ghost▌

Scans dependency lockfiles for known vulnerabilities and generates severity-ranked findings with remediation guidance. \n \n Discovers and scans all common lockfile formats (package-lock.json, yarn.lock, go.sum, Gemfile.lock, and others) across your repository \n Identifies CVEs in dependencies and assigns severity levels to help prioritize remediation \n Analyzes exploitability of each vulnerability candidate to distinguish high-risk from low-risk findings \n Generates a structured scan report

Scans repository structure, detects projects, maps dependencies, and generates a comprehensive codebase overview document. \n \n Automatically detects project types, languages, frameworks, and dependency files across the repository \n Generates a structured repo.md file documenting project architecture, components, and organization for security analysis or codebase understanding \n Caches results in a configurable directory to avoid redundant scans on subsequent runs \n Works entirely with local

Aggregates dependency, secrets, and code scan findings into a single prioritized security report. \n \n Combines results from scan-deps, scan-secrets, and scan-code into one unified report, filtering for high-confidence findings only \n Prioritizes findings by severity (high, medium, low) and scan type, inlining full details for critical issues so the report is self-contained \n Caches reports at the commit level to avoid regeneration; checks for existing results before running scans \n Extracts

Validate security findings by analyzing code flows, testing exploit conditions, and confirming true vs. false positives. \n \n Traces request flows from route registration through middleware to handler logic, identifying indirect protections scanners may miss \n Performs live validation against accessible application instances using proxy-based request replay and response comparison \n Classifies findings into True Positive, True Positive (Confirmed), False Positive, or Inconclusive with support

MITM proxy for capturing, inspecting, and replaying HTTP/HTTPS traffic between clients and servers. \n \n Start the proxy scoped to specific domains or hostnames; traffic outside scope passes through transparently without logging \n View captured request/response logs, search by method/path/status/host with wildcard support, and inspect full raw HTTP entries \n Supports both foreground and daemon modes with configurable port; default listen address is localhost:8443 \n Requires manual client con

Automated secrets scanner that detects hardcoded API keys, tokens, passwords, and sensitive data in codebases. \n \n Scans repositories for leaked credentials and generates findings with severity levels and remediation guidance \n Uses the poltergeist binary to identify secret candidates, then analyzes and confirms each one through parallel subagents \n Stores scan results and findings in a repo-specific cache directory under ~/.ghost/repos/ with git-based versioning \n Orchestrates multi-step w

Static analysis security scanner that identifies OWASP vulnerabilities across backend, frontend, mobile, and library code. \n \n Scans for SQL injection, XSS, BOLA, BFLA, SSRF, prototype pollution, unsafe deserialization, ReDoS, path traversal, and zip slip vulnerabilities \n Three scan depths available: quick (default), balanced, and full, with token usage warnings for comprehensive scans \n Automated workflow: plans vulnerability vectors per project type, nominates candidate files, analyzes fi