Enternovate Open · Mhangani
Audit your defenses. Ethically.
An ethical web security audit toolkit. It runs OWASP-aligned header, TLS, cookie and CORS checks with a 0-100 posture score and board-ready reports. Passive checks only. Always authorized and scoped.
v0.1.0 · releasedMITPython 3.11+open-core → PromptShield
Test your defenses. Keep your ethics.
Test your defenses the way an attacker would. Never cross the line. Mhangani runs passive, OWASP-aligned checks. It turns them into a score you can act on and reports you can show.
Header checks
Mhangani audits security headers against OWASP guidance. It checks CSP, HSTS, X-Frame-Options and Referrer-Policy. Each check gives a clear pass or fail and remediation.
TLS inspection
It parses certificates and checks TLS posture. This covers protocol support, cipher strength, expiry and trust chain. Mhangani scores each against current best practice.
Cookie & CORS audits
It audits Set-Cookie attributes (Secure, HttpOnly, SameSite) and CORS policy. These checks find the subtle misconfigurations attackers use.
0-100 posture score
Every check feeds a graded posture score with per-finding detail. You see exactly what lowers your score and what fixes it.
Board-ready reports
Render the same audit as HTML, JSON or Markdown. Share it with a client, a board or your own ticketing.
Ethics by design
Mhangani runs passive checks only. Every audit is authorized and scoped. It audits what you own or have permission to test. Nothing more.
One command, one score.
$ mhangani audit https://example.com
$ mhangani report --format html --out report.html
$ mhangani report --format json --out findings.json
$ mhangani grade --url https://example.com
Every audit is scoped, passive and logged. Ethics checks are built into the CLI itself.
One part of a connected stack.
Xavani drives it
Run the audit. Let Xavani triage the findings. One request such as 'audit this site and fix the headers' starts the work.
Feeds the constellation
Mhangani stores findings in the Nyarhi knowledge graph. Gavaza covers the compliance side.
Open-core
The free local toolkit also comes as PromptShield and the platform's audit features. They are hosted, scheduled and multi-tenant.