Plexicus Open Source Explorer

Explore the code.
Understand the risks.

A public directory of open source projects, AI agents, and developer tools. Review security evidence tied to the code that was actually checked.

Curated by Plexicus. Every published report starts with evidence.
PUBLIC REPOSITORY REGISTRY
3Listed repositories
0Completed reports
openclawopenclawAwaiting evidence
hermes-agentNousResearchAwaiting evidence
reamorlutoAwaiting evidence

The directory is taking shape. Repositories are listed below while scans await verified results. Pending findings are unknown. No findings detected does not guarantee a project is safe.

Continuous visibility

Scan activity

Runner enabled at last update09:00, 12:00, 17:00 · Asia/Jakarta

Follow scan progress and the code requested for assessment. Published findings appear in repository reports once their evidence has been checked.

Activity updated: 14 Oct 2026, 15:20 WIB

Discover / Assess / Decide

Repository directory

3 curated projects

AI agents

openclaw

openclaw

The AI that really does things. Any OS. Any Platform. The lobster way. 🦞

TypeScript 391,611
Scan pending

Findings unknown. A verified scan report is not yet available.

AI agents

NousResearch

hermes-agent

The agent that grows with you

Python 251,990
Scan pending

Findings unknown. A verified scan report is not yet available.

Developer tools

morluto

rea

Reverse engineer anything with agents, from app behavior down to native binaries.

TypeScript 16,536
Scan pending

Findings unknown. A verified scan report is not yet available.

Evidence before confidence

Know what a scan
actually tells you.

A security result is only useful when you can see what was assessed and where its limits are.

01 / SOURCE

A specific commit

Each report identifies the repository revision it assessed. New code can introduce new risks.

02 / COVERAGE

Clearly defined checks

See the engine, checks performed, and any excluded sources or incomplete work.

03 / FINDINGS

Results with context

Counts represent normalized scanner alerts. Source scans do not assess runtime behavior, MCP permissions, or prompt injection unless explicitly included.

YOUR CODE. YOUR NEXT STEP.

Bring security evidence
to your repository.

Start with a code scan and understand what needs attention.

Scan your repository
Qualification

Check whether AI Swarm Pentest fits your environment.

Share the minimum context. We will review the scope and tell you the next commercial step.

Before submitting — verify you fit

0 / 280

No commitment. If you don't fit, we'll tell you.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
Private Round For investors