JoySafeter
The AI-native enterprise security Agent platform — not just chatting: build, run, test, and trace autonomous agent teams with visual orchestration.
Evidence shows multi-tenancy, per-user RAII sandboxes, RBAC, credential encryption (CREDENTIAL_ENCRYPTION_KEY) and detailed deployment hardening guidance in SECURITY.md — least_privilege and sensitive_data_handling score 2. Deductions: MCP arbitrary-code execution and external scanning actions rely on advisory text only, with no enforced confirmation gate (user_confirmation 1); the pentest agent autonomously executes auth-bypass attacks against authorized targets with only a sandbox-image note and no documented approval/rollback mechanism (external_effects 1, rollback 1); the Trivy scan runs with exit-code=0 and blocks nothing, making the dependency gate nominal (dependency_security 1). License and third-party attribution are clear (source_attribution 2).
Evidence shows CI covering pre-commit, ruff, mypy, ESLint, type-check, frontend tests and builds, frozen bun.lock installs, and a versioned image release flow; however the backend pytest step is commented out in ci.yml, so backend tests are not enforced in CI — deduct to 2. Error handling and 404 tests exist and backend errors are internationalized (failure_messages 2).
Evidence shows a well-defined audience (security teams, pentest, APK analysis) and rich deployment modes with port-conflict detection (audience_and_scenarios 2, environment_fit 2). Deductions: claims like 'zero manual intervention' and 'replacing 2-3 engineers' lack boundary statements about applicability, false-positive rates, or sandbox escape limits (capability_boundabilities 1); the auto-trigger for auth-bypass testing is described only narratively, without precise trigger documentation (trigger_precision 1).
Evidence shows a complete documentation set (INSTALL/DEVELOPMENT/ARCHITECTURE/CONTRIBUTING/SECURITY/CODE_OF_CONDUCT/CHANGELOG/THIRD_PARTY_LICENSES), a one-click script with port table and prerequisites (information_architecture 3, install_notes 3); full Apache-2.0 text (license 3); SECURITY.md lists known security considerations (known_limitations 2); CHANGELOG and bump-version.sh are referenced but their contents are not in evidence (versioning_changelog 2); naming is consistent across README/images/scripts (naming_stability 2); community support is WeChat-group based and maintenance SLAs are email-based (maintenance_responsibility 2); tutorial contents are referenced but not shown (examples_and_faq 2).
Evidence shows structured OWASP-aligned reports, Run Center event replay, and visual orchestration that plausibly deliver value for the target scenario; but report quality and analysis accuracy have no statically verifiable implementation detail in evidence and remain at the claim level (output_usability 2, marginal_value 2). Setup cost is high (Docker, DB, Redis, model config, sandbox image) with benefit claims plausible but documentation-only (cost_benefit 2).
Evidence shows that referenced CHANGELOG, tutorials and architecture docs are absent from the evidence set, and key claims ('replaces 2-3 engineers', '200+ tools') cannot be traced within provided files (claim_traceability 1). Partial cross-file consistency exists (deploy scripts match CI structure), scoring 2. Marketing language is heavily mixed with factual statements ('no engineer required', 'zero state leakage') without separation of inference from fact (fact_inference_separation 1).
- The pentest agent autonomously executes attacks such as auth bypass against targets; verify target authorization and network isolation before deployment, and audit the sandbox image provenance and contents.
- MCP tools can execute arbitrary code; only trusted MCP servers should be enabled. The Trivy scan does not fail the build (exit-code=0), so dependency vulnerabilities require separate auditing.
- The backend test step is commented out in CI; backend code lacks enforced automated testing. Run the backend test suite yourself before production deployment.
- README claims such as 'zero manual intervention' and 'replacing 2-3 engineers' are marketing assertions, unverified by evidence; do not infer actual capability from them for procurement decisions.
- CREDENTIAL_ENCRYPTION_KEY must never change once set, or existing encrypted credentials become unreadable; plan key management before deployment.
- Publisher identity is not registry-verified; the jd-opensource organization name alone does not constitute a reliability guarantee.
What does this agent do, and when should you use it?
JoySafeter, released under jd-opensource, is an enterprise AI Agent platform focused on AI-driven Security Operations (AISecOps). It ships a visual Agent Builder with drag-and-drop workflow editing (loops, conditionals, parallel execution) in two modes: Rapid Mode, which turns natural-language descriptions into running agent teams, and Deep Mode, which adds visual debugging and step-by-step observability. The platform comes with 200+ security tools (pre-integrated Nmap, Nuclei, Trivy, and more) extendable via the MCP Protocol with zero glue code, plus 30+ pre-built skills spanning penetration testing, document analysis, and cloud security. Execution is powered by LangGraph and DeepAgents with Manager-Worker multi-level collaboration, long/short-term memory evolution, and a versioned skill system; all runs flow through a unified event-sourced Run Center with full-chain tracing via Langfuse. Enterprise features include multi-tenancy with RBAC, SSO integration (GitHub, Google, Microsoft, OIDC providers, JD SSO), and RAII-based per-user sandbox isolation.
JoySafeter ingests user-uploaded artifacts (e.g., APK files) or natural-language task descriptions, invokes MobSF for static analysis and Frida for dynamic instrumentation to validate high-severity findings, or plans and executes penetration tests against an authorized target URL — then auto-generates structured reports (e.g., OWASP Mobile Top 10). Under the hood, every agent workflow is a stateful LangGraph graph that can pause, resume, and branch; Chat, Copilot, and Skill Creator share a single event-sourced run lifecycle (Run → Event → Snapshot) streamed over a unified WebSocket layer (BaseWsClient), with trace_id propagated via contextvars from the HTTP/WS entry point through LangGraph to persistence. Tools integrate through the MCP Protocol (mcp 1.20+, fastmcp 2.14+), code executes in per-user isolated Docker sandboxes, and model resolution uses canonical (provider_name, model_name) identifiers via ModelService → ModelFactory.
- Security engineers screening large volumes of APKs: upload a file and the agent autonomously runs MobSF and Frida to produce an OWASP Mobile Top 10 report, replacing a 2-3 engineer manual process
- Pentest teams with an authorized engagement: enable DeepAgents mode with penetration-testing skills in the Workbench; the agent auto-triggers auth-bypass testing when it finds a login page and delivers a final report
- Security leads consolidating a legacy toolchain: orchestrate Nmap, Nuclei, Trivy, and 200+ tools through the MCP Protocol without per-tool glue code
- Compliance teams needing audit trails: leverage execution tracing and full-chain trace_id propagation for governance requirements
- Security researchers debugging complex automation: use Deep Mode's visual debugging and step-by-step observability to inspect agent decisions
What are this agent's strengths and limitations?
- 200+ pre-integrated security tools (Nmap, Nuclei, Trivy, etc.) extendable via MCP Protocol with zero glue code — domain depth generic agent platforms lack
- Graph-based LangGraph execution supports pause, resume, and branch, combined with the event-sourced Run Center and real-time Langfuse tracing for glass-box observability
- Complete enterprise stack: multi-tenancy, RBAC, multiple SSO providers (GitHub, Google, Microsoft, OIDC/Keycloak/Authentik/GitLab), and RAII sandbox isolation — a direct path to production
- 30+ pre-built skills plus Rapid/Deep dual build modes significantly lower the barrier from idea to a running agent team
- The deployment stack is heavy: full operation requires Docker, PostgreSQL, and Redis, and the pentest case additionally pulls a dedicated sandbox image from a Huawei Cloud registry — non-trivial initial ops cost
- Core focus is security scenarios (vulnerability detection, pentesting); teams seeking general office or data-analysis automation must develop their own skills, and the README shows no such out-of-the-box capability
- Deep dependence on the LangChain/LangGraph/DeepAgents stack — migrating to another orchestration framework means rewriting workflows
- The two showcased cases (APK detection, pentesting) rely on third-party tools (MobSF, Frida) and require an authorized target for pentesting, so effects cannot be verified in unauthorized environments
How do you install or deploy this agent?
Prerequisite: Docker + Docker Compose. Recommended one-click launch:
./deploy/quick-start.shThe interactive menu offers:
(1) Docker Compose full stack (frontend, backend, PostgreSQL, Redis all containerized; localhost or remote IP/domain);
(2) Local frontend only (bun run dev, can connect to a remote backend);
(3) Local backend only (uvicorn --reload, remote DB/Redis supported);
(4) Local frontend + backend (auto-starts middleware).
Optional flags:
./deploy/quick-start.sh --skip-env # skip .env initialization
./deploy/quick-start.sh --skip-db-init # skip database initializationOther paths: ./deploy/scripts/dev.sh for development, ./deploy/scripts/prod.sh for production, ./deploy/install.sh for an interactive install wizard, ./deploy/scripts/check-env.sh for environment preflight. Full details in INSTALL.md.
How do you use this agent?
After launch, open the frontend at http://localhost:3000; the backend API is at http://localhost:8000 with Swagger docs at http://localhost:8000/docs. The typical user journey is 9 steps: Login → Configure Models → MCP Tools → Skill Management → Build Agent → Self-Test (Langfuse trace) → Publish → Chat UI → Run Center. The penetration-testing case requires the sandbox image swr.cn-north-4.myhuaweicloud.com/ddn-k8s/ghcr.io/jd-opensource/joysafeter-sandbox:latest configured in Sandbox Settings. Build agents via Rapid Mode (natural-language description) or Deep Mode (visual debugging).