APEX — Autonomous Path EXploration

Find vulnerabilities. Fix coverage gaps. Automatically.

APEX is a Claude Code plugin that scans your codebase for security gaps, dead code,
and untested branches — then writes the tests to fix them. 63 detectors, 11 languages,
zero config. Works as both a CLI tool and a set of AI agents inside Claude Code.

Validated against: Linux kernel · Kubernetes · CPython · TypeScript compiler ·
ripgrep · Spring Boot · .NET Runtime · Vapor · Rails · ktor

Found a hardcoded EC private key in Kubernetes (CWE-798).
Scanned the Linux kernel in 4 minutes. 0 crashes across 12,656 findings.

Full validation report →

Quick Start

1. Install the binary

# macOS / Linux (auto-detects platform, no sudo needed)
curl -LsSf https://github.com/sahajamoth/apex/releases/latest/download/apex-cli-installer.sh | sh

# Windows
powershell -ExecutionPolicy ByPass -c "irm https://github.com/sahajamoth/apex/releases/latest/download/apex-cli-installer.ps1 | iex"

# From source (needs Rust toolchain, ~5 min)
cargo install --git https://github.com/sahajamoth/apex

# Nix
nix run github:sahajamoth/apex

Package registry publishing (npm, Homebrew, pip) coming soon.

2. Install the Claude Code plugin

# Add the APEX marketplace (GitHub repo)
claude plugins marketplace add sahajamoth/apex

# Install the APEX plugin from it
claude plugins install apex@apex

Or from a local clone:

git clone https://github.com/sahajamoth/apex.git
claude plugins marketplace add ./apex
claude plugins install apex@apex

3. Run

# In Claude Code:
/apex init      # Auto-detect language, venv, toolchain
/apex           # Full analysis: coverage + security + intelligence
/apex detect    # Security scan (63 detectors, 40+ CWEs)
/apex hunt      # Bug hunting in uncovered code
/apex deploy    # Deploy readiness score

APEX agents detect your environment, install missing tools
(via uv, bun, mise), run coverage, write tests, and produce reports.

Not using Claude Code? See Standalone Installation
for CLI binary, GitHub Actions, and CI/CD setup.

What APEX Finds in Real Projects

The output below is from Claude Code running the /apex command.
APEX agents orchestrate the full analysis cycle automatically.

> /apex

  ╭──────────────────────────────────────────────────╮
  │  APEX — Autonomous Path EXploration              │
  │  Target: ./your-project  (Python, 847 branches)  │
  ╰──────────────────────────────────────────────────╯

  Round 1/5 ─────────────────────────────────────────

  Coverage: 62% → 71% (+9%)
  +142 branches covered | 203 remaining | 8 tests written

  Round 5/5 ─────────────────────────────────────────

  Coverage: 71% → 94% (+23%)
  Final: 798/847 branches covered
  Tests written: 31 new tests across 6 files

Then ask Claude for intelligence:

> /apex intel

  ┌─ Test Optimization ──────────────────────────────┐
  │  312 tests → 94 minimal set (3.3× speedup)       │
  │  218 tests are redundant — same branch coverage   │
  └──────────────────────────────────────────────────┘

  ┌─ Dead Code ──────────────────────────────────────┐
  │  23 branches in 4 files — never executed by any   │
  │  test or production path                          │
  │                                                   │
  │  src/billing.py:89   unreachable after refactor   │
  │  src/export.py:34    legacy XML path, 0 callers   │
  │  src/api.py:201      dead error handler           │
  └──────────────────────────────────────────────────┘

  ┌─ Flaky Tests ────────────────────────────────────┐
  │  2 tests show nondeterministic branch paths       │
  │                                                   │
  │  test_concurrent_upload — race in file locking    │
  │  test_session_timeout  — depends on wall clock    │
  └──────────────────────────────────────────────────┘

  ┌─ Security ───────────────────────────────────────┐
  │  src/auth.py:67  — auth bypass: no token check    │
  │  on admin endpoint (reachable from test_api)      │
  │                                                   │
  │  src/config.py:12 — hardcoded secret:             │
  │  AWS_KEY = "AKIA..." (not from env)               │
  └──────────────────────────────────────────────────┘

  ┌─ Hot Paths ──────────────────────────────────────┐
  │  src/auth.py:45  — 12.3% of all branch hits      │
  │  src/db.py:112   — 8.7% of all branch hits       │
  │  These functions need the most test coverage.     │
  └──────────────────────────────────────────────────┘

  Deploy Score: 87/100 — GO

Why APEX?

Installation

Claude Code Plugin (Recommended)

# From GitHub
claude plugins marketplace add sahajamoth/apex
claude plugins install apex@apex

# Or from a local clone
git clone https://github.com/sahajamoth/apex.git
claude plugins marketplace add ./apex
claude plugins install apex@apex

This installs slash commands, 20+ AI agents, and 33 MCP tools.

Verify

In Claude Code:

/apex init      # Should detect your project and generate apex.toml
apex doctor     # Should show all green checks

Standalone CLI, GitHub Actions, CI/CD: See docs/STANDALONE.md

MCP Setup

APEX ships a Model Context Protocol STDIO server (apex mcp-stdio) so AI
coding assistants can invoke its analyses as tools. Production deployments
should configure a workspace boundary via APEX_MCP_WORKSPACE_ROOT or the
McpConfig struct. See docs/mcp-setup.md for the
full operator guide, defence-in-depth layers, and the DEFER-FE follow-up
model.

Commands Reference

All commands work both as Claude Code slash commands (/apex detect)
and as standalone CLI (apex audit --target . --lang python).
Full standalone docs: docs/STANDALONE.md

apex run --target ./project --lang python      # Coverage gap report
apex ratchet --target ./project --min-cov 0.8  # CI gate
apex doctor                                     # Check dependencies
apex audit --target ./project --lang python     # Security audit

apex index --target ./project --lang python --parallel 8

Runs each test individually under coverage, builds a map of test→branches.
Stored in .apex/index.json. Required before intelligence commands.

apex test-optimize --target .                  # Minimal test subset
apex test-prioritize --target . --changed-files src/auth.py
apex flaky-detect --target . --lang python --runs 5

apex dead-code --target .                      # Semantically dead code
apex lint --target . --lang python             # Runtime-prioritized lints
apex complexity --target .                     # Exercised vs static complexity

apex diff --target . --base main               # Behavioral diff
apex regression-check --target . --base main   # CI gate for behavior changes
apex risk --target . --changed-files src/auth.py
apex hotpaths --target . --top 20
apex contracts --target .                      # Discover invariants
apex deploy-score --target .                   # Aggregate confidence 0-100

apex docs --target . --output docs/behavioral.md

apex attack-surface --target . --lang python --entry-pattern test_api
apex verify-boundaries --target . --lang python \
  --entry-pattern test_api --auth-checks check_auth --strict

# Full transitive dependency tree snapshot (Cargo, npm, Go, PyPI, +4 more)
apex enterprise supply-chain-snapshot

# Diff two snapshots — detect what changed deep in the dependency tree
apex enterprise supply-chain-diff --from 1 --to 0

# Risk scoring with 9 signal types (checksum mutation, coordinated updates, etc.)
apex enterprise supply-chain-audit --threshold 5.0

Detects transitive dependency poisoning: A uses B, B uses C, C uses D — attacker
compromises D, and months later D propagates into A through natural update cycles.
Tree snapshots capture the full resolved dependency graph with depth, propagation
paths, checksums, and provenance per node.

Claude Code Integration

APEX integrates natively with Claude Code for an AI-enhanced workflow.
The standalone CLI works without any AI tooling — Claude Code adds
slash commands and auto-triggered agents on top.

Slash Commands

Auto-triggered Agents

These fire automatically when Claude Code detects a matching intent:

Strategy Selection

The /apex-run loop automatically picks the best strategy per gap:

Architecture

Rust workspace, 16 crates. Heavy dependencies (Z3, LibAFL, PyO3, Inkwell,
Firecracker) are behind feature flags — not compiled by default.

Analysis Mechanisms

APEX integrates fundamental mechanisms from established tools
(see docs/INSPIRATION.md for details):

cargo build --release --features "apex-symbolic/z3-solver,apex-fuzz/libafl-backend"

Configuration

# apex.toml
[coverage]
target = 1.0
min_ratchet = 0.8

[fuzz]
corpus_max = 10000
stall_iterations = 50

[agent]
max_rounds = 3

[sandbox]
process_timeout_ms = 10000

Contributing

See CONTRIBUTING.md for development setup and guidelines.

Bug reports and feature requests: GitHub Issues.

License

MIT