BYOAI code auditing: security + bugs
Run security audits or bug hunts manually, or use our support-assisted GitHub integration for incremental pull-request work. TheSpider runs Claude Code, Codex, OpenCode, and other commands on your machine, then keeps every finding deduplicated, stored, and ready to triage in one place.
$ curl -fsS thespider.xyz/healthz → ok · bring your own models · keep your audit history · hosted SaaS, local execution
$ thespider-agent run --once --max-slices 1
● project acme/payments-api (profile: bugs)
→ claim slice #142 … ok (auth/, api/handlers/)
→ render prompt … 8.2k tokens
→ run claude … done in 3m12s (checkout not uploaded to TheSpider)
✓ 3 findings reported · 1 duplicate suppressed by AI adjudication
HIGH concurrent refresh can overwrite a newer session
MED pagination drops records after a deleted cursor
LOW retry loop ignores the configured backoff limit
$ // two audit modes
Find vulnerabilities, broken authorization, unsafe trust boundaries, injection risks, leaked secrets, and other exploitable weaknesses.
Find correctness defects, broken edge cases, race conditions, state inconsistencies, error-handling failures, and regressions.
Every project contains both profiles with independent methodologies and campaigns. Findings, dedupe, triage, fixes, and status remain shared project-wide.
// why thespider
TheSpider is the system of record for AI-assisted code audits. It remembers what has already been found, combines duplicate reports across models and runs, and gives your team one queue for triage, remediation, and retesting.
A thin Rust agent runs model commands on the machine that has the checkout. TheSpider receives git metadata and model output, not your source tree. Your chosen model CLI may still send context to its own provider.
Use Claude Code, Codex, OpenCode, Gemini, aider, or any compatible local command. Mix models in one project to benefit from their different strengths without locking your audit history to one provider.
Findings survive individual runs. TheSpider tracks identity, status, evidence, and sightings over time, then collapses duplicate reports across models and branches into one finding with full history.
TheSpider builds campaigns from your configured passes, buckets, and enabled models, then tracks each work unit from claim through result ingestion.
Review and update findings in the dashboard. Run full audits from the agent; the currently support-assisted GitHub integration creates incremental campaigns that CI can gate.
The SaaS service owns methodology, dedupe, findings, and team workflow. Only the prebuilt agent and your chosen model CLIs run on your Linux machine or WSL environment.
// how it works
The first-party installer selects and verifies the matching Linux binary without a source checkout.
Setup opens browser authorization, safely selects or creates the matching project, and binds your agent (Claude Code, Codex, or OpenCode) to Security or Bugs.
Review the full planned matrix, then claim exactly one slice. Remaining work stays running and visible.
Reports are parsed, deduplicated, and added to one shared findings history for remediation and retesting.
thespider-agent (Rust) HTTPS / bearer brain server (Bun)
• enroll + token ── claim/results ──▶ • orgs · RBAC · quotas
• model → command ◀── prompts ─────── • parse · dedupe · triage
• git detect + runs • web UI + PR gate
runs in your checkout does not receive your tree Parsed findings are scrubbed before report rows are written. Raw stdout and stderr artifacts are stored as received unless you enable client-side --redact.
// pricing
You bring the models. We sell the audit brain. Self-serve checkout — the listed price is the price.
or $1,490/year
On-prem is Business billed yearly: $1,490/year, same 50 seats / 50 projects / SSO. Docs-only support. Compare deployment options
// evaluating deployment options?
The on-prem edition is the Business plan as a single-tenant deployment — $1,490/year, same seats, projects, and SSO — for organizations with data-residency, private-network, or air-gap requirements. It supports Docker Compose or Kubernetes, customer-controlled Postgres and object storage, and local or internal model endpoints. Public setup instructions on this site are for TheSpider Cloud.
// get started
Install the hosted skill and paste a short prompt, or fetch the one-shot setup wizard. Both paths install the verified client, run browser-authorized setup, and ask before one model call.
CLI + skill
Install TheSpider's skill into Claude Code, Codex, OpenCode, and the other agents npx skills detects. Then paste the prompt.
1. Install the skill
npx skills add https://thespider.xyz -g2. Paste this prompt
Get me started with TheSpider.URL wizard
No skill install. Paste this into an agent that can fetch a URL — it follows startup.md.
Get me started with TheSpider: https://thespider.xyz/startup.mdLinux or WSL · no server clone · no Docker, Bun, or Rust toolchain
Start with a security audit or general bug hunt. Run one model or many, keep your checkout off TheSpider's server, and build a findings history that improves with every campaign.