slow-stack/euthyna
A code security audit framework for AI coding agents that produces facts agents cannot compute by reading code and forces every security claim through gates.
euthyna is a code security audit framework for AI coding agents, named for the audit every outgoing Athenian official had to submit. It does two things: it produces the facts an agent cannot compute by reading code, and it forces every security claim the agent makes through gates before it counts as a finding. The README frames the problem as agents reporting things that are not real — pattern-matched 'vulnerabilities' that do not survive data-flow tracing — and reports validation runs on a JavaScript, a Python and a Go codebase where 5 of 5, 2 of 3 (the third inconclusive, supply-chain-dependent) and 4 of 4 pattern-matched findings were refuted at the gates. It is explicitly 'not another scanner': it targets false positives and unearned security claims rather than raw detection count.
Install
dsh plugin --profile web add euthynaCopied verbatim from the README's comparison table, whose DSH row reads: dsh plugin --profile web add euthyna — the npm package mounts its own skill. The README also documents copying .agents/skills/euthyna/ into ~/.agents/skills/ (user-wide) or <project>/.agents/skills/, and notes Markdown hot-reloads with no restart needed.
Compatibility
Installs into the web profile via DSH's plugin manager; the README says the npm package mounts its own skill, and that a copied-in Markdown skill hot-reloads with no restart.
Details
- Repo: slow-stack/euthyna
- Category: Tools & Capabilities
- Stars: 1
- Version: GitHub repo slow-stack/euthyna; npm package euthyna at 0.5.0 (registry check 2026-10-07; registry repository field resolves back to this repo). License Apache-2.0 with verified npm provenance per the README's badges.
FAQ
- Is this just another vulnerability scanner?
- No — the README says it is explicitly 'not another scanner': it produces the facts an agent cannot compute by reading code and forces every security claim through gates before it counts as a finding.
- How is it installed?
- The README's DSH row uses dsh plugin --profile web add euthyna, where the npm package mounts its own skill; it also documents copying the skill directory into ~/.agents/skills/ or a project's .agents/skills/.
Alternatives
Rianico/dsh-better-edit · fwerkor/local-shell-mcp · TencentCloudBase/CloudBase-AI-Toolkit