# grayhat

> An AI gray hat that deep-scans your codebase, proves each exploit, then opens the pull request that fixes it.

## Changelog

- [A hacker on every pull request](https://grayhathacker.ai/changelog/v0-2-0): Every push now gets a security review, a targeted scan, exploits run in a sandbox, and, when the attack works, a pull request that fixes it.
- [Index and scan your whole codebase](https://grayhathacker.ai/changelog/v0-1-0): Install the GitHub App, pick your repos, and grayhat maps every entry point, guard and data flow, then attacks all of it in a first deep scan.

## Docs

- [Introduction](https://grayhathacker.ai/docs): grayhat is an AI gray hat for your own codebase. It indexes your repo, hunts it like an attacker, proves each exploit in a sandbox, then opens the pull request that fixes it.

### Get started

- [Quickstart](https://grayhathacker.ai/docs/quickstart): Install the grayhat GitHub App, choose repositories, and get your first security review on a pull request.

### Concepts

- [How it works](https://grayhathacker.ai/docs/how-it-works): A persistent security index tells the hacker exactly what changed. It ranks what to attack, but never decides what to skip.
- [Findings](https://grayhathacker.ai/docs/findings): Every finding is a confirmed exploit with a reproduction. Here's how to read one.
- [Supply chain](https://grayhathacker.ai/docs/supply-chain): A hijacked package has no CVE yet. grayhat reads the dependency code itself and diffs what it's capable of.

### Account

- [Credits](https://grayhathacker.ai/docs/credits): No seats and no repo limits. You spend credits only when grayhat reviews, scans or fixes something.
- [Security and data](https://grayhathacker.ai/docs/security): Consent-gated scanning, throwaway sandboxes, and what grayhat keeps about your code.

## RSS Feeds

- [grayhat — Changelog](https://grayhathacker.ai/changelog/rss.xml)

## Agent resources

- [llms-full.txt](https://grayhathacker.ai/llms-full.txt): The full Markdown of every page in one file.
- [Page Markdown](https://grayhathacker.ai/index.md): Append `.md` to any page URL to fetch that page as raw Markdown.
- [JSON API](https://grayhathacker.ai/api/docs/pages.json): Page index of the JSON docs API; each entry links the page's JSON and Markdown forms. Described by the OpenAPI document at https://grayhathacker.ai/openapi.json.
- [Agent skills](https://grayhathacker.ai/.well-known/agent-skills/index.json): Agent Skills discovery index of the skills this site publishes.
- [API catalog](https://grayhathacker.ai/.well-known/api-catalog): RFC 9727 linkset of the APIs documented here.
- [AI catalog](https://grayhathacker.ai/.well-known/ai-catalog.json): ARD manifest of the agent-facing resources on this site (MCP server, skills, APIs).
- [agent-readability.json](https://grayhathacker.ai/agent-readability.json): Manifest of every agent-facing artifact on this site.
- [Sitemap](https://grayhathacker.ai/sitemap.xml): Every indexable page URL with its last-modified date.