Resources

Ghost Agents 01: Getting started

Deploy Ghost Agent Platform on a host you control, with the AWS Terraform module or Docker Compose on any Linux server. Claim your instance, connect your first model, and watch your first agent run live.

Ghost Agents 02: Workspaces & access

Organize teams into workspaces, invite members with single-use links, and give each person the right role. Add two-factor authentication, scoped API keys, and an audit log of every change.

Ghost Agents 03: Connectors

Connect the models, credentials, MCP servers, and apps your agents rely on. Agents never hold a secret: they carry an opaque run token, and the credential proxy injects the real credential only on its allowed hosts.

Ghost Agents 04: Skills & environments

Package know-how as versioned skills, and roll back to an earlier version in one click. Bundle a model, credentials, skills, and variables into an environment, and every run gets a fresh copy of it.

Ghost Agents 05: Building agents

Start from 130 ready-made agent templates, or build your own from tasks and workflows. Pick the right model for each step, add conditions and memory, and bring people in with approvals, questions, and notifications.

Ghost Agents 06: Triggers & channels

Start agents on demand, on a schedule, or from a verified webhook. Keep your team in the loop in the tools they already use, with live status updates, approvals, and answers right from the thread.

Ghost Agents 07: Workers & add-ons

Every run gets its own isolated worker, with exactly the tools it needs. Run worker pools side by side, build custom add-ons from simple install steps, and let skills suggest what they need.

Ghost Agents 08: Guardrails

Set token budgets by the hour or the day, decide where agents can reach, and keep every credential scoped to its hosts. Stop any run on the spot, with its output and events kept for review.

Ghost Agents 09: Observability

Follow every run's output and events as they happen, then replay any run on its own clock. Track token usage, network traffic, logs, and an audit log of who changed what.

Ghost Agents 10: Outcomes

Turn the metrics your agents report into results you can track against a target. Build views across workflows, see when a number can't be trusted, and trace every value back to the runs that produced it.

Ghost Agents 11: MCP

Connect your coding agent to Ghost over MCP with a scoped API key. Describe an agent in plain words or start from a template, then build, run, and approve it from the same conversation.

Ghost Agents 12: Updates & operations

Upgrade the whole platform from the app, and roll back if a release goes wrong. Manage instance settings, check service health, forward logs to the platform you already use, and keep your data backed up.

OMCC: Can open-source AI models autonomously hack?

We benchmarked an autonomous hacking agent driven by the latest open-weight AI models against three vulnerable web apps we built — 432 runs across eight models, three knowledge conditions, and three trials each — measuring what they could actually break into. Stripping a model's safety training added no offensive capability.

• Security

An engineering blueprint for durable agents

How to architect durable security agents that can run safely in production.

• agents

Reaper

An open-source MITM HTTPS proxy that intercepts and logs web traffic to a local database, with a CLI for searching captured requests during application security testing.

• Security

Wraith

An open-source dependency vulnerability scanner that wraps osv-scanner with a friendly CLI and Go library, built for both humans and AI agents.

• Security

Poltergeist

A high-performance open-source secret scanner that uses Vectorscan/Hyperscan multi-pattern matching to find exposed credentials in source code.

• Security

AI Skills

Ghost Security's collection of AppSec skills for AI coding agents — a plugin marketplace bringing vulnerability scanning, secret detection, and code analysis to Claude Code.

• Security

VulnBench: Can LLMs Fix Real-World Security Vulnerabilities?

We tested 16 frontier language models on real CVEs from the GitHub Advisory Database. The best model patches 22.5% of the curated subset; the median fixes ~1 in 30 of the full 1,650-instance benchmark.

• Security