The AI-native platform for building, orchestrating, and running security agents at scale.
From idea to production-grade security automation â in minutes, not months.
English | çŽä˝ä¸ć
Traditional security tooling hits a ceiling: scripts are brittle, single agents lack context, and complex scenarios require 2â3 engineers working in parallel. JoySafeter breaks that ceiling.
| Challenge | Traditional Approach | JoySafeter |
|---|---|---|
| APK vulnerability analysis | Manual MobSF + engineer review | Autonomous agent: upload â analyze â report |
| Penetration testing | Fixed scripts, static playbooks | Dynamic DeepAgents that adapt to findings in real time |
| Tool integration | Custom glue code per tool | 200+ tools via MCP Protocol, zero glue |
| Scale | Linear headcount growth | Agent teams that multiply capacity |
JoySafeter defines a new paradigm: AI-driven Security Operations (AISecOps) â where multi-agent collaboration, cognitive memory, and scenario-matched skills replace manual coordination.
Upload an APK. Get an OWASP Mobile Top 10 report. No engineer required.
How it works:
- User uploads the APK file
- Agent invokes MobSF for static analysis
- Extracts critical risk signals â permission abuse, hardcoded secrets, insecure network config
- Deep-validates high-severity findings via Frida dynamic instrumentation
- Auto-generates a structured report aligned to OWASP Mobile Top 10
The entire flow â from upload to report â requires zero manual intervention, covering work that traditionally takes 2â3 security engineers.
Describe the target and scope. The agent plans, executes, and adapts â then delivers a report.
How it works:
- Open the Workbench and create a new agent
- Enable DeepAgents mode â select penetration testing skills
- Provide an authorized target URL and test requirements
- Agent runs autonomously â if it discovers a login page, it automatically triggers auth bypass testing
- Download the final report when the run completes
Note: Requires sandbox image
swr.cn-north-4.myhuaweicloud.com/ddn-k8s/ghcr.io/jd-opensource/joysafeter-sandbox:latestconfigured in Sandbox Settings.
This dynamic decision-making â where the agent adapts its next step based on what it finds â is what fixed scripts cannot replicate.
|
|
|
|
./deploy/quick-start.sh| Service | URL |
|---|---|
| Frontend | http://localhost:3000 |
| Backend API | http://localhost:8000 |
| API Docs | http://localhost:8000/docs |
Prerequisites: Docker + Docker Compose. See INSTALL.md for manual setup or pre-built images.
Full architecture details: docs/ARCHITECTURE.md
Key design principles:
- Graph-based execution â every agent workflow is a stateful LangGraph, enabling pause, resume, and branch
- Glass-box observability â real-time Langfuse tracing of every agent decision and state transition
- Layered skill system â skills are versioned units that compose into workflows without coupling
| Layer | Technology | Purpose |
|---|---|---|
| Frontend | Next.js 16, React 19, TypeScript | Server-side rendering, App Router |
| UI | Radix UI, Tailwind CSS, Framer Motion | Accessible, animated components |
| State | Zustand, TanStack Query | Client & server state |
| Workflow Editor | React Flow | Interactive node-based builder |
| Backend | FastAPI, Python 3.12+ | Async API with OpenAPI docs |
| AI Framework | LangChain, LangGraph, DeepAgents | Agent orchestration & workflows |
| MCP | mcp 1.20+, fastmcp 2.14+ | Tool protocol support |
| Database | PostgreSQL, SQLAlchemy 2.0 | Async ORM with migrations |
| Cache | Redis | Session cache & rate limiting |
| Observability | Langfuse, Loguru | Tracing & structured logging |
Full history: CHANGELOG.md
| Tag | Feature | What it means |
|---|---|---|
| NEW | Skill Versioning & Collaboration | Publish, rollback, manage skill versions; invite collaborators with role-based permissions; platform API tokens for CI/CD |
| NEW | Multi-Tenant Sandbox Engine | Per-user isolated code execution â zero state leakage between sessions |
| NEW | Enterprise SSO | Built-in GitHub / Google / Microsoft templates, plus OIDC and JD SSO |
| UPGRADE | DeepAgents v0.4 | Latest stability and performance improvements for the multi-agent kernel |
| UPGRADE | Glass-Box Observability | Real-time Langfuse tracing of every agent decision and state transition |
- INSTALL.md â Installation guide (Docker / manual / pre-built images)
- DEVELOPMENT.md â Local development setup
- deploy/README.md â Docker deployment
- deploy/PRODUCTION_IP_GUIDE.md â Production deployment
- docs/ARCHITECTURE.md â Architecture overview
- backend/README.md â Backend guide
- frontend/README.md â Frontend guide
See docs/tutorials/ for step-by-step guides on model setup, MCP integration, skill development, and more.
- CONTRIBUTING.md â Contributing guide
- SECURITY.md â Security policy
- CODE_OF_CONDUCT.md â Code of conduct
Join the WeChat user group for questions and discussion:
   Â
git clone https://github.com/jd-opensource/JoySafeter.git
git checkout -b feature/amazing-feature
git commit -m 'feat: add amazing feature'
git push origin feature/amazing-featureSee CONTRIBUTING.md for full guidelines.
Apache License 2.0 â see LICENSE for details.
Third-party component licenses: THIRD_PARTY_LICENSES.md
 LangChain |
LangGraph |
 FastAPI |
 Next.js |
 Radix UI |
Made with â¤ď¸ by the JoySafeter Team
For commercial solutions, contact JD Technology Solutions Team at org.ospo1@jd.com