ZyraSecby Zyra Labs
Workspace Join waitlist

Security, connected.

Your servers. Your packages. One clearer view.

ZyraSecOne shared report format
Select a connection to explore

Local checks. A shared view. A model you choose.
Connect the pieces without handing over control.

Join the waitlist Explore the preview
Public beta

Read-only checks with uploads you control.

See what’s available

A small footprint.
A connected system.

Start with what’s running. Check it against known advisories. Bring the results together, then choose your next step.

Your environment

Local collectors
Linux VPSOS packages + selected checks
npm projectDirect + transitive dependencies
No source code collected
One local reportzyrasec.report/v1Inventory · findings · coverage
Advisory check

--online queries OSV.
Reuse a matching cache offline.

Local plan command

Report → suggested fix.
Invoked on request.

Chosen endpointLocal or remote modelPlan only · keys stay local

Optional hosted workspace

Your workspace

Servers and projects,
in one private view.

Open workspace

Inventory runs without AI. Remote checks, sync, and model calls are separate, explicit operations.

Know exactly what’s running.

The Linux collector and npm CLI take a local inventory and save a shared JSON report. Normal scans don’t need a network connection or a model.

See the collectors

Clarity includes
what you don’t know.

A clear result means no matches in the scope you checked. Missing inventory, unsupported packages, and stale advisory data stay visible.

See the example workspace
How to read a reportScope, always visible

Clear in scope

No known matches in current checked inventory.

!

Review needed

An advisory or configuration observation needs you.

?

Unknown

Not checked, incomplete, or no longer fresh.

A report is evidence to review, never a guarantee of security.

Open by design.
Yours to configure.

Small, inspectable collectors. MIT-licensed source. Bring a local model, an OpenAI-compatible endpoint, or Anthropic when you want help making a plan.

  • Normal scans run without AI
  • Provider keys stay on your machine
  • You decide what leaves your environment
Explore the source
Local / read-only 
# Download, inspect, then run.
curl -fSLO __ZYRASEC_PUBLIC_URL__/downloads/zyrasec.py

python3 zyrasec.py scan \
  --output host-report.json

# Inventory saved locally.
# No system changes. No model call.
Python 3 · No third-party dependencies
Read installation and scope notes

Open tools.
Room to grow.

Start with the preview. Help shape a hosted service that makes sense for the size of your stack.

Local collectors

Inspect, run, and adapt the MIT-licensed tools.
Bring your model; pay your provider only when invoked.

FreeAvailable now

Hosted workspace

A free one-server tier, then plans for growing stacks.
Team and agency controls are planned.

In developmentProposed paid plans

Hosted agents

Optional model credits with usage caps.
Local scans would remain independent of agent usage.

PlannedUsage-based concept

Self-hosted beta. No payments or hosted model billing. Commercial plans are proposals, not active subscriptions.

A little more
under the hood.

What actually runs offline?

Local inventory and selected configuration checks run offline. You can reuse a matching advisory cache offline. Fetching fresh advisories, syncing reports, and using a remote model require a connection and an explicit command.

Will it change my server or packages?

Repairs are optional. ZyraSec collects inventory and observations and can ask your chosen model for a remediation plan. A separately enabled VPS agent can apply approved APT updates; GitHub Actions can open tested repair PRs. Automatic policies are off by default. Model text is never executed as a shell command.

What leaves my machine?

A plain scan stays local. An explicit OSV request sends package identities and versions. Sync uploads the report to your private workspace. The separate planning command sends a bounded set of findings and coverage information to your chosen endpoint. Source code and keys are excluded from collector reports. Optional repository/model connections store encrypted credentials on your own central server.

Can I use my own model?

Yes. Configure an OpenAI-compatible endpoint, including a compatible local model, or the Anthropic Messages API. The adapters are open source. Planning happens when you invoke it; your provider’s usage charges may apply.

What can I try today?

The Linux collector, downloadable npm CLI, browser-local report demo, self-hosted accounts and dashboard, central email alerts, CVE tracking, serverless reporting, and approved package repairs. MFA, shared-team roles, billing and automatic rollback are not included in this beta.

Build more.
Worry less.

We’re building ZyraSec for the people looking after their own stack. Join the early-access list and help decide what comes next.

A project from Zyra Labs

Get early access.

Product updates, straight from Zyra Labs.

No payment details. Unsubscribe from future updates at any time.