KeelenScans — Security
A security audit that ships the fix.
Keelen's Security scan is a deep, whole-repository security audit run by an AI agent in an isolated single-use VM with a read-only, single-repo token. It works through a fixed checklist of more than forty categories across four layers — code vulnerabilities, leaked secrets including git history, dependencies and supply chain, and infrastructure hardening — and reports ranked findings plus a coverage map showing what was checked, what was partial, and what was skipped, with a reason.
It is built to be re-run: findings carry stable fingerprints, so a weekly or pre-release scan reconciles against the last one instead of flooding you with duplicates. And any finding can be sent to Keelen's autonomous loop, which implements the fix and opens a pull request through the same verification gates as every other change.
- A fixed checklist, not vibes: every applicable category ends the run as covered, partial, or skipped-with-reason — no silent gaps.
- Findings ranked critical to info, anchored to CWE and OWASP references, deduplicated across runs by fingerprint.
- One click turns a finding into a Request; the loop fixes it and ships a tested, reviewed pull request.
- Read-only by construction: a single-repo read token inside an isolated single-use VM. The scan cannot write anything.
- Run it on demand from the dashboard, or on a daily, weekly, or monthly rhythm over MCP.
What it checks
The checklist adapts to what your project is. Network-facing apps get the full web control set — access control, authentication and sessions, XSS, CSRF, CORS, security headers, SSRF, rate limiting. Libraries and CLIs get public-API misuse, input validation on the public surface, and heavier supply-chain weighting. Game projects get client-trust boundaries, save-file tampering, and untrusted asset loading. Projects that embed an LLM get a GenAI security pass. Four layers apply to everything: code-level vulnerability classes, hardcoded credentials in source and git history, vulnerable or abandoned or typosquatted dependencies, and Dockerfile, IaC, and CI-pipeline hardening.
Coverage you can audit
Most scanners show you what they found. Keelen also shows what it looked at. The audit runs against a fixed checklist rather than whatever the model happened to notice, and the report carries a per-category coverage map: covered, partial, or skipped — each with a reason. We cannot prove zero misses, but we can guarantee no silent gaps.
From finding to merged fix
Each finding has two buttons. Dismiss is a sticky won't-fix — it stays dismissed on every future run. Send to loop turns the finding into a Request on your roadmap: the loop plans the fix, implements it in an isolated VM, proves the new tests fail without the fix, passes an independent adversarial review, runs your suite on a clean checkout, and ships a pull request that merges only when CI is green — or waits for your click, if the project is set to manual merge.
Run it on your cadence
There is a Run button on the project tab, and there is an MCP tool — run_security_review — so any agent or scheduler you already use can trigger a scan weekly, before each release, or after every incident. Re-running is the intended workflow, not a spam generator: findings carry stable fingerprints, so a re-run reconciles against the last one — fixed findings resolve, new ones surface, dismissed ones stay dismissed.
Trigger it from any agent
claude mcp add --transport http keelen https://keelen.ai/mcp
Then the run_security_review MCP tool starts a run — from Claude Code, Cursor, a cron job, or anything else that speaks MCP.
What it is not
This is a read-only audit of the repository — not a penetration test, and nothing is executed against a live system. The absence of a finding is not evidence of absence. It complements, rather than replaces, your existing dependency alerts and static analysis.
Included on every paid plan
From $29 / month on Indie
FAQ
Can AI find security vulnerabilities in my code?
Yes, with honest limits. Keelen runs an AI agent through a fixed checklist of more than forty security categories over your whole repository and reports ranked findings with CWE and OWASP references. It also reports its own coverage per category, so you can see what was actually audited. No tool can prove the absence of vulnerabilities; this one guarantees no silent gaps in what it claims to have checked.
What does Keelen's Security scan check?
Four layers on every project: code-level vulnerability classes, hardcoded secrets in source and git history, dependency and supply-chain risk, and infrastructure hardening across Dockerfiles, IaC, and CI pipelines. Web apps additionally get the full web control set — access control, sessions, XSS, CSRF, CORS, headers, SSRF, rate limiting — and libraries, CLIs, games, and LLM-embedding apps each get their own modules.
Does the scan modify my repository?
No. The scan runs in an isolated single-use VM with a read-only token scoped to one repository. Changes only happen if you send a finding to the loop — and then they arrive as normal pull requests through the same verification gates as any other Keelen change, gated however you have configured the project.
How is this different from Dependabot or a SAST tool?
Those tools pattern-match one layer each. Keelen's scan is an agent reading your actual code the way a security engineer would — across code, secrets, dependencies, and infra in one pass — and it closes the loop: a finding becomes a Request, and the autonomous loop ships the fix as a tested pull request. It complements rather than replaces the scanners you already run.
How often should I run a security scan?
Weekly is a good default, plus one before each release and one after any incident. Re-runs are cheap to consume: findings are fingerprinted, so a new run reconciles with the last — fixed findings resolve, dismissed ones stay dismissed, and only genuinely new findings ask for your attention. Trigger it from the dashboard or on a schedule via the run_security_review MCP tool.
Which plans include the Security scan?
Included on every paid plan, from Indie at $29/month. CMMC Level 2 controls are an Enterprise feature.