Achilles

A free, private cybersecurity AI code assistant. A harness, not a wrapper.

Rancero owns and distributes Achilles (GitHub), a native desktop application (Windows, macOS, Linux - Rust core, Electron shell) that runs tools, talks to models, and includes application-security scanning as a first-class technical preview. Everything runs on your machine: your code, your findings, your model keys, and your history stay in local storage rather than someone's cloud.

This page is the overview and architecture. Companion pages cover MCP, Skills, and Recipes, the headless CLI, and building from source and troubleshooting.

What it is at a glance

Aspect	Detail
Product	Achilles, a desktop agent harness with an AppSec technical preview
License	Apache 2.0, fully open source, 100% free
Platforms	Windows (AchillesSetup.exe), macOS (Apple Silicon and Intel .dmg), Linux (.deb, .rpm, .flatpak)
Core	Rust agent runtime wrapped in an Electron desktop shell
Models	Bring your own: Claude, ChatGPT, Gemini, OpenCode, OpenRouter, Grok, Ollama, Z.AI, or any OpenAI-compatible endpoint. Keys stay local.
Cost	FAST scan mode can cost as little as pennies. Investigate and Deep are capped and token-efficient.
Data	Local SQLite ledger (achilles.db). No site uploads your code.
MCP	Achilles exposes its AppSec tools over Model Context Protocol so Cursor, Claude Code, Codex, or OpenCode can read the ledger directly

Philosophy: engines write, the model judges, the ledger remembers

Three design commitments separate Achilles from a chat wrapper or a raw-prompt baseline:

1. Engines do the deterministic work. Scanning, secret matching, dependency lookups, and surface checks are performed by dedicated engines on your machine. The model is placed on top of engine output to reason about specific findings, never sent generic repo dumps.
2. The ledger is the record. Every scan run, finding, triage decision, and engine execution lands in a local database with stable identities that persist across rescans.
3. Find and patch stay separate. Achilles finds, triages, and briefs. Your editor or coding agent applies the patch. This pairing keeps the expensive frontier model out of most of the work and cuts hallucination because the model reasons over confirmed evidence.

The scan pipeline

flowchart LR
    A["REPO\nyour tree, untouched"] --> B["WALK\nnative index, ignore-aware"]
    B --> C["ENGINES\nmulti-engine, deterministic"]
    C --> D["LEDGER\nachilles.db, local"]
    D --> E["FINDINGS\ntriage rail"]
    E --> F["FIX\nfix brief, chat, MCP"]

1. Walk. Achilles indexes the workspace using ripgrep-compatible ignore rules, so .gitignored directories, node_modules, and vendor trees are skipped the same way they are in your editor. The walk builds a file and function inventory used by every downstream stage and by Code Map.
2. Engines. Multiple engines run over the walk in one pass. Each writes structured findings with path, line, evidence snippet, severity, and engine name.
3. Ledger. Findings land in achilles.db. Findings are deduplicated across rescans with stable handle ids, so "new" and "now fixed" states survive you closing the app.
4. Findings rail. The desktop app shows a durable Findings rail alongside the chat transcript. This rail is the system of record.
5. Fix. Copy a fix brief, ask a follow-up question, or let your MCP-enabled agent read the ledger rows directly.

Scan modes

Depth is a dial, and cost stays capped in every mode.

Mode	What runs	Cost profile
Fast	Engines do the deterministic work; the model only judges.	Extremely token-efficient, as little as pennies
Investigate	Engines plus an agent loop over ledger ids: an investigator reviews up to 80 SAST hits, then a validator double-reviews. No new findings.	Capped context, no repo dump
Deep	Investigate-style review of up to 250 reviews plus up to 160 heuristic function units. New agent-unit findings must quote shown source.	Up to 16k-file walk, still context-capped (at most 24 heuristic units and at most 8 turns)

Investigate and Deep run the investigator then validator pattern: the model may not invent findings, and validator verdicts must quote the shown source to stand.

Two scan scopes cover most needs: full tree (default; full-tree scans also check local git history for secrets) and changed files (git diff only, great for pre-commit review; note SCA still reads lockfiles regardless of scope).

Engine coverage

secrets

Detects leaked credentials in the working tree and, on a full scan, in local git history. Coverage includes AWS keys, GitHub and GitLab PATs, Slack, Stripe, Google, npm, Hugging Face, Anthropic, Postgres and Mongo URLs, Vercel, Railway, DigitalOcean, PEM blocks, and webhooks. Findings are shown as redacted previews capped at 200 hits. This engine is explicit about its limits: it is not a vault resolver and it does not promise complete coverage.

sast-lite

Regex-lite, line-oriented dangerous-code detection with extension tagging for C/C++, Python, JS/TS, Go, PHP, Java, C#, Ruby, and Rust. It flags patterns like gets/strcpy, eval/pickle/yaml.load, innerHTML assignment, string-built SQL, and Runtime.exec. Achilles is upfront that this is not Joern or CodeQL: there is no taint analysis or interprocedural resolution. It is a first pass you will actually run, not a proof of exploitability.

sca

Reads package-lock and yarn files, requirements.txt and Pipfile.lock, Cargo.lock, go.sum, Poetry, Bundler, and Composer manifests, then queries OSV for known vulnerabilities. On top of CVE lookup it reports pinning problems (unpinned versions, missing lockfiles) and hygiene issues (lifecycle install scripts and distance-1 typosquat names). CVE context and KEV/EPSS intel are injected so the model or the reader can judge exploitability. With a Socket token configured, optional supply-chain alerts on the same packages arrive from Socket's risk, capability, quality, and license feed.

fingerprint, surfaces, boot, harden

These engines inventory and check the deployable configuration of your tree: GitHub Actions, GitLab, Circle, Azure Pipelines, Jenkins, Terraform (AWS/Azure/GCP), Kubernetes and Helm, Docker, Cloudflare Workers, Vercel, Netlify, Railway, Fly, Firebase, Ansible and more. surfaces then detects risky patterns in those files: pull_request_target, curl-pipe-shell, write-all / persist-credentials, 0.0.0.0/0, public S3 buckets, privileged containers, :latest tags, root users, and permissive CORS. harden is detect-only; it never auto-fixes. This is not a live posture scan and not a DAST product by default.

Code Map

Read-only exploration built from the same walk as the scan. Three views: functions by file (the handler exists, where is it), the call graph (trace a finding's sink backwards to the source), and routes and templates (which HTTP endpoint renders which view and where that XSS sink is actually reachable). No LLM, no invented graph, no chat upload. Code Map is navigation; findings remain the system of record.

The ledger schema

The ledger is a SQLite database named achilles.db. Its tables are the product's memory:

Table	What it stores
engageements / engagements	Workspaces you opened
assessments	Each scan run, with its parent run and new/gone deltas
findings	Path, line, evidence snippet, severity, engine
finding_events	Triage history over time
engine_runs	What ran and when
handle_index	Stable finding ids across rescans
intel_cache	KEV/EPSS write-through cache
coverage_snapshots	What the walk actually saw
candidates	Heuristic units produced for Deep
work_units	Stack playbooks

The Findings rail and triage

Findings are the system of record. For every finding you can:

• Confirm it as a real issue, or mark it a false positive.
• Open it at its source file, mapped visually to its function and callers.
• Copy it as a fix prompt - an importable fix brief with impacted paths, lines, functions, evidence, severity, recommended next steps, and triage resolution criteria, ready for your editor or agent to use.

Triage states persist across rescans in the ledger, so a disagreement you resolved once stays resolved unless the finding changes.

What Achilles does not do

Honesty about scope is part of the design brief:

• It does not apply patches. You or your agent apply them, guided by a brief or by the ledger over MCP.
• SAST-lite is heuristic. Findings must be verified; that is what triage is for.
• Secrets matching is pattern-based, not a full vault audit.
• Surface checks are detect-only against files that exist in your tree; no live probing.
• Achilles is a technical preview, not a finished product. There will be rough edges.

Try it

1. Download a desktop installer from achilles.sh (see building and troubleshooting for unsigned-installer warnings).
2. Configure a model if onboarding asks. Fast mode is extremely token-efficient either way.
3. Pick a workspace, hit Scan, and start triaging the Findings rail.

For repositories to practice on, the repo ships examples/achilles-scan-fixture and examples/achilles-fixtures with documentation-shaped example values, never real credentials.