locac

Autonomous vulnerability research

Evidence, or it isn't a finding.

locac audits a codebase the way a researcher does: map the surface, trace a source to a sink, then try to break its own conclusion. Nothing reaches High or Critical without a real execution artifact and a 2-of-3 independent verifier quorum, enforced by the harness rather than by the model's confidence.

curl -fsSL https://locac.dev/install.sh | sh
Read the docs View source
session - one run, schematic
$locac run "audit the HTTP request pipeline" --require-sandbox --auto
sandbox=os · 34 tools · resuming from 2 prior findings
▸scan_sinksclass=command-injection18 candidates
▸trace_callersnet/proxy.ts:214 ← router.ts:88 ← server.ts:31
▸executepoc/cmd-inject.shartifact exec:7f3a
▸cross_verifyreproduce ✓ refute ✓ boundary ✗QUORUM 2/3
▸score_findingCWE-78 · CVSS 9.8CRITICAL
✓report_findings: 1 confirmed, 17 candidates rejected

The proof gate

Four gates between a grep hit and a Critical.

The gate is code, not instructions. A model that is certain, persuasive, and wrong still fails it, because every clause resolves through one function, so the reporting path and the scoring path cannot drift apart.

  1. 01

    Candidate

    A tool hit is a candidate, never a finding. The sink scanners surface where dangerous calls live; the tracers decide whether an untrusted source actually reaches one and whether an attacker controls the value when it lands.

    scan_sinksgrok_sinktrace_callers
  2. 02

    Execution artifact

    The finding must cite an artifact minted in this same session whose kind proves exploitability: exec, dast_run, replay, or crash_oracle. A coverage artifact is rejected here on purpose: reaching a line is not crashing it.

    executereproducereplay_requestrun_module
  3. 03

    2-of-3 quorum

    cross_verify fans out exactly three verifiers on fixed, diverse lenses: reproduce, refute, boundary. A vote counts only if that verifier reproduced the bug itself during this round and cites its own new artifact; re-citing the candidate's evidence, or one another lens already used, counts for nothing.

    cross_verifyspawn_subagent
  4. 04

    Severity gate

    score_finding computes CVSS rather than asking for it, and only High and Critical survive. report_findings re-checks both clauses at render time, so a finding cannot be printed by asserting it already passed.

    score_findingreport_findingssubmit_report

Why the gate is not just "the run passed"

A proof-of-concept that genuinely crashes its target exits non-zero. Gating every artifact on a clean exit would therefore throw away the strongest evidence in the system, so only crash_oracle, the one kind that records a real triggered / not-triggered verdict, is checked for its own outcome. The others are judged by kind and session, and coverage never proves anything at all.

Non-negotiable

Five invariants.

Every one of them removes findings. That is the point: the expensive failure mode of an automated auditor is not missing a bug, it is handing a team a hundred reports and making them prove the negative on each.

01
Default deployment only
If the path needs a debug flag, an example credential, a non-default setting, or an administrator's mistake, it is discarded. The question is never whether a configuration exists that breaks; it is whether the shipped one does.
02
No app sink
The bug lives in official, supported code. Wrapping the target in a deliberately vulnerable harness proves something about the wrapper, so building one is not allowed.
03
High or Critical only
Informational, low, medium, hardening notes and version disclosure are out of scope by construction, not filtered out of the report at the end, but never promoted in the first place.
04
Cross-verify
A candidate is accepted only after independent verifiers reproduce it and a deliberate attempt to refute it fails. The agent that found it does not get to be the agent that confirms it.
05
Resume from memory
Prior findings and the scratchpad are read before any expensive tool runs. A long audit continues where it stopped instead of paying to rediscover what it already knows.

What it actually does

Thirty-four tools, one argument.

None of this is a scanner wrapped in a chat box. Each capability exists to close a specific way an automated auditor lies to you.

Structure, not grep

Sink discovery and caller tracing run on tree-sitter parses, so a match is a call node with a resolved callee, not a string that happened to appear inside a comment, a test fixture, or a vendored copy.

outlinescan_sinksgrok_sinktrace_callers

The target repo is untrusted

Everything the target runs goes through an OS sandbox: bubblewrap on Linux, a seatbelt profile on macOS, a broker process on Windows. --require-sandbox refuses to start at all rather than quietly running a repo unconfined.

bashexecute--require-sandbox

Subagents with a job description

A subagent spawns as a typed role: its own task and report schema, its own tool allow-list, its own model. A verifier that cannot call the tool that produced the original artifact cannot accidentally re-cite it.

spawn_subagentsteer_subagentwait_subagent

Evidence outlives the run

Findings, artifacts, and the scratchpad live in SQLite under ~/.locac/projects, never inside the repo under audit. Resume a session, or fork it at any point in the transcript and take the other branch.

record_findingrecallmemoryscratchpad

Compaction without a second model

Context shrinking is deterministic elision, not summarization: it never calls a model, it never reorders the transcript, and it holds an evidence floor so the artifact a finding depends on is not what gets dropped to make room.

--keep-recent--evidence-budget-tokens

Prompts you can measure

A change to the system prompt is an experiment, so it gets an experiment's tooling: A/B two prompts across labeled fixtures for a single run score, or diagnose the current harness on those fixtures instead of guessing at a regression.

locac eval ablocac eval diagnose

Install

One file, and it checks its own hash.

A single self-contained executable, with every runtime asset compiled into it, so what you copy around afterwards is one file. The installers below verify the download against the release's SHA256SUMS and refuse to unpack an archive it does not vouch for. Neither one edits your shell profile or your PATH: they print the line and stop. Building from source stays fully supported, and is the right call if you would rather not take a binary from anyone.

What the machine still needs

  • 64-bit Windows. arm64 machines run the x64 build under emulation.
  • Git for Windows, because locac executes through a bash-compatible shell. Point --shell-path (or LOCAC_SHELL) at C:\Program Files\Git\bin\bash.exe.
  • npx sandbox-runtime windows-install, once per machine, to install the sandbox broker.

On the sandbox

The broker runs the target as a different user, which is what makes the confinement real. Until it is installed the run degrades to direct mode: cwd pinned, nothing else.

Install

irm https://locac.dev/install.ps1 | iex

Pulls locac-windows-x64.zip from the latest release into ~/.locac/bin. Set LOCAC_VERSION to pin a tag and LOCAC_INSTALL_DIR to choose somewhere else.

First run

locac config init
locac run "audit the HTTP request pipeline" --require-sandbox

config init writes ~/.locac/config.json. The API key is read from the provider's own environment variable: ANTHROPIC_API_KEY, OPENAI_API_KEY, and the rest, and never has to be typed on a command line.

Or build it yourself

git clone https://github.com/Losec-io/locac
cd locac
bun install
bun run build:exe
dist\locac.exe selftest

Needs Bun>= 1.3, and nothing else.

locac selftest is not a formality: it verifies that the assets embedded in the binary actually materialize on this host, and reports which sandbox mode you get and why.

Threat model

Assume the code is hostile.

A tool that reads attacker-authored source and then runs it is itself an attack surface. These are the assumptions the harness makes so that pointing it at a repo you do not trust is a normal thing to do.

Authorized testing only

The repo under audit is the attacker
Config, skills, roles, and keybindings are read from ~/.locac and nowhere else, so a repo cannot ship a file that reconfigures the harness auditing it. Output produced by target code is fenced with a per-run nonce before the model ever sees it, so a README that says "ignore your instructions" arrives labelled as data.
The key stays where you put it
The API key is read from the provider's environment variable and bound to the endpoint it belongs to. It is never echoed, never written to a transcript, a finding, or memory, and never reaches the browser: the local dashboard renders configuration without it.
Nothing is written into the repo
The session database lives under ~/.locac/projects, keyed by project. An audit leaves no files behind in the tree it audited, so a dirty working directory is never something locac put there.
A web scan is not a pivot
The DAST fetcher resolves a host and then checks the address it actually resolved to, rejecting loopback, private, and link-local ranges, including the cloud metadata endpoint reached through an IPv4-mapped IPv6 literal, which a string match on the hostname misses entirely.
Dangerous tools ask first
bash and execute are blocked outright unless you approve them. --auto is the middle setting, not the loose one: read-only commands run, everything else fails closed rather than degrading to a prompt nobody is there to answer.