A red team that proves the hole by running it and locks it with a red-to-green regression, not a report.
Hi. I am not an engineer, I am a lawyer. I vibe-code my own tools for my own tasks.
I understood that security is very important, so I built this instrument. It checks my code by actually running the attack, not by guessing. If a scanner cannot prove a hole is real, I do not want to hear about it, and now I do not have to: Arez only reports what it broke and fixed.
If it helps you the same way, take it and make it yours.
— Filipp Zarubin
- What This Is
- Why It Helps
- The Main Advantage
- How It Works
- Quickstart
- Simple Comparison
- Simple Words
- Safety And Privacy
- Limits
- Star And Contribute
Arez is Ares, the red-team god of the Olympuz family, cut out as a standalone tool. It runs a real security campaign against a target. It maps the surface, runs the exploit, and counts a finding only after a test was watched going red on the broken code and green after the fix.
The regression then lives in your own gate for good. Ares wages war on your code to find its flaws and fix them. He does not fight alone. Deimoz, his son, the dread that rode into every battle beside him, is the engine that runs the campaign and chains its scanners into one verdict. It attacks, proves each hole by running the exploit, and locks the fix with a regression. Zero external dependencies. It hits a live target only on 127.0.0.1, under its own sandbox.
Most security agents hand back a report: a list of things that look insecure. Half of them are not real, and the real ones get lost in the noise. Worse, a green test can sit on top of a hole that never moved, and nobody notices.
Arez refuses that. A finding is real only when the exploit was executed and the fix was watched closing it. If you pay an agent to check your code, you want the flags to be real, and the proof to be a test you can run yourself.
Main advantage: a finding counts only after the exploit was run and the fix was watched turning the test from red to green, and that proof stays as a test you can run yourself.
Why this is better: A scanner hands you a report and moves on. Arez cannot. It never writes "theoretically an attacker could": a claim that will not run is refused. It never trusts a green test that was green before the fix. It never calls its own patch clean; the verdict is the gate's exit code, run by a separate process the attacking agent cannot reach. When a hole needs real egress to prove, it is logged as held, not passed off as a win.
A campaign moves through four stages. Each hands the next something it can check. Nothing becomes a finding until it has been executed and proven.
| Stage | What happens |
|---|---|
| 1. Recon | The attack surface gets mapped before any exploit runs |
| 2. Exploit | The exploit is run against the target for an exit code |
| 3. Prove | A coordinator watches the test go red, then green |
| 4. Lock | The regression stays in the gate for good |
The first stage reads the target. It finds which endpoints answer, where input enters, and what the agent may touch. Nothing is attacked yet. A surface no scanner flagged is dropped honestly, not turned into a claim.
You get: a map of trust boundaries and input points, ready for the exploit stage.
Ares runs the real exploit against the target. It runs on 127.0.0.1, under its own sandbox. What comes back is an exit code, not a paragraph. A claim of "theoretically an attacker could" is refused. An exploit that will not run is not a finding.
You get: an executed exploit with a real exit code, or an honest drop.
The proof is not the agent's word. A separate coordinator runs the exploit test on the unfixed tree and sees it fail. Then it runs on the fixed tree and sees it pass. Red before, green after: that is proof. A test already green before the fix is hollow, and thrown out.
You get: an observed red-to-green, judged by exit code out of the agent's reach.
The test that proved the hole becomes a permanent regression. Every later run goes red the moment the flaw returns. The posture ratchets tighter over time. It is not rescanned from scratch. This is what separates Arez from a scanner that hands back a report and forgets.
You get: a permanent test, red on the flaw forever, living in your own gate.
You need a Mac or Linux, Node.js 22 or newer, and git. For the live hunt you also want an agent in the terminal: claude or codex. Three doors from here, any of them works.
git clone https://github.com/zarubinvibe/arez.git ~/arez
cd ~/arez
# Plain terminal, no agent needed: install checks your machine, then the gate proves the tool
bash install.sh
node bin/arez.ts gate
# In an editor: open the folder in Claude Code or VS Code
code .
# Drive a live campaign with an agent in the terminal
claude # or: codexNo Git? Download the ZIP, unpack it, and run the same ./install.sh inside. Prefer an archive in the terminal? Take the tarball. First time here? Open the project in Claude Code and run /arez-setup: the install goes as a conversation, one question at a time, and nothing runs without your yes.
Never done this before? The onboarding walks the whole first run step by step and says what you see after every command.
You get: the installer greets you, checks what you already have, runs its own gate, and names honestly what will not work on your system.
| Option | Effort | Does it prove? | Undoable / locked | Coverage | The catch |
|---|---|---|---|---|---|
| Arez | Install once, read one gate | Yes: red-to-green, watched | Locked as a regression forever | One target, deep | Needs macOS for the live sandbox |
| A scanner that returns SARIF | One quick scan | No: a self-claim | Nothing is locked | Broad but shallow | Half the report is not real |
| Asking the model "is this safe?" | One fast question | No: a guess | Nothing is locked | Any code | A green test on a real hole passes it too |
| A red team of parallel skeptics | Many agents at once | No: opinions, not runs | Nothing is locked | Wide on paper | Fan-out multiplies the blast radius |
| Reviewing the code by hand | Slow, careful | Only if you write the test | Only if you keep the test | Whatever you reach | Hours per pass, and humans tire |
| Buying a bigger-context model | No setup at all | No: still a guess | Nothing is locked | Everything fits a while | You pay for every byte again each turn |
Names belong to their owners. The table describes purpose, not a benchmark: other tools change, and this page makes no promises for them.
| Word | Simple meaning |
|---|---|
| Repository | The project folder that Git stores and versions |
| Terminal | The window where you type commands |
| Command | One instruction you give the computer |
| Branch | A separate line of changes that does not touch main |
| Pull Request | A request to review your change and accept it |
| observed-RED | A finding is real only when a separate coordinator watched the test fail on the broken code and pass after the fix. Not the agent's word, an exit code it saw itself. |
| hollow test | A test that is green both before and after the fix. It reproduces nothing, so Arez throws it out instead of calling it proof. |
| seatbelt | The sandbox the target runs under. It hits 127.0.0.1 only, cannot reach off your machine, and a canary proves the containment is real. |
- Arez is an offensive tool, built to be honest about its own limits.
- It hits a live target only on 127.0.0.1, under its own OS-level sandbox, with zero host egress.
- It spawns no sub-agents. It is a leaf, on purpose, because fan-out multiplies the blast radius.
- It never runs Docker, raw sockets, or someone else's key.
- A step that needs a network or shell grant carries a one-time human gate.
The gate runs the tests in a separate process the attacking agent cannot reach, so the tool never judges its own patch. A hole that needs real egress off the machine is logged as held and unprovable, never dressed up as a win.
Working: the full attack pipeline, the anti-theater core, the vendored-core doctor, and the end-to-end acceptance scenario all pass the gate. Ahead: the live seat-adapter when the Olympuz swarm is assembled, and a portable sandbox so the live target runs beyond macOS.
- One campaign finds about half of what is there. Arez does not mistake a run for a full audit.
- It needs macOS for the live-target sandbox today; the gate and doctor run everywhere.
- The live hunt needs an agent CLI, Claude or Codex; without one, the gate and doctor still work.
- strix is a local reference bench only, never a dependency.
docs/MASTER-PLAN.md sequences the four attack stages by dependency. docs/ONBOARDING.md walks a first install step by step. AGENTS.md holds the doctrine and the invariants. SECURITY.md holds the safety model. tests/CORPUS.md names every probe.
Useful? Give Arez a star: https://github.com/zarubinvibe/arez. It takes a second and it decides whether other people ever find the project.
Want to change something? The path is short: fork the repository, create a branch, commit your change, push the branch, then open a Pull Request. Do not push directly to main; the release gate rejects it.
Found a problem instead? Open an issue at https://github.com/zarubinvibe/arez/issues and say what you ran and what happened.
This is one of the public Olympuz projects. Each row opens the repository or downloads its source as a ZIP.
| Type | Name | What it does | Source |
|---|---|---|---|
| project | Athena | Portable agent OS that restores a complete Claude and Codex setup on a new Mac. | Repository · ZIP |
| project | Helioz | 24/7 agent work conveyor with verified completion markers and goal-based overnight decisions. | Repository · ZIP |
| project | Mnemazine | Local-first memory system that turns raw inputs into verified reusable knowledge. | Repository · ZIP |
| project | Themiz | Multi-agent assistant for Russian litigation with local OCR and review by a five-jurist council. | Repository · ZIP |
| project | Zeuz | Factory that turns an idea into a governed multi-agent workflow with gates, observability, and replay. | Repository · ZIP |
| project | Lynceuz | Collects public web evidence at zero cost and stops with an honest reason when the safe routes end. | Repository · ZIP |
Apache-2.0, because Arez carries the vendored Olympuz core.