FinLexPurple
FinLexPurple

Live on PyPI Pre-1.0, open source

Security findings you can actually prove.

A local, autonomous security agent for financial applications. A finding is marked verified only after code re-executes it, and each one ships with an evidence bundle anyone can re-check offline.

View on GitHub 
$ finlexpurple scan --target http://127.0.0.1:5000/
Recon: discovered 6 endpoints.
Scan complete: 18 findings (4 verified) across 6 detector calls.
[VERIFIED] sqli http://127.0.0.1:5000/lookup
[VERIFIED] ssrf http://127.0.0.1:5000/settings/fetch-logo
[VERIFIED] sqli http://127.0.0.1:5000/login
[VERIFIED] sqli http://127.0.0.1:5000/login
[REPORTED] idor http://127.0.0.1:5000/lookup
[REPORTED] xss http://127.0.0.1:5000/search
(+ 12 generic_misconfig, reported)
$ finlexpurple verify-bundle evidence/<finding>.bundle.json
content hash matches (sha256:5064009ee8dd56aad04f144d9e830a5d80228a24ccf025b8e13cc050412a8c05).
no signature to verify (signing mode: hash-only); integrity rests on the content hash.
OK: bundle verified.
Real output from the 0.3.0 release demo against a deliberately vulnerable local app. Condensed: the scope prompt and endpoint list are omitted, and findings are shown with their report badges.

What it is

Proof, not confidence.

FinLexPurple tests a financial app and everything it trusts, then keeps only the claims it can back with evidence.

  • Deterministic verification

    A finding is verified only when code replays it: a SQL error reproduced, an SSRF confirmed by an out-of-band canary. Never on a model's say-so. Every verified finding gets an evidence bundle that verify-bundle re-checks with no scan and no network.

  • Local and air-gapped

    Runs on your own hardware, fully local through Ollama, with cloud model providers optional. Egress is default-deny, iteration caps are on by default, and reports are written owner-only.

  • The whole surface

    One engagement for the app, its AI agents and MCP tools, its dependencies, and its containers. The web path runs end-to-end in scan today; the MCP, supply-chain and container modules run standalone.

    Coming soon Running all surfaces from a single scan.

Get started

From install to proof in three steps.

Requires Python 3.10 or newer.

  1. Install

    One package from PyPI. External scanners it wraps are optional and detected at runtime.

    $ pip install finlexpurple

  2. Check and configure

    See your hardware and installed tools, then pick a model provider and hardware tier.

    $ finlexpurple doctor --tools
$ finlexpurple setup

  3. Scan, then verify the evidence

    Scan a target you are authorized to test, then re-check any verified finding offline.

    $ finlexpurple scan --target https://app.example.com/
$ finlexpurple verify-bundle ./finlexpurple-reports/<run>/evidence/<id>.bundle.json

Installs

Counted without knowing who you are.

The counter is opt-in and private by architecture: there is nothing in it that could identify a person or a machine.

  • Each opted-in install sends one random local ID, generated once and not derived from your hardware, network, or name.
  • The endpoint stores only that ID with first- and last-seen times, and publishes nothing but the distinct count.
  • No IP, hostname, or scan data is part of the count.

Opted-in installs

—

Coming soon The live count arrives with the opt-in telemetry release.