Two modes in one CLI. Security Scan reads the code. Pen Test attempts the exploits against systems you authorise.
brew install CosineAI/tap/cos
curl -fsSL https://cosine.sh/install | bash
winget install Cosine.CLI
Pick modules, set the agent’s permissions, run. Output is a markdown report — location, severity, cause, and fix direction for every finding it could ground in your code.
Free install. Running scans requires an active $20/month Cosine subscription — the same login that runs Cosine’s coding agent.
Overall risk rating: CRITICAL
Multiple critical and high-severity vulnerabilities:
balancereader, transactionhistory, and ledgerwriter verify JWTs against a single shared RSA public key with no issuer or audience claim binding. Combined with the hardcoded private key in the repo (see below), a token signed off-cluster passes verification at every service and authorises any account; per-service trust collapses to “do you have the repo.”[ trimmed — full report includes per-module findings ]
.cos/scan-<date>.md with executive summary, per-module findings, location, severity, cause, and fix direction. The file stays on your machine.Same CLI, second tab. The swarm goes offensive against systems you authorise — not just reading the code, attempting the exploits. Gated because the security implications are real; access is via booking, scope and authorisation written down before anything runs.
Status: 2 critical, 1 high, 3 medium — all reproducible.
Scope: 2 hosts, 47 endpoints. Out-of-scope items deferred and flagged for next engagement.
1. JWT signature bypass (CRITICAL · CVSS 8.6)
POST /v1/sessions/refresh — forged token with disabled signature verification, returned 200 OK with admin scope. Reproduction script included.
2. SSRF via OAuth consent redirect (HIGH · CVSS 7.4)
Open redirect on /oauth/authorize resolved arbitrary internal URLs. Reproduction included.
[ trimmed — full summary includes evidence and remediation per finding ]
cos runs on a model Cosine post-trained for offensive security, not an off-the-shelf API behind a prompt wrapper. We trained it because off-the-shelf models refuse the work this product does — a security scanner that won’t read the parts of your code worth attacking isn’t a security scanner.
Safety isn’t a layer of refusals you can talk the model out of. It’s a Go harness sitting below the model that intercepts every tool call before execution. In Security Scan mode, the harness deterministically blocks mutating tools (file writes, command execution) regardless of what the model wants — read-only is a guard, not a flag. In Pen Test mode, the same harness limits network egress to the targets you authorised at booking.
The binary you install with brew, curl, or winget is the same one we run internally. It is not open source. It runs locally on your machine. You can run cos behind a firewall and tcpdump what it does before trusting it on real code.