TRACE

TRACE reads a backend repository and tells you, in under a second and with zero tokens, where it can actually be broken into — then hands the proof to your coding agent to fix.

Start here

1. Install — lite on any machine, full where you want neural scoring.
2. Run your first audit — one command, 60 seconds.
3. Connect your agent — eight tools over MCP, fixes proven by replay.
4. Let your agent set it up — install the trace skill and the agent configures TRACE itself; trace-fix handles triage, fixes and verification. Works in any agent harness.

How it works

source code → AST adapters → Attack-Path Model → hypotheses
→ live probes → Bayesian fusion → findings → verify

Static analysis proposes, live probes dispose, and the verification oracle replays each exploit after a patch. A finding marked FIXED means the attack is dead. Only source files TRACE can analyze are read; see What TRACE scans.

Everyday commands live on the cheat sheet; agents can read the whole site from llms.txt.