Take your code to the peak of

APEX runs your code — fuzzing and symbolic execution — and proves every finding with a reproducing input.

Free up to 10 findings. No signup.

What APEX is

A universal code-verification engine

APEX verifies code by executing it. It runs your program against thousands of inputs, reaches places your tests never touch, and returns the exact input that reproduces each finding. Everything runs on your machine — not a line of code goes out.

01

Proof, not a warning

Static analyzers read code and infer from patterns. APEX executes it and hands back the file or line it crashes on. Run it yourself — you see the same thing.

02

Enterprise bar out of the box

CWE Top 25 (2024) — the full registry. OWASP Top 10 (2021) — the official MITRE mapping. NIST SSDF practices. Over 60 detectors; ASVS coverage is 22%, and we print the honest number instead of a checkmark.

03

More than security holes

Coverage across 11–12 languages, MC/DC, mutation testing. The coverage gate fails the build — the standard stops being a verbal agreement.

04

Tested on other people’s code

10 major open-source projects. 12,656 findings, zero engine crashes.

apex scan · payment-service

Finding

● SQL injection · CWE-89 · OWASP A03
db/orders.py:42 — reachable from POST /orders
# db/orders.py:42 q = f"SELECT * FROM orders WHERE id = {order_id}" cursor.execute(q) # order_id — user-supplied

Proof

$ apex prove orders.py:42 input "1 OR 1=1--" reached cursor.execute, line 42 result entire table dumped

Green tests tell you the code does what you checked. APEX shows you everything else it does.

Metrics and benchmarks

Numbers you can verify yourself

25 / 25
CWE Top 25 (2024)
The full registry of the most dangerous code weaknesses of 2024. Not a subset — all 25.
10 / 10
OWASP Top 10 (2021)
Every detector maps to a category via the official MITRE mapping, not by eye.
12,656
findings in other people’s code
Linux kernel, CPython, TypeScript, Kubernetes, Spring Boot, .NET, Rails and three more projects.
0
engine crashes
The same ten runs. APEX never crashed on code written over twenty years.
100%
of findings ship a reproducing input
Every finding carries the input that triggers it. No input, no finding.
0 bytes
leave your machine
No source, no findings, no telemetry. Network libraries are not compiled into the binary.

The standards we measure ourselves against

OWASP ASVS — 22%That many requirements are checked automatically, by running the code. The rest is about process, architecture and human decisions. We do not write “covered” when it is not true.
NIST SSDFA mapping of secure-development practices with evidence attached for audit.
Coverage gateFails the build if test coverage drops below the threshold. 80% by default.
Mutation testingCorrupts a copy of the code and checks whether your tests catch it. Python, JS, Rust.
Business solutions

The peaks

One engine, different peaks. Every product runs your code and proves the finding with a reproducing input. All local.

Pricing

Launch pricing

Two things are fixed: the free tier is permanent, not a trial, and the scan always runs to completion. Packaging can still move — sign up before launch and your price is the launch price or lower, held 12 months.

For yourself
$10 / month
Free — first 10 findings a month
  • Full engine: fuzzing, symbolic execution, every detector
  • Claude Code plugin and Cursor integration
  • Licence for personal, non-commercial use
Lock this price
For a team
$1000 / year
Free — first 100 findings · or $100 a month
  • Everything in “For yourself”, with no limit on commercial use
  • Build integration: a check on every code change
  • One licence per organisation — any number of machines and runners
Reserve a team licence

How the free limit works. APEX scans the whole project and shows the total it found. For every finding you see the name, file, line and severity. Only the proof and the remediation hint are hidden — those unlock on a paid plan. We never hide the fact that a problem exists.

Get started

Your first report in a couple of minutes

Three steps. The code goes nowhere: APEX is a program on your machine.

01

Your agent

APEX is a tool for the agent. It runs locally, needs no API key, and works with any MCP host.

# Claude Code · Cursor · Cline # Codex CLI · Continue
02

Add the MCP server

One stanza in your agent's config. The engine exposes 33 tools — audit, coverage, fuzzing, symbolic, taint, reach.

Channel opening
{ "mcpServers": { "apex": { "command": "apex", "args": ["mcp"] } } }
03

The agent calls it

Your agent runs apex.audit and gets findings with a reproducing input on each one.

apex.audit ← 12 findings · 3 critical ← each with a replayable input
Release channel opening

One message. No newsletter, no sequence, no sharing the address.

You're in the channel.

One message when the command works. Nothing before it.

How is this different from Snyk, Semgrep or SonarQube?

APEX runs the code and obtains the concrete input that breaks it. Hence fewer false positives: if we show a crash, it is real, and you can reproduce it yourself.

What counts as a “finding” against the free limit?

Only vulnerabilities and real defects. Code-quality remarks and complexity metrics do not count and are always shown.

Does it work offline?

Yes. The internet is needed once — at purchase. After that the licence is verified on your machine against a built-in signature. Air-gapped environments are supported.

Which languages are supported?

Test execution and coverage — 11–12 languages: Python, JavaScript/TypeScript, Java, Go, Rust, C, C++, C#, Kotlin, Ruby, Swift. Depth varies: C, C++ and Rust get the full set, including memory fuzzing.

How many false positives?

Where proof is attached there are no false positives by definition — you can reproduce the crash. Some detectors work on patterns and can be wrong; those findings are marked separately.

Can I use it at a company?

The $10 plan is for personal, non-commercial use. Company use needs a team licence: $100 a month or $1,000 a year per organisation, with no limit on machines.

How do I pay, and what then?

Card payment through a payment partner. After paying you receive a licence file by email — activated with one command. No calls to our server during operation.