Engines

Insidia runs these projects and names them on each finding. Each keeps its own license.

Engine	License	Layer
garak	Apache-2.0	AI
promptfoo	MIT	AI
PyRIT	MIT	AI
DeepTeam	Apache-2.0	AI
mcp-scanner	Apache-2.0	MCP and skills
SkillSpector	Apache-2.0	MCP and skills
NuGuard	Apache-2.0	Agent code and AI-SBOM
ZAP	Apache-2.0	Web and API
Nuclei	MIT	Web and API
Dalfox	MIT	Web and API
katana	MIT	Web
httpx	MIT	Web
Trivy	Apache-2.0	Dependencies and images
osv-scanner	Apache-2.0	Dependencies
gitleaks	MIT	Secrets
Bandit	Apache-2.0	Python SAST
gosec	Apache-2.0	Go SAST

Findings whose engine is insidia come from Insidia’s own modules: indirect injection, RAG bleed, tool-trace checks, and scripted chains, among others.

insidia engines list
insidia engines install garak zap

Promptfoo remote generation stays off unless you turn it on. A local scan should not send your prompts to an engine vendor.

Notices for shipped dependencies are in THIRD_PARTY_NOTICES.md in the repository.