Cerberus Documentation

Cerberus is a security-orchestration platform for modern, AI-assisted applications. Nine weighted native agents run a 59-check catalog, while the CLI can add ALIGNMENT and normalized evidence from five specialized open-source feeders.

Meet the agents

Learn how SENTINEL, GATEKEEPER, VAULT, and the rest of the swarm divide security work.

What we check

Browse every check in the catalog across all nine security domains.

Run a scan

Install the CLI scanner, point it at your project, and interpret the results.

Scoring guide

Understand how the 0–100 score, letter grade, and severity deductions work.

What Cerberus is

As AI coding assistants let developers ship faster, security reviews often fall behind. Traditional penetration tests take weeks and cost thousands of dollars. Automated static-analysis tools are powerful but noisy, require heavy configuration, and rarely explain why a finding matters to your specific stack.

Cerberus treats a security audit as nine domains run over the same fetched files: each agent is a named group of pattern-based checks defined in checks.json, with its own weight toward the final score. You get a single, coherent report that tells you what is wrong, how severe it is, and how to fix it — with a file, a line number, and a permalink for every finding.

Cerberus is built for

Solo founders preparing for a Product Hunt launch, seed-stage startups closing their first enterprise deal, agencies delivering client work, and any team that ships AI-assisted code and needs fast, credible security due diligence.

How the examination works

Every Cerberus examination follows the same pipeline. You provide a target — a GitHub repository URL or a local directory (via the CLI) — and the system does the rest.

Resolve & fetch

The scanner resolves the target, pulls the file tree, and fetches eligible source files (≤2,000 files, ≤2 MB each).

Evaluate

All 59 native checks in checks.json, grouped into 9 weighted agent domains, run over eligible files.

Resolve check states

Each check ends as pass, fail, not_applicable, or skipped, each with findings or a stated reason.

Score, normalize & report

Native scores remain independent. CLI ALIGNMENT and feeder evidence are normalized into separate report sections and a combined policy result.

CLI orchestration

The CLI adds a separately scored ALIGNMENT analyzer and adapters for Gitleaks, OSV-Scanner, Zizmor, OpenSSF Scorecard, and actionlint. External findings retain tool provenance and stable fingerprints but never alter native points. Missing tools and non-applicable inputs are explicit statuses rather than scanner crashes.

python3 examine.py . --feeders auto --json report.json --html report.html \
  --sarif report.sarif --feeder-json feeders.json

Use --native-only for the offline catalog-only path. Cerberus never downloads feeder binaries.

The nine security domains

Each agent owns a narrow slice of the security surface and a share of the 100-point score. That specialization lets Cerberus mimic the workflow of a real cross-functional red team: one set of checks covers SQL injection, another covers JWT config, another covers Docker hardening, and so on. Counts below are pulled live from checks.json — see the Check Catalog for the full list.

SENTINEL

Code Analysis

Finds hardcoded secrets, raw SQL injection, command injection, path traversal, unsafe deserialization, weak randomness, and SSRF.

11 checks · weight 14 · S-01 → S-10 + S-06P

GATEKEEPER

Access Control

Audits JWT/signature verification, password length policy, auth opt-outs, default admin credentials, cookie flags, and client-side authorization.

6 checks · weight 12 · G-01 → G-06

VAULT

Data Security

Reviews password hashing, cipher modes, secrets in logs, committed .env/key/database files, .gitignore coverage, and provider token literals.

8 checks · weight 13 · V-01 → V-08

CONDUIT

Network & API

Checks wildcard CORS, credentialed CORS, TLS verification, cleartext HTTP, and services bound to all interfaces.

5 checks · weight 11 · C-01 → C-05

WATCHTOWER

Application Config

Scans for debug mode, root containers, unpinned base images, privileged containers, CI secrets, missing SECURITY.md/LICENSE, and security headers.

8 checks · weight 11 · W-01 → W-08

LIBRARIAN

Dependencies

Identifies missing lockfiles, known-vulnerable dependency versions, git/URL-sourced dependencies, missing Dependabot/Renovate, curl-pipe-to-shell, and unpinned Actions.

6 checks · weight 12 · L-01 → L-06

SHIELD

Client Security

Audits tokens in web storage, unsanitised HTML injection sinks, document.write, postMessage origin checks, target=_blank rel, and client-side secrets.

6 checks · weight 11 · F-01 → F-06

AUDITOR

Logging & Monitoring

Reviews credentials passed to loggers, stack traces returned to clients, leftover debug output, and missing CI pipelines.

4 checks · weight 8 · A-01 → A-04

ARCHITECT

Infrastructure

Checks hardcoded IPs, security groups open to the internet, publicly readable object storage, missing tests, and committed Terraform state.

5 checks · weight 8 · R-01 → R-05

What you receive

After a scan completes, Cerberus produces a structured report with four layers of detail:

Executive summary: a 0–100 score and letter grade (A–F) so non-technical stakeholders can understand posture at a glance.
Agent summary: per-domain scores and check state distributions (pass, fail, n/a, skip).
Detailed findings: each issue includes the file, line number, severity, description, code snippet, and a concrete remediation recommendation.
Coverage metadata: files in the tree, files eligible, files actually scanned, bytes scanned, and anything skipped or truncated, for audit traceability.

Try the sample report

Open cerberus-report.html to see the exact layout, severity badges, and recommendation format your team will receive.

Quickstart & CI/CD

The web app needs nothing installed — open Cerberus Agent and paste a GitHub URL. The CLI runs the same 59-check native catalog and can append ALIGNMENT, feeder, and policy sections while preserving the legacy cerberus.report/2 fields.

python3 examine.py <path-or-github-url> --html report.html

To run Cerberus automatically on every pull request and push, see our complete GitHub Actions Setup Guide or the CI Scanner Reference.

Cerberus Examination vs. Watchdog

Service	When to use	Deliverable
Cerberus Examination	Pre-launch, pre-fundraise, pre-sale, or after a major refactor.	One-time scored HTML report with remediation guidance.
Cerberus Watchdog coming soon	Continuous assurance on production repos and deployed apps.	Always-on agents that re-scan on every push or deployment.

Navigating the documentation

Use the sidebar to jump between sections, or start with the four pages most teams read first:

Agent Swarm — the architecture and every agent’s responsibilities.
Check Catalog — the complete checklist of checks, IDs, and pass criteria.
CLI Scanner — how to install and run the local scanner.
Severity & Scoring — how the final score is calculated and why.