Sandchest

Open source alternative to Snyk, Semgrep, Aikido Security and Gecko Security

50 stars
AGPL-3.0
Active this week
Last commit today

Last verified Nov 4, 2026

Secure your repos with an AI code reviewer using abliterated, unrestricted models to find real exploitable vulnerabilities.

Visit website GitHub50 Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Sandchest is for#

Teams using AI coding agents for code review

Teams that already use Claude Code, Cursor, or Codex get Sandchest findings directly in the same workflow. The MCP server lets you trigger scans, read findings, and apply fix prompts without leaving your coding agent interface.

Skip if:

Your team is not yet using AI coding agents and your code review process is entirely manual. The fix prompt and agent integration are the core workflow. Without an agent to paste prompts into, you get findings but lose the fastest path to applying them.

Development teams building auth, billing, or data-handling code

Teams whose code handles billing, authentication, or customer data get a scan that reasons about access control, injection paths, and data exposure from the perspective of an external attacker. Findings include CWE classifications and step-by-step attack paths that can be attached to audit records.

Skip if:

Your compliance requirements mandate specific scanner tooling on an approved vendor list. Sandchest finds real exploitable vulnerabilities but does not yet have the certification profile that some procurement processes require.

Organizations self-hosting for code confidentiality

Organizations that cannot send source code to third-party services can run Sandchest on their own infrastructure. The self-hosted install routes code only to GitHub and the model endpoint you control. There are no plans, credits, or outbound calls to Sandchest's servers.

Skip if:

Your team lacks the infrastructure to run a machine with 2 CPUs, 4 GB of RAM, a public HTTPS address, and a separate model endpoint. The hosted version at sandchest.com handles the infrastructure and reduces setup to installing the GitHub App.

Open source maintainers protecting public repositories

On public repositories, Sandchest posts only a check result to the pull request and keeps finding details in your private dashboard, so sensitive attack paths are not exposed in public review threads. The GitHub App installs in a few clicks and the first deep scan is free.

Skip if:

Your project has limited maintainer bandwidth for reviewing security findings. Each finding requires reading an attack path and deciding whether to apply the fix prompt. High-volume projects may generate more findings than a small team can triage.

the problem

The problem it solves#

Most code security scanners flag patterns, not paths. They match known vulnerability signatures against your code and report what looks wrong, leaving you to manually verify whether the finding is actually exploitable. The result is a list that mixes real security holes with false positives, and teams learn to ignore the alerts.

The harder challenge is that attackers do not use polished, cautious AI assistants. They use open-weight models with the refusal behavior removed, models that think like an attacker holding your source code and will chain small bugs into real exploits. A scanner built on a constrained model is trying to find holes that an unconstrained model would find. That gap is where real vulnerabilities go unreported.

how Sandchest solves it

How it solves it#

Threat model mapping for every repo

Before scanning, Sandchest maps every repository the way an attacker would: it reads all routes, auth checks, sensitive data stores, and dangerous function calls. That threat map is the starting point for every pull request review and deep scan, so the hunters know where to look first.

Pull request reviews with per-line findings

Every pull request gets reviewed. Findings land as comments on the exact lines where the problem appears, each with the attack path, the proof of concept, and a fix prompt ready to paste into your coding agent. When you push the fix, Sandchest re-checks and closes the finding once the attack path is gone.

Deep scan with multiple attacker agents

A deep scan sends several specialized agents through your codebase at once: an outsider agent, a free-user agent, a fraudster agent, and an insider-threat agent. Each follows untrusted input from entry points to the code it can reach. A skeptic agent then tries to disprove each finding, and only results it cannot refute get reported.

Abliterated, unrestricted open-weight models

Sandchest uses abliterated, unrestricted models rather than stock AI assistants. Abliteration removes the refusal direction from an open-weight model's weights, leaving a model that is equally capable but does not hedge or refuse to follow an attack chain. This matches what real attackers are already running.

Proof of concept with every finding

Each finding includes the step-by-step attack path by file and line, the prerequisites for exploitation, a working proof of concept you can run, what any fix must guarantee and must not break, and a ready-to-paste prompt for your coding agent that includes a regression test.

MCP server and agent-first setup

Sandchest integrates with Claude Code, Cursor, Codex, and any MCP-compatible agent. Add the MCP server with one command and handle setup, deep scans, findings, and settings entirely from your coding agent without opening a browser.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Findings are verified before being reportedAfter the hunting phase, a skeptic agent tries to disprove each finding by pointing at the code that stops the attack. A finding can only be dismissed by naming that code, so what gets reported is verifiably reachable. This reduces the false-positive rate that makes most security scanner alerts ignorable.
Self-hosted with full code privacyThe self-hosted install runs on Docker Compose and sends nothing to Sandchest. Your code goes only to GitHub and to the model endpoint you configure. There are no plans or credits when you self-host, and the AGPL-3.0 license covers internal team and commercial use with no licensing fees.
Fix prompts with regression tests for every findingEach finding includes a prompt written for your coding agent that describes the attack path, states what the fix must guarantee and must not break, and requests a regression test. You paste it into your agent and push the fix. Sandchest re-checks on the next push and closes the finding when the attack path is gone.
Treats your own source code as untrustedSandchest's model is told it is an attacker holding your source code. It never runs your code or the exploits it writes. It also treats comments in the source as untrusted input, so a comment instructing it to look away from something gets flagged rather than obeyed.

Trade-offs

-Self-hosting requires a separate model endpointThe self-hosted install needs a machine with 2 CPUs and 4 GB of RAM, a public HTTPS address for GitHub webhooks, and an external model endpoint that handles chat completions with tool calls and strict JSON output. Sandchest is tuned for a fast abliterated model, so you also need to source and run that model separately.
-Early-stage project with a small communitySandchest was created in February 2026 and has 50 GitHub stars. It is an active project with its last push recorded on 2026-11-04, but it does not yet have the documentation depth or ecosystem of longer-established scanners like Semgrep.
-Deep scans consume credits on the hosted versionOn the hosted service, pull request reviews and deep scans consume credits. The first deep scan per repository is free, but subsequent full-codebase scans require a paid credit balance. Self-hosting removes this constraint entirely.

versus alternatives

Sandchest vs alternatives#

Sandchest vs Snyk

Snyk applies pattern-based static analysis against a database of known CVEs in dependencies and source code. Sandchest uses abliterated, unrestricted models to reason through your actual call chain and prove a path from input to exploit exists. The two tools find different things.

Snyk fits teams whose primary concern is known dependency CVEs with managed, enterprise-grade compliance reporting and no infrastructure overhead. Sandchest fits teams that need a reviewer finding novel business-logic vulnerabilities, broken access control, and injection chains that have no existing signature, and who are willing to run a model endpoint or pay per scan.

Sandchest vs Semgrep

Semgrep checks code against written rules, is fast, and gives teams control over what gets flagged. Sandchest does not use rules. Its agents follow data flow through your code and report only what they can prove is exploitable.

Semgrep is the stronger choice for enforcing custom code standards and known anti-patterns across a large codebase with low per-finding review overhead. Sandchest finds the holes that rules do not cover, particularly chained vulnerabilities and logic flaws, but each finding takes more review time because it carries a full attack path and proof of concept.

Sandchest vs Aikido Security

Aikido Security is a managed platform covering SAST, secrets detection, container scanning, and cloud posture. Sandchest focuses on code-level vulnerability finding with no container or cloud-posture features.

Aikido suits teams that want broad security coverage across code, containers, and cloud with one managed dashboard. Sandchest suits teams targeting depth over breadth: logic vulnerabilities, broken access control, and exploit chains that broad-coverage scanners miss. The self-hosted AGPL-3.0 install removes the managed-service dependency.

Sandchest vs Gecko Security

Gecko Security is a commercial AI-powered penetration testing service. Like Sandchest, it reasons about exploitability rather than matching patterns. Sandchest is AGPL-3.0 and can be self-hosted with your own model endpoint, keeping your source code off third-party servers. Gecko Security is a fully managed service with no infrastructure to provision. Choose Sandchest when open source licensing and self-hosting are requirements. Choose Gecko Security when you prefer a managed service and do not want to run a model endpoint.

install · quick start

Quick start#

bash

Self-hosting uses Docker Compose and requires a machine with 2 CPUs and 4 GB of RAM.

```bash
git clone https://github.com/CapSoftware/Sandchest.git
cd Sandchest/docker
cp .env.example .env
docker compose up -d --build
docker compose logs web | grep setup
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaScriptPythonRustTypeScript
Frameworks: Next.jsReact

frequently asked

FAQ#

What does it mean that Sandchest uses abliterated, unrestricted models?

Abliteration is a technique that removes the refusal direction from an open-weight model's weights. The result is a model that is as capable as before but no longer declines to follow an attack chain or write a proof of concept. Sandchest uses these models because attackers already use them, so a scanner that finds what a real attacker would find must run on what a real attacker runs. The process is explained in the README under "Why abliterated models."

Is Sandchest free to use?

The self-hosted version is free. It is AGPL-3.0 licensed, runs on your own infrastructure via Docker Compose, and sends nothing to Sandchest. The first deep scan per repository is free on the hosted service at sandchest.com. Subsequent deep scans consume credits, as do pull request reviews on the hosted version.

Can Sandchest run my code or the exploits it writes?

No. Sandchest only reads repositories you install it on and never executes your code or the proof-of-concept exploits it generates. Findings go only to people who can push to the repository. Comments inside your source code that instruct the scanner to ignore a finding are themselves reported as suspicious rather than obeyed.

What infrastructure does self-hosting require?

You need a machine with at least 2 CPUs and 4 GB of RAM, a public HTTPS address that GitHub can reach for webhooks, and a model endpoint that handles chat completions with tool calls and strict JSON output. Sandchest is tuned for a fast abliterated model, so you will also need to run that model at the endpoint. The full self-hosting guide, covering tunnels, reverse proxies, upgrades, and backups, is in the docker/ directory of the repository.

How is Sandchest different from Snyk or Semgrep?

Snyk and Semgrep match known vulnerability patterns in your code using static analysis and predefined rules. Sandchest uses abliterated, unrestricted open-weight models to reason about your code the way an attacker would, following untrusted input through your actual call chain and proving exploitability before reporting. Each finding includes a working proof of concept and a step-by-step attack path rather than a pattern match.

also worth a look