One command scans your codebase, scores its security health, and turns on real-time protection against risky AI agent actions. No config files, no license key, no dashboard to set up.
There’s nothing to configure and nothing to install permanently. npx downloads and runs Thuban for this session only.
npx thuban protect
Click to copy
Runs the Scanner across every file in your project, activates Shield — all 5 defence layers (File Guard, Shadow Realm, Watchers, Execution Gate, Audit & Recovery) — and runs Crucible to verify your defences actually catch known attack patterns. All in one pass.
Node.js 16+ on Windows, macOS, or Linux. No account, no API key, no license key needed to run the free tier.
Most projects finish in 1–3 seconds. Larger monorepos may take a little longer on the first run.
Every scan ends with a letter grade — a fast, honest read on how exposed your codebase is right now.
Excellent. Almost everything auto-fixable is fixed. This is the target state.
Healthy baseline. Normal for most active projects. A few things worth tightening.
Needs attention. Real, fixable risk is sitting in the codebase. Run the fixer.
High exposure. Critical or high-severity findings likely present. Fix before shipping.
Findings are grouped by severity — Critical (exploitable now), High (serious risk), Warning (should fix), Info (best-practice suggestions).
Findings are printed with enough context to act on immediately — no digging through a dashboard required.
Each line gives you the severity, a plain-English description, the exact file and line number, which rule triggered it, and a suggested fix. If it says [auto-fixable], Thuban can resolve it for you.
Run the fixer to clear every auto-fixable issue in one pass. Nothing destructive happens without a snapshot you can roll back.
npx thuban fix . --fix
Click to copy
A scan tells you where you stand. Shield watches everything your AI agent does while it's running — every file write, every command. Start it at the beginning of your coding session. When you're done coding, Shield's done watching.
Every file create, edit, and delete, plus every shell command an AI coding agent attempts — before it executes, not after.
A terminal warning naming the exact file or command, why it was flagged, and whether it was blocked or just logged for review.
If something risky slips through, restore the last protected snapshot instantly:
npx thuban shield rollback
Click to copy
Scanning tells you what Thuban thinks it would catch. Crucible proves it — by firing hundreds of real attack patterns at your setup and confirming each one is actually detected.
npx thuban crucible
Click to copy
Runs a corpus of known attack patterns — credential exfiltration, injection, destructive commands — against your Scanner and Shield rules to confirm each one is actually caught, not just theoretically covered.
A pass/fail count per scenario, an overall detection rate, and a shareable summary you can hand to a security reviewer, auditor, or investor as evidence — not just a claim.
npx thuban protect works immediately with no account, API key, or license key for the free tier.npx thuban protect. Pro is $9/mo and adds Shield's continuous monitoring plus advanced features.No install, no config files, no signup required to scan.
Get Started Free