JoySafeter
The AI-native enterprise security Agent platform — not just chatting: build, run, test, and trace autonomous agent teams with visual orchestration.
- Source repo
- jd-opensource/JoySafeter
- Stars
- ★ 315
- Last updated
- 6mo ago
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 59/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free software; you pay for model usage
- Setup effort
- High · needs real infrastructure
- You'll need
- Typical use
- Security engineers screening large volumes of APKs: upload a file and the agent autonomously runs MobSF and Frida to produce an OWASP Mobile Top 10 report, replacing a 2-3 engineer manual process
- Not a fit if
- Teams wanting general office or data-analysis automation must build their own skills
- Small teams unwilling to run Docker, PostgreSQL, and Redis infrastructure
- Source review
- 59/100 · Major gaps
What does this agent do, and when should you use it?
JoySafeter, released under jd-opensource, is an enterprise AI Agent platform focused on AI-driven Security Operations (AISecOps). It ships a visual Agent Builder with drag-and-drop workflow editing (loops, conditionals, parallel execution) in two modes: Rapid Mode, which turns natural-language descriptions into running agent teams, and Deep Mode, which adds visual debugging and step-by-step observability. The platform comes with 200+ security tools (pre-integrated Nmap, Nuclei, Trivy, and more) extendable via the MCP Protocol with zero glue code, plus 30+ pre-built skills spanning penetration testing, document analysis, and cloud security. Execution is powered by LangGraph and DeepAgents with Manager-Worker multi-level collaboration, long/short-term memory evolution, and a versioned skill system; all runs flow through a unified event-sourced Run Center with full-chain tracing via Langfuse. Enterprise features include multi-tenancy with RBAC, SSO integration (GitHub, Google, Microsoft, OIDC providers, JD SSO), and RAII-based per-user sandbox isolation.
JoySafeter ingests user-uploaded artifacts (e.g., APK files) or natural-language task descriptions, invokes MobSF for static analysis and Frida for dynamic instrumentation to validate high-severity findings, or plans and executes penetration tests against an authorized target URL — then auto-generates structured reports (e.g., OWASP Mobile Top 10). Under the hood, every agent workflow is a stateful LangGraph graph that can pause, resume, and branch; Chat, Copilot, and Skill Creator share a single event-sourced run lifecycle (Run → Event → Snapshot) streamed over a unified WebSocket layer (BaseWsClient), with trace_id propagated via contextvars from the HTTP/WS entry point through LangGraph to persistence. Tools integrate through the MCP Protocol (mcp 1.20+, fastmcp 2.14+), code executes in per-user isolated Docker sandboxes, and model resolution uses canonical (provider_name, model_name) identifiers via ModelService → ModelFactory.
- Security engineers screening large volumes of APKs: upload a file and the agent autonomously runs MobSF and Frida to produce an OWASP Mobile Top 10 report, replacing a 2-3 engineer manual process
- Pentest teams with an authorized engagement: enable DeepAgents mode with penetration-testing skills in the Workbench; the agent auto-triggers auth-bypass testing when it finds a login page and delivers a final report
- Security leads consolidating a legacy toolchain: orchestrate Nmap, Nuclei, Trivy, and 200+ tools through the MCP Protocol without per-tool glue code
- Compliance teams needing audit trails: leverage execution tracing and full-chain trace_id propagation for governance requirements
- Security researchers debugging complex automation: use Deep Mode's visual debugging and step-by-step observability to inspect agent decisions
How do you install or deploy this agent?
Prerequisite: Docker + Docker Compose. Recommended one-click launch:
./deploy/quick-start.shThe interactive menu offers:
(1) Docker Compose full stack (frontend, backend, PostgreSQL, Redis all containerized; localhost or remote IP/domain);
(2) Local frontend only (bun run dev, can connect to a remote backend);
(3) Local backend only (uvicorn --reload, remote DB/Redis supported);
(4) Local frontend + backend (auto-starts middleware).
Optional flags:
./deploy/quick-start.sh --skip-env # skip .env initialization
./deploy/quick-start.sh --skip-db-init # skip database initializationOther paths: ./deploy/scripts/dev.sh for development, ./deploy/scripts/prod.sh for production, ./deploy/install.sh for an interactive install wizard, ./deploy/scripts/check-env.sh for environment preflight. Full details in INSTALL.md.
How do you use this agent?
After launch, open the frontend at http://localhost:3000; the backend API is at http://localhost:8000 with Swagger docs at http://localhost:8000/docs. The typical user journey is 9 steps: Login → Configure Models → MCP Tools → Skill Management → Build Agent → Self-Test (Langfuse trace) → Publish → Chat UI → Run Center. The penetration-testing case requires the sandbox image swr.cn-north-4.myhuaweicloud.com/ddn-k8s/ghcr.io/jd-opensource/joysafeter-sandbox:latest configured in Sandbox Settings. Build agents via Rapid Mode (natural-language description) or Deep Mode (visual debugging).
What are this agent's strengths and limitations?
- 200+ pre-integrated security tools (Nmap, Nuclei, Trivy, etc.) extendable via MCP Protocol with zero glue code — domain depth generic agent platforms lack
- Graph-based LangGraph execution supports pause, resume, and branch, combined with the event-sourced Run Center and real-time Langfuse tracing for glass-box observability
- Complete enterprise stack: multi-tenancy, RBAC, multiple SSO providers (GitHub, Google, Microsoft, OIDC/Keycloak/Authentik/GitLab), and RAII sandbox isolation — a direct path to production
- 30+ pre-built skills plus Rapid/Deep dual build modes significantly lower the barrier from idea to a running agent team
- The deployment stack is heavy: full operation requires Docker, PostgreSQL, and Redis, and the pentest case additionally pulls a dedicated sandbox image from a Huawei Cloud registry — non-trivial initial ops cost
- Core focus is security scenarios (vulnerability detection, pentesting); teams seeking general office or data-analysis automation must develop their own skills, and the README shows no such out-of-the-box capability
- Deep dependence on the LangChain/LangGraph/DeepAgents stack — migrating to another orchestration framework means rewriting workflows
- The two showcased cases (APK detection, pentesting) rely on third-party tools (MobSF, Frida) and require an authorized target for pentesting, so effects cannot be verified in unauthorized environments
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| JoySafeter This agent | 59 · Major gaps | Self-hosted serviceFree + model costs | ★ 315 | 6mo ago | Python | — |
| PentestCode | 55 · Major gaps | CLIFree + model costs | ★ 883 | 1d ago | TypeScript | OpenAI API · Claude API |
| PentesterFlow | 73 · Some gaps | CLIFree + model costs | ★ 1.4k | 1mo ago | TypeScript | OpenAI API |
| Jelly: Local Multi-Bot Agent Workspace | 52 · Major gaps | — | ★ 60 | 1d ago | TypeScript | ChatGPT · OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows multi-tenancy, per-user RAII sandboxes, RBAC, credential encryption (CREDENTIAL_ENCRYPTION_KEY) and detailed deployment hardening guidance in SECURITY.md — least_privilege and sensitive_data_handling score 2. Deductions: MCP arbitrary-code execution and external scanning actions rely on advisory text only, with no enforced confirmation gate (user_confirmation 1); the pentest agent autonomously executes auth-bypass attacks against authorized targets with only a sandbox-image note and no documented approval/rollback mechanism (external_effects 1, rollback 1); the Trivy scan runs with exit-code=0 and blocks nothing, making the dependency gate nominal (dependency_security 1). License and third-party attribution are clear (source_attribution 2).
Evidence shows CI covering pre-commit, ruff, mypy, ESLint, type-check, frontend tests and builds, frozen bun.lock installs, and a versioned image release flow; however the backend pytest step is commented out in ci.yml, so backend tests are not enforced in CI — deduct to 2. Error handling and 404 tests exist and backend errors are internationalized (failure_messages 2).
Evidence shows a well-defined audience (security teams, pentest, APK analysis) and rich deployment modes with port-conflict detection (audience_and_scenarios 2, environment_fit 2). Deductions: claims like 'zero manual intervention' and 'replacing 2-3 engineers' lack boundary statements about applicability, false-positive rates, or sandbox escape limits (capability_boundabilities 1); the auto-trigger for auth-bypass testing is described only narratively, without precise trigger documentation (trigger_precision 1).
Evidence shows a complete documentation set (INSTALL/DEVELOPMENT/ARCHITECTURE/CONTRIBUTING/SECURITY/CODE_OF_CONDUCT/CHANGELOG/THIRD_PARTY_LICENSES), a one-click script with port table and prerequisites (information_architecture 3, install_notes 3); full Apache-2.0 text (license 3); SECURITY.md lists known security considerations (known_limitations 2); CHANGELOG and bump-version.sh are referenced but their contents are not in evidence (versioning_changelog 2); naming is consistent across README/images/scripts (naming_stability 2); community support is WeChat-group based and maintenance SLAs are email-based (maintenance_responsibility 2); tutorial contents are referenced but not shown (examples_and_faq 2).
Evidence shows structured OWASP-aligned reports, Run Center event replay, and visual orchestration that plausibly deliver value for the target scenario; but report quality and analysis accuracy have no statically verifiable implementation detail in evidence and remain at the claim level (output_usability 2, marginal_value 2). Setup cost is high (Docker, DB, Redis, model config, sandbox image) with benefit claims plausible but documentation-only (cost_benefit 2).
Evidence shows that referenced CHANGELOG, tutorials and architecture docs are absent from the evidence set, and key claims ('replaces 2-3 engineers', '200+ tools') cannot be traced within provided files (claim_traceability 1). Partial cross-file consistency exists (deploy scripts match CI structure), scoring 2. Marketing language is heavily mixed with factual statements ('no engineer required', 'zero state leakage') without separation of inference from fact (fact_inference_separation 1).
- The pentest agent autonomously executes attacks such as auth bypass against targets; verify target authorization and network isolation before deployment, and audit the sandbox image provenance and contents.
- MCP tools can execute arbitrary code; only trusted MCP servers should be enabled. The Trivy scan does not fail the build (exit-code=0), so dependency vulnerabilities require separate auditing.
- The backend test step is commented out in CI; backend code lacks enforced automated testing. Run the backend test suite yourself before production deployment.
- README claims such as 'zero manual intervention' and 'replacing 2-3 engineers' are marketing assertions, unverified by evidence; do not infer actual capability from them for procurement decisions.
- CREDENTIAL_ENCRYPTION_KEY must never change once set, or existing encrypted credentials become unreadable; plan key management before deployment.
- Publisher identity is not registry-verified; the jd-opensource organization name alone does not constitute a reliability guarantee.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.0.0 Release v1.0.0
-
v0.3.2 Release v0.3.2
Release notes excerpt
What's Changed Features - 添加版本信息展示功能，并接入 bump-version.sh 版本管理体系 (#125) - Agent 构建错误信息加入 graph_name 和 node_label 上下文，便于用户定位问题 Bug Fixes - 修复本地 Ollama 模型在 Agent 工作台报 401 无 API key 的问题 (#127) - 修复 Skill 保存时使用 previewData 替代 fileTree 容器路径，并正确去除沙箱路径前缀 - 修复沙箱断连后自动重连，改善 Skill 名称冲突的错误提示 - 修复 preview_skill 读取时传入正确的 sandbox backend - 修复 FileTrackingProxy 在 SkillSandboxLoader 中的 backend 检测 - 修复 CheckpointerManager 复用 Settings 获取数据库 URI，替代直接读取环境变量 - 修复 checkpointer 调用缺少 RunnableConfig 类型注解的问题 - 修复 credential_resolver 中未使用的 model_service 变量 …View on GitHub ↗ -
v0.3.1 Release v0.3.1
Release notes excerpt
What's Changed 新功能 - Chat 与 Copilot 全面迁入 Run Center 架构，支持运行详情查看、会话恢复与事件回放 - 解锁深色模式，新增偏好设置面板并重新设计个人资料页面 - WebSocket 层统一重构：引入 BaseWsClient 基类，三端 WS 客户端统一生命周期与认证方式 - 新增 trace_id 全链路追踪传播 - 添加 Ollama 本地模型供应商一键集成 - 更新 OpenAI Compatible 供应商为官方标准模型列表 - 新增图模板自动应用功能（新建或空白图时） - 技能协作者标签页展示用户名、邮箱及角色 - 增强快速启动脚本，支持交互式部署模式选择 - 新增 Artifacts 开关标签的中英文本地化 问题修复 - 修复默认主题为 system，确保 API 响应优先 - 修复侧边栏用户下拉菜单重复分隔线 - 修复通知 WebSocket Hook 的监听器泄漏问题 - 修复沙盒用户列展示 "Unknown" 的 schema 不匹配问题 - 修复非 Docker 环境（Colima 兼容）下的优雅降级 - 修复工作空间权限审计——关闭认证缺口，修正角色映射 - 修复多处 Alembic 迁移循环（重复 revision ID） …View on GitHub ↗