Features

Choose a workflow by target, then follow its setup and authorization requirements.

Target coverage

Target or task	Entry point	Guide
Web application or REST API	scan --mode web	Scan Workflows
AI/LLM endpoint or MCP target	scan with the appropriate mode	Commands
Source repository	review	Scan Workflows
Source plus a running application	scan --repo	White-Box Mode
npm, PyPI, Cargo package, or OCI image	audit --ecosystem	Scan Workflows
Focused source and vulnerability research	hunt, deep-review, and specialized research commands	Research Workflows
Kernel reproduction	kernel, verify, and research families	Kernel VM Verification
Compiled binary evidence	binary and the 0verse adapter	Research Workflows
Identity and offline relationship analysis	identity, adgraph, entragraph	Authorized Engagements
Stateful agent assurance	agent-assure	Adversarial Evals
Candidate evaluation and promotion	evolve	Improvement Plane

Live network testing requires authorization and scope. Source review may execute tools, download dependencies, and send model requests. Coverage depends on the target and available evidence.

CLI flags (scan)

See Commands for scan target, scope, model, budget, authentication, and output flags. Other commands have their own options.

Authenticated scanning

Use --auth for target credentials. Model credentials use separate environment variables. The scan command accepts a JSON value or a JSON file for bearer, cookie, basic, or custom-header authentication. Prefer a restricted file over putting a real token into shell history. See credential formats and Authorized Engagements for engagement preparation.

API spec import

scan --api-spec seeds endpoint knowledge from an OpenAPI or Swagger document. It does not authorize the described hosts or guarantee endpoint coverage. See the API recipe.

Export to GitHub Issues

scan --export github:owner/repo writes findings to the remote repository. Review the destination, permissions, and sensitive evidence before use. Integrations covers automation and publishing boundaries.

Runtimes

The model provider handles inference. The tool executor runs actions.

Configuration documents runtime selection and fallback. API Keys documents supported providers, model routing, credential sources, and subscription authentication.

Executors and tools

The default shell path executes on the host. Optional Docker execution and specialized replay/VM paths have different isolation boundaries and prerequisites. Neither scope checks nor a cost ceiling is an OS sandbox.

Available tools depend on the workflow and feature settings. See Configuration for executor controls, Console for interactive approvals, and Research Workflows for tools that compile or execute untrusted programs.

Output formats

Supported formats vary by command. Core scan/review/audit flows expose terminal, JSON, Markdown, HTML, SARIF, and PDF output. A local report, a saved journal, and a deterministic verification result are different artifacts.

Scan Workflows explains how to inspect and retain results. Integrations covers CI and machine-readable output.

Triage pipeline

Candidate generation, automated verification, and human triage have separate evidence requirements. Available gates vary by target and workflow. See Finding Triage, Blind Verification, and Verification Results. Skipped or unavailable checks leave coverage unknown.

Agent loop enhancements

The agent loop supports budgeting, context management, tool use, and feature-gated research strategies. Agent Loop explains the control flow; Budget Management distinguishes turn limits from spend limits; Configuration owns feature settings and defaults.

Use Console for interactive work. Desktop is development-only alpha; see Roadmap for status.

Advisory evaluations

Jev assistance is opt-in for browser exploration, memory ranking, duplicate assessment, finding prioritization, EGATS specialist selection, and red-team feedback. It does not verify a vulnerability, authorize an action, or replace the existing verification path.

Set ZERO_JEV_FEATURES to the selected comma-separated features: browser, memory, dedupe, rank, specialist, redteam, kernel, crash, radar, or foxguard. Credentials alone do not enable assistance.

Setting	Behavior
ZERO_JEV_PROVIDER	vercel by default (your own gateway key); cloud routes through the managed endpoint and bills workspace credits
AI_GATEWAY_API_KEY / ZERO_JEV_CLOUD_TOKEN	Credential for the selected provider; keep it out of command history
ZERO_JEV_TIMEOUT_MS	Per-request timeout; default 10000
ZERO_JEV_MAX_REQUESTS	Per-evaluator request limit; default 100
ZERO_JEV_MAX_COST_USD	Per-evaluator estimated budget; default 0.10, not a customer invoice or whole-scan ceiling
ZERO_JEV_BROWSER_READ_ONLY_URLS	Exact comma-separated URLs approved for assisted navigation; engagement scope still applies

After configuring the provider credential:

env ZERO_JEV_FEATURES=memory,dedupe \
  0 scan --mode web --target https://app.example.test --scope ./scope.json

Assistance sends selected observations to the evaluator. Browser assistance hands forms, authentication, writes, and ambiguous decisions back to the main agent. Unavailable evaluations retain the existing decision path rather than inventing a result.

These paths have different effects:

• Browser: browser action assist follows captured links only when the exact URL is operator-approved and in scope, the page is unchanged, and the selection probability is at least 0.95. It returns a handoff, not a finding.
• Memory: ranks prior human-review context; the verifier still has to assess current evidence. Prepared feedback remains scan-local.
• Dedupe: can add canonical/cluster mappings for high-confidence exact-location, same-defect, same-fix pairs. Original evidence is retained; ambiguous pairs use the existing model dedupe path.
• Rank: scores exploitability, impact, and evidence strength independently, then orders final canonical findings by their equal-weight mean. Duplicates stay with their canonical. All selected levels must have probability at least 0.8; an uncertain or failed batch abandons all partial Jev scores and uses the existing generative ranker. Vulnerability confidence and verification state are unchanged. finding_priority events retain scores/model provenance.
• Specialist: inside native scan --egats, selects one of the existing six methodologies or stays generic. Specialist selection requires probability at least 0.8. Generic, uncertain, or malformed answers are not overridden by keyword matches; request failures retain the existing flag-gated regex route. Selection changes methodology, not scope or exploit evidence.
• Redteam: records advisory attempt labels and evaluator usage. Regex/LLM judges, or the separate action oracle in agent assurance, retain the verdict.

Invalid feature names, missing credentials and invalid budgets are configuration errors, not a promise of silent fallback. Request failures have no automatic retry or substitute chat-model fallback. Evaluator usage is separate from main-model usage; evaluator request budgets reserve estimated request cost. Agentic ranking and specialist evaluations also contribute to the shared scan token-based cost ledger and obey scan cancellation and its total spend ceiling. Ledger pricing uses its model price table and falls back to default token rates when an evaluator model is absent; reconcile against provider invoices. The 0.8 gates are pilot policies, not measured security-domain calibration.

The shared evaluator API also recognizes the kernel feature, used by the 0sec kernel jev-prepass command. That support alone does not wire an automatic kernel prepass into the assessment commands described here.

Managed workers receive a separate scan-bound capability and endpoint from the service. Installing this engine does not enable managed execution, establish account entitlement, or prove that a deployed worker uses this version.

Benchmarks

Published benchmark scores, configurations, and caveats are in Benchmarks and Methodology. Historical research results are not current-target guarantees.

Related products

See Integrations for connected tools and managed work for separate scoping, access and terms. The interactive console uses your model connection. See Commands for the full CLI reference.