Skip to content
CYBRET logo

CYBRET

Probes your domains and APIs for exposed attack paths and produces a reproducible exploit proof for each flaw it confirms.

Actively maintained

Developer toolsSecurityFor developersFree tier
cybret.ai ↗GitHubLinkedInX
Open cybret.aiAlternativesSet it up for my teamIs CYBRET yours? Claim the card →
At a glanceswept Oct 21, 2026

not read yet

Use

For
Security and engineering teams who need to test their APIs and web apps for exploitable flaws before attackers do.
Activity
Actively maintainedrelease 2 weeks ago · site updated 2 weeks ago
Company
CYBRET AI, Inc. · Domain since 2025privacy policy · domain registered
Used for
  • Prove exploitable API flaws such as cross-tenant data reads
  • Test logged-in API access for broken object authorization
  • Review connected code for hardcoded secrets and risky sinks
Worth knowingcomputed from what we read · each with its source
  • Has an MCP server (1 in the registry)public registry →
  • Publishes llms.txt, a file written for AI assistantscybret.ai ↗
Pricing

Price not read

Trial & discounts

Your datawhat they publish, each line with its page · read Oct 23, 2026

“We do not use customer scan data or findings to train models.”

privacy policy ↗

These are CYBRET's own statements, read from its pages. We did not audit them. A line that is missing was not found on the pages we read; it does not mean the practice is absent.

How a program reaches itfound, not claimed · read Oct 23, 2026
  • MCP serverai.cybret/findingsverified in the MCP registry
  • Stateanswers, requires sign-inchecked 2026-10-23
  • Address to connectmcp.cybret.ai/mcp
  • MCP docscybret.ai/docs/mcpthe vendor's page ↗

MCP server details →

This card as JSON, for your agent →

Each line is something a program found when it went looking: the registry entry, the server's own answer, a spec that parses. A missing line means we did not find it, not that it does not exist.

Alternatives in Developer toolsby use, among tools still maintained

Figure and bar: visits/mo, estimate · year: online since

Compare CYBRET with

Pick up to two.

All 10 alternatives to CYBRET →

All Developer tools tools →

Not it? Say what you need

beta

Three tools from the Atlas for the job you describe, each with what fits and what does not.

From people who use itnot part of the reading

No notes yet. What do you use CYBRET for?

Sign in to leave a note
Questions this page answers
  • What is CYBRET?

    Probes your domains and APIs for exposed attack paths and produces a reproducible exploit proof for each flaw it confirms. It is listed in the Atlas under Developer tools and made by CYBRET AI, Inc.

  • Who is CYBRET for?

    Security and engineering teams who need to test their APIs and web apps for exploitable flaws before attackers do.

  • Do people use CYBRET?

    Little sign of use.

  • Is CYBRET still maintained?

    Actively maintained: release 2 weeks ago · site updated 2 weeks ago.

  • Who owns CYBRET?

    CYBRET is run by CYBRET AI, Inc., per its privacy policy (2026-10-23).

  • Does CYBRET train AI on your data?

    No, per its privacy policy (2026-10-23): “We do not use customer scan data or findings to train models.”

  • Is CYBRET safe?

    We do not audit vendors. What CYBRET publishes, read 2026-10-23: SOC 2 Type II, ISO 27001, CCPA stated on its DPA; on training with your data, “We do not use customer scan data or findings to train models.”.

  • Does CYBRET give refunds?

    In its own words (terms of service, 2026-10-23): “Fees are non-refundable except as required by law or expressly stated.”

  • What are alternatives to CYBRET?

    In Developer tools, by use: Paragon, Mabl, Strix, Sourcery, KushoAI, Nango.

How we read a tool

No votes, no reviews, no vendor claims. Every week a crawler reads each tool's own site and a few public registries, and the words on the card are bands over what it read.

  • Use: visits to the site (estimated), installs from npm and PyPI, presence in Chrome's usage report.
  • Activity: the newest release on GitHub, npm or PyPI; the newest dated page on the site; open roles on a public jobs board.
  • Price: the vendor's own pricing page, read with the date. A figure is printed only when it is on that page.
  • The line and the use cases are written by us from the homepage, one tool at a time, and refused when they repeat the vendor's marketing.

How AI assistants read each site — the reading vendors ask us about — is on each tool's own visibility page.

How we read every tool → · By INITE Atlas Desk