Rokkhe is an AI penetration tester and security-operations workspace. Map your attack surface, validate real risks, and review the evidence, proposed fixes and retests in one record.
GitHub
GitLab
SlackEnabled per deployment.
Each finding keeps its scope, proof, proposed fix and retest result in one place.
A potential access boundary issue needs review. Keep the hypothesis separate from the evidence that confirms it.
Targets and exclusions defined by the team
Reproduction record and artifacts awaiting validation
Review the evidence before assigning severity
These examples contain no live findings or assessment results.
Review a proposed fix as a GitHub pull request, with the finding that prompted it attached.
Remediation workflowsReview source events, related context and agent hypotheses before deciding what happens next.
Security operations
curl --proto '=https' --tlsv1.2 -fsSL https://rokkhe.com/install.sh | shReview the installer before running it locally. The installer verifies the release checksum. See the CLI guide for requirements and setup.
Connect to your deployment, check its readiness and inspect retained evidence from the CLI.
CLI referenceDefine deployment, inference and retention boundaries around the infrastructure your team operates.
Deployment guideEach approval is recorded with the evidence it was based on.
Read the security modelEach briefing is checked against the vendor advisory, CISA's catalog and the original research: who is affected, how to check and how to fix it.
All security briefingsRokkhe brings authorized pentesting and security operations into one workspace. Define an assessment, review findings and their evidence, investigate alerts, and track remediation with the team that owns the system.
A scanner flags patterns that look exploitable; a pentest tries to exploit them. Rokkhe’s agents map routes, parameters, auth flows and dependencies, then attempt a proof-of-concept from a container sandbox. Each finding keeps its proof and request trace. A model proposal remains a proposal until its evidence supports a finding.
Hosted at rokkhe.com in Google Cloud’s Paris region, or self-hosted on a Linux host with Docker Compose. Enterprise deployments can run in your own cloud or on-premises.
Git repositories in the hosted workspace. Self-hosted deployments and the CLI can also test live web applications, local source and IP addresses you are authorized to test. Cloud security findings arrive as alerts from AWS Security Hub, GuardDuty and Google SCC.
The one you choose. You bring your own key for OpenAI, Anthropic, Google, Z.ai or another provider the engine supports, and model spend stays on your account.
Rokkhe does not publish fixed prices. Evaluation, Team and Enterprise plans are each quoted after scoping where Rokkhe runs, what it may reach, who approves its actions and which model path it uses. Model spend stays on your own provider account.