have it run the steps above for you, the prescriptive, machine-readable version is at /llms.txt.
No. RedMirror is one offline binary that reads your source locally and calls whatever model you point it at. Point it at a local model and nothing ever leaves your machine. Point it at a cloud model and the only thing sent is what that model reads, to the provider you already trust. We never receive your code; we store only your account email, a weekly licence check, and (if you accept cookies) basic site analytics.
How is this different from Copilot, Cursor, or asking an LLM to “find bugs”?
Those guess. An LLM pattern-matches and hallucinates, so it misses real bugs and invents fake ones. RedMirror pairs your model with a compiled kernel that exhaustively searches every reachable state of the code, so a finding is verified, not an opinion: you get the exact steps that reach the bug, or a proof none exists. On the 440-case OpenSSF benchmark it takes a model from 54% to 96% real-bug recall, and it catches bugs the benchmark itself labelled safe.
Is it a linter or a SAST scanner?
No. Linters and SAST tools match patterns and bury you in maybes. RedMirror searches every reachable state of the code and returns a concrete counterexample, the exact sequence of steps that drives it into the bad state, or a bounded proof that no such path exists. Every result is reproducible.
What does it actually find?
Real, reachable security bugs: auth bypasses, path traversal, injection, and logic and state flaws, each proven with a replayable attack path rather than a style nit. The fixes it has already shipped to open source say it best, including google/osv-scanner, apache/airflow, PrefectHQ/prefect, and sipsorcery.
Which model do I need?
Any tool-calling model. The flow drives it through function calls (read, run, submit). You do not need a frontier model: on the 440-case benchmark the same 96% real-bug recall holds on gpt-oss-20b as on the 120b, and small open models like qwen3-coder run the whole loop. A local model is fine. The kernel does the exhaustive checking with zero tokens, so you only pay for the model’s reading.
Which languages does it work on?
Any language your model can read. RedMirror doesn’t depend on a fixed parser per language: your model reads the source, RedMirror models it as a state machine, and the kernel reasons about that the same way no matter the language. Go, Python, TypeScript, Rust, Java, C#, Ruby, PHP, C++, Solidity, or something far more niche, if your model understands the code, RedMirror can verify it.
How do I set it up?
One line installs the binary (curl -fsSL https://dist.redmirror.io/install.sh | sh, or the PowerShell one-liner on Windows). Activate your licence, then point your editor at it. It is an MCP server, so it drops straight into Claude Code, Cursor, VS Code (Copilot), or Windsurf, with no runtime, no dependencies, and no scan command to learn. It takes minutes.
Can I run it fully offline or air-gapped?
Yes. With a local model the whole loop (reading, searching, and proving) runs on your machine with nothing on the wire. The licence checks in about once a week and works offline in between, so it is happy behind a firewall or on an air-gapped box.
What does it cost to run?
$4.99 a month, cancel any time, by card or PayPal with no account needed, with a free 7-day trial (no card) to start. The kernel’s exhaustive search costs zero tokens, so your only usage cost is the model doing the reading: a local model’s electricity, or your existing provider’s rate. One seat is one developer.
What if it’s not for me?
Start with the free 7-day trial, no card. Try it on your real code, and if it’s not for you, walk away and pay nothing. If you keep it, it’s $4.99/mo, cancel whenever from your account.
In RedMirror Reflection. Update any time with redmirror-reflect update.
0.6.0August 2026latest
Send findings to your code-scanning dashboard, audit --sarif report.sarif writes a standard SARIF 2.1 file for GitHub code scanning, Defender, or Azure DevOps, and every finding carries the whole path an attacker takes to reach it, not just a line number.
Catches regex denial-of-service (ReDoS), a regular expression a crafted input can make hang for seconds or minutes, a class most scanners walk past, with the pattern to rewrite.
Finds more cross-site scripting, wider coverage of the ways untrusted text reaches the page, jQuery and React among them.
Same code, same answer, every time, results are now fully reproducible from one run to the next.
0.5.1August 2026
Setting up with the pi agent is now instant, redmirror-reflect init pi no longer pauses while it registers the tools.
0.5.0August 2026
Finds injection bugs and proves them, SQL injection, command injection, path traversal, SSRF, code injection, XSS. It traces a request value to the dangerous operation and shows the reachable path, or that something neutralises it. A real, replayable finding, not a maybe.
Triage a whole codebase in one step, point it at a directory and it returns just the files with a request-reachable dangerous operation, ranked by impact. Now in every supported agent, not only one.
Exploit a live app, guided, it tells you which endpoints are reachable from a request and the payload class each needs. In a five-run test on a live server, the guided model landed a real exploit every run and in about a third fewer steps; blind it managed three in five.
Check your own business rules, flag weak crypto, and init now installs the tools, not just the guide.
0.4.2August 2026
Fixed a stale line in the built-in agent skill that pointed at a command which no longer exists, your agent could waste a turn on it. The skill now matches the commands the tool actually has.
0.4.1August 2026
Now works inside DeepSeek’s deepseek-harness (dsh) too. Wire RedMirror in with one command, redmirror-reflect init dsh, then ask it to find and prove a bug.
0.3.5August 2026
Works in more editors out of the box, one-line setup for Claude Code, Cursor, Codex, Gemini CLI, Windsurf, jcode, and pi (and any MCP-capable agent).
Point it at a whole repository and it works through the codebase subsystem by subsystem.
Sharper, more accurate results.
0.3.0August 2026
One-step setup: redmirror-reflect init <agent> connects RedMirror to your coding agent.
Runs entirely inside your agent, using the model you already work with there.
0.2.0August 2026
Update in place with a single command: redmirror-reflect update.
Scan a whole repository subsystem by subsystem, tracking coverage so nothing is left unexamined.
Broader model support: runs reliably across more local and hosted models.
More accurate results and finding counts when your agent finishes a review.
0.1.0August 2026
First release: propose a finding, and get back a proof it’s real or a note on what to fix.
Bring your own model, cloud or fully local.
One binary, offline licence, 7-day free trial.
Prove a bug in your own code. Free 7-day trial, no card.Try it free →
