Glasswing Mini

glasswing-mini

An open-source, homebrew take on the idea behind Anthropic's [Project Glasswing](https://www.anthropic.com/glasswing): an autonomous agent that reads a codebase and hunts for security vulnerabilities.

Glasswing proper uses Claude Mythos Preview, an Anthropic-gated model. `glasswing-mini` uses any Claude model you have API access to (defaults to Sonnet 4.6), runs locally, and finds high-signal issues in JS/TS codebases.

It won't match Mythos Preview's ceiling. It will find real bugs in real code, today, for the price of a few cents of tokens per scan.

What it does

Given a path to a JS/TS repo, the agent:

1. Lists the repo to get the lay of the land
2. Plans the attack surface based on framework + entry points
3. Greps for dangerous sinks (RCE, SSRF, SQLi, path traversal, prototype pollution, auth bypass, XSS)
4. Reads the code around each hit and traces data flow from source (request input, env) to sink
5. Records findings with location, data flow trace, proof-of-concept, and suggested fix
6. Writes a Markdown report

Install

git clone https://github.com/carrmjw/glasswing-mini
cd glasswing-mini
npm install

Requires Node 20+ and `ripgrep` on `$PATH` (macOS: `brew install ripgrep`).

Use

export ANTHROPIC_API_KEY=sk-ant-...
npx tsx src/cli.ts scan ./path/to/your/repo --focus=rce,ssrf,sqli --i-own-this

Or build and install globally:

npm run build
npm link
glasswing scan ./path/to/your/repo --focus=rce,ssrf --i-own-this

Options

Flag	Default	What
--focus	all	Comma-separated: rce,ssrf,sqli,xss,path,proto,auth
--max-steps	30	Agent step budget (tool calls + think steps)
--model	claude-sonnet-4-6	Anthropic model ID. Use claude-opus-4-7 for harder targets
--out	reports/.md	Report output path
--json	off	Also emit .json with raw findings
--i-own-this	required	Ethics gate — se