// agentic & automation, on your infra

Ship agents you actually own.

wrok.in is BytesBrains' home for installable AI agents. Configure them and install them on your own GitHub, cloud, and platforms — your infra, your data, your AI keys.

› Install GitHub App See how it works

Self-serve · BYOK · You own infra & data

// 01 · what you get

Built for engineers who want automation without the leash.

Self-serve, on your own infra

You install and configure it yourself, on the GitHub, cloud, and infrastructure you already run. No managed black box, no data leaving your control.

Bring your own keys, no lock-in

Plug in your own LLM API keys and choose the model per role — Anthropic, OpenAI, Google, Mistral, DeepSeek, or OpenRouter. Switch anytime. We never sit between you and your provider.

Install anywhere it fits

Ships as products that drop into your stack: a GitHub App today, more integrations coming. Configure with a dashboard and a simple file in your repo.

Minimal support by design

Clear docs, sane defaults, transparent config. Built to set up in minutes and run on its own — not to keep you on a support thread.

// 02 · products

A growing catalog of self-serve agentic products.

wrokin is the first. More agentic apps and integrations are landing on wrok.in over time.

wrokin

A team of AI agents on your repos

Install the GitHub App and wrokin deploys AI agents across your repositories. They work automatically when a PR or issue opens, or on demand when you call them. You bring the keys and pick the models; everything runs against your own provider account.

Under the hood, wrokin runs on the Pi agent — with BytesBrains' own workflows, context-gathering (Scout), and extra harnesses & guardrails layered on to make it more effective and safer.

  • Seven agents — review, security, triage, delivery and repo posture. Four are live and switched on per repo; the Hunter and the Builder are private preview
  • BYOK + per-role models — Anthropic · OpenAI · Google · Mistral · DeepSeek · OpenRouter
  • Auto or on-demand — triggers on PR/issue, or @wrokin / /w
› Install on GitHub Open dashboard
LIVE
.wrokin/config.yml 
version: 1
agents:
  code-review:
    model: deepseek/deepseek-v4-pro
  issue-triage:
    model: anthropic/claude-opus-5
# your keys, your models, your repo

The team

Seven agents across review, security, delivery and posture — four live today, two in private preview, one on the roadmap. Each card says which, and opens a readme with a real sample of what that agent produces: the output below is lifted from production runs, not mocked up.

Review & Security

LIVE

Code Review

code-review

Reviews a pull request against the issue it closes, not just the diff.

full page ›
LIVE

Security Audit

security-audit

Flags only security-relevant findings, with a concrete remediation.

full page ›
private preview

The Hunter

hunter

Proof-carrying vulnerabilities: it writes the exploit and detonates it.

full page ›

Delivery

private preview

Builder

builder

Implements an issue, then proves it — builds and tests the change on your runner before opening the PR.

full page ›
LIVE

Issue Triage

issue-triage

Labels, routes and de-duplicates issues as they arrive.

full page ›
ROADMAP

Project Management

project-management

Keeps boards, milestones and status summaries current.

full page ›

Posture

LIVE

Warden

repo-audit

Audits your repo's setup and the shape of your source. No model call at all.

full page ›

Also on the roadmap

ROADMAP

Automation workflows

Chain agents into multi-step pipelines across your tools and repos.

ROADMAP

Ops / on-call agents

Triage alerts, draft incident summaries, and suggest runbook steps.

ROADMAP

Data / ETL agents

Schedule and run extract-transform-load jobs on your own infrastructure.

ROADMAP

Custom agents

Define your own roles and prompts; bring them to your stack.

// 03 · code review LIVE

A review that checks facts, not vibes.

Most AI review is one model's opinion of a diff. Ours runs a deterministic pass first — real scanners, real advisory databases, real line numbers — and only then asks a model to reason about what's left. Facts don't hallucinate.

  • It knows what the PR was for

    The review reads the GitHub issue the PR closes — repro steps, acceptance criteria, the constraint someone spelled out — and grades the diff against it. So it can tell you a change doesn't do what was asked, or quietly skipped half the criteria. Not just "is this code correct", but "is this the right code".

  • Findings you can fix in one click

    Leaked secrets, dependency CVEs from the OSV database (escalated when CISA lists them as actively exploited), risky sinks, typosquatted and malicious packages — anchored to the exact line, with a suggested patch you commit from the PR.

  • Straight into your Security tab

    Security findings publish as SARIF to GitHub code scanning, so they get native de-duplication, lifecycle and history — not a comment that scrolls away. Your existing security workflow, not a second dashboard.

  • Design review, not just bug review

    SOLID and DRY assessed against the real diff, architecture layer boundaries enforced from a rule you declare in .wrokin/config.yml, and duplication flagged where something already exists to reuse.

  • Honest about what it didn't read

    A large PR is reviewed across several passes, and anything that still didn't fit is named as unreviewed. No silent truncation dressed up as a clean bill of health.

  • It notices low-value work

    Churn with no behaviour change, new logic with no test, tests that would still pass with the feature deleted, a diff that doesn't match its title. Advisory and deliberately conservative — a pointer for a human, never a verdict.

All of it runs on your key and your chosen model — and the deterministic passes cost no tokens at all.

// 04 · the hunter private preview

Security findings you can run, not just read.

Most "AI security review" hands you a comment you have to trust. The Hunter reasons across files to find an exploitable bug, has a second model family try to refute it, and — at its deepest level — writes a proof-of-concept and detonates it in an isolated sandbox. We don't flag it. We prove it.

In preview — we're running the Hunter on our own repositories today and rolling it out to customers. Install wrokin to hear when it lands.

FORAY

~5 min · the changeset

The day's hunt

Cross-file taint analysis on your diff, adversarially verified by a second model family — fast enough to run on every pull request.

run it: on every pull request

STAKEOUT

~10 min · the whole repo

The overnight hunt

Everything in Foray, widened to full-repo context and your dependency / supply chain, with a CVSS-vector report on each finding.

run it: before a staging / beta cut

EXPEDITION

~20 min · proof by execution

The long hunt

Everything in Stakeout, plus an ensemble of finder models voting by consensus and a proof-of-concept detonated in a no-secrets, network-isolated sandbox. Red means confirmed.

run it: before a production release

  • Cross-file, not pattern-match. It follows tainted input across hops to the sink — the data-flow bugs signature scanners walk right past.
  • Adversarially verified. A different model family tries to refute every candidate, so false positives get killed before they reach you.
  • Proof, not a guess. A finding is only marked confirmed once a generated exploit actually runs and goes red in the sandbox.
  • Advisory by design. Runs on your own runner, never blocks your PR, and touches your repo only with an explicit opt-in.

// 05 · offline models · powered by Naderu new

A private pen-testing lab that never leaves your machine.

Specialised security models you download and run fully offline — no cloud, no API keys, nothing phoning home. Built for air-gapped, regulated, and sensitive engagements. Trained and released continuously by Naderu, BytesBrains' models company — you own the weights and run them on your own hardware.

hunter-crypto-7b · available now

Names the crypto flaw. Writes the exploit.

Hand it a weak or misconfigured construction and it identifies the weakness, then emits a runnable attack script (PyCryptodome / SageMath) that recovers the plaintext or flag — all on your own machine, with no network.

  • Runs fully offline on Apple Silicon — MLX, LM Studio
  • Open weights, Apache-2.0 — deploy on-prem, edge, or air-gapped
  • Ships with receipts — public model card, benchmarks & training recipe
  • 100% solve rate on its in-distribution crypto set — full harness published
  • For authorized pen-testing, defensive security & CTF only
› Get it on Hugging Face Explore Naderu →
RUNS OFFLINE

Fully offline & private

No cloud, no API keys, no telemetry. The model runs on your hardware, so your targets and findings never leave the building. Air-gap it.

You own the weights

Open-weight releases under Apache-2.0. Run on-prem, at the edge, or fully disconnected — no per-call fees, no lock-in, no kill switch.

Every model ships with receipts

A public model card, reproducible benchmarks, and the training recipe. Evidence over claims — verify it before you trust it.

A growing arsenal

hunter-crypto-7b is live today; more specialised pen-testing models are in training and ship on a rolling basis. ROADMAP

Need a private or custom model trained for your stack? Talk to Naderu →

// 06 · how it works

Up and running in four steps.

  1. 01

    Install

    Add the product from GitHub to the repos or org you choose.

  2. 02

    Bring keys & pick models

    Add your own LLM API keys and assign a model per role.

  3. 03

    Configure

    Set defaults in the dashboard and commit a .wrokin/config.yml.

  4. 04

    It runs on your infra

    Agents trigger on PRs and issues, or on demand. Calls go through your provider — your data and spend stay yours.

// 07 · principles

No black boxes. You see the config, the keys, and the code.

Own your data & keys

Your code and LLM keys stay in your accounts. Runs go through your own provider on infrastructure you control — you decide what the agents can touch.

No lock-in

Swap models or providers anytime. Uninstall cleanly. Nothing holds your stack hostage.

Transparent pricing

Flat monthly price, predictable. You pay your LLM provider directly — no markup, no metering games.

Self-serve first

Designed to install, configure, and run without a sales call or a support queue.

// 08 · why we're different

The colors aren't a coincidence.

Our logo wears many colors on purpose. We believe diversity is the most powerful tool for innovation — here's what that looks like inside wrokin.

Many models

One model has one blind spot.

Where a single model is confidently wrong, a different one sees straight through it. Distinct architectures fail in distinct places — so the gaps stop lining up.

// 09 · pricing

Simple, flat pricing. No surprises.

A flat monthly price for the product — you always pay your LLM provider directly for usage, with no markup or metering games.

  • FREE

    $0

    Open source & trying wrokin out

    • Review, security-audit & issue-triage agents
    • BYOK — 8 providers, a model per role
    • 150 agent runs / month
    • Unlimited repos · community support

    Your LLM keys. Your provider's bill.

    Install
  • BEST VALUE

    PRO

    $19/mo

    Solo developers

    • Everything in Free
    • 1,000 agent runs / month
    • Custom instructions & recipes · email support
    • Autonomous Builder — private preview, not included yet

    50% off your first 2 months · 14-day trial

    Install on GitHub

  • TEAM

    $49/mo

    Teams shipping together

    • Everything in Pro
    • 3,000 agent runs / month
    • Built for teams & shared repos
    • Priority email support

    50% off your first 2 months · 14-day trial

    Install on GitHub

  • BUSINESS

    $199/mo

    Orgs that live in pull requests

    • Everything in Team
    • 20,000 agent runs / month
    • Priority support
    • Full-autonomy Builder + auto-merge — private preview, not included yet

    50% off your first 2 months · 14-day trial

    Install on GitHub

  • ENTERPRISE

    Custom

    Orgs with security, identity & procurement needs

    Custom annual contract · your LLM keys, your bill

    Talk to us
    • Everything in Business
    • Runs on your own runners — GitHub-hosted or self-hosted compute
    • Custom DPA & data-processing terms
    • Unlimited seats & repos · custom run limits
    • Dedicated support channel & SLA · onboarding
    • Annual invoicing · PO / MSA · volume pricing
    • SSO/SAML, SCIM & custom roles ROADMAP

Enterprise is tailored per org — talk to us about SSO, self-hosted runners, and volume terms.

// 10 · the facts

Evaluating us with an agent? The answers it needs.

Every claim below is also machine-readable — and the quality numbers come from a live endpoint, not marketing copy.

BYOKYes — your LLM API key, your provider's bill, no token markup. 8 providers (Anthropic, OpenAI, DeepSeek, Google, Mistral, OpenRouter, Moonshot, Groq); any model id your key can call, chosen per role.
What it postsPR and issue comments in your repo, with file:line findings. Nothing outside your repo.
What leaves your repoThe diff and bounded context go to your model provider under your key. Our telemetry keeps finding locations and outcomes — never finding prose, never your code. Full data-handling story.
Who can trigger itRepo owners, org members, and collaborators only — third parties on a public repo cannot spend your tokens or quota.
QuotasFree 150 · Pro 1,000 · Team 3,000 · Business 20,000 runs/month.
Human checkpointsExactly two: the GitHub install click + key custody, and payment. Everything else is agent-executable.
Proof of qualityPublished per-model evidence — findings, rework rate, human verdicts: api.wrok.in/quality
Machine surfacesllms.txt · capabilities.json · agents.md · w-commands.md · config.schema.json

Put agents on your repos today.

Install wrokin, bring your keys, and let the agents start working — on your infra, under your control.

› Install on GitHub View plans

Code Review

code-review · Live — running in production on every installation

A deterministic pass runs first — real scanners, real advisory databases, real line numbers — and only then does a model reason about what is left. It also resolves the issue the PR closes, so it can judge whether the change does what was asked, not merely whether the code is correct.

Sample output — a review it left on this repo

code-review · real output 
### 🤖 wrokin code review

The diff correctly addresses #408 items 1 (god-files flag unmeasured large
files by byte size) and 4 (fix vendored detection via .gitignore instead of
name matching). Extraction to `gitignore.ts` is clean and DRY, tests cover
the key changes. No security or correctness issues found.

**Missing coverage**
`apps/pi-backend/src/services/gitignore.ts:37` – `isInIgnoredDir` is not
directly tested, though it is exercised indirectly through
`committedIgnoredPaths` tests. A small unit test would add confidence (e.g.
confirm `some/dir/dist/file.js` matches `dist` while `dist-file.js` does not).

<sub>Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)</sub>
Open the full page

Security Audit

security-audit · Live — running in production on every installation

Deliberately narrow: injection, authorization, secrets, unsafe deserialization. No style notes and no general-correctness comments, so a finding here means something. Runs beside code review rather than inside it, so a second model family sees the same diff.

Sample output — a real finding on this repo — it was right

security-audit · real output 
### 🤖 wrokin security audit

apps/pi-backend/src/services/posture/checks-toolchain.ts:365: The `matchesGlob`
function constructs a `RegExp` from user-controlled `.gitattributes` patterns
by mapping `*` to `[^/]*`. This is vulnerable to Regular Expression Denial of
Service (ReDoS) via catastrophic backtracking if a pattern contains multiple
wildcards (e.g., `*a*a*a*a*b`) and is matched against a long, non-matching
path. Remediation: use a non-backtracking glob library or implement a strict
limit on the number of wildcards allowed per pattern.

<sub>Model: google/gemini-3-flash-preview · your key, your model (BYOK)</sub>

—— measured after the report: 7 wildcards against a 60-char path took 29s.
   Fixed by replacing the regex with a segment-wise matcher.
Open the full page

The Hunter

hunter · Private preview — invite only, not yet self-serve

A finding is only filed once a proof-of-concept has run in an isolated sandbox and fired, and a second model family has independently confirmed it. Severity and a CVSS vector only — never a dollar or business-impact estimate.

Sample output — the issue a confirmed finding opens

hunter · real output 
## 🛡️ Proven vulnerability

The **wrokin security hunter** found this issue, wrote a proof-of-concept, and
**detonated it in an isolated sandbox** — it fired. Independently verified by a
second model family.

| | |
|---|---|
| Severity | **high** |
| Category | CWE-78: OS Command Injection |
| CVSS | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| Location | `services/greeter.js:10` |
| Finder → verifier | deepseek-v4-pro → gpt-5.1 |

### Data flow
- source: req.query.name
- sink: execSync(`echo ${name}`)

### Proof of exploitation
```
uid=65534(nobody) gid=65534(nogroup)
```

_Advisory — the hunter never blocks your PR._
Open the full page

Builder

builder · Private preview — a customer cannot switch this on yet

It reads the repo's own AGENT.md and conventions before writing anything, and makes the smallest coherent change that resolves the issue. The PR it opens is reviewed by your review and security agents like anyone else's — it does not get a pass for being a machine.

Sample output — the pull request it opens

builder · real output 
fix(scan): treat a 404 from the protection endpoint as unprotected

Closes #412.

The check read any non-200 as "unknown", so a repository with no branch
protection reported not_checked instead of a finding — the exact silent gap
the epic forbids.

  files changed   2  (+38 −6)
  tests added     4
  suite           186 passed
  grade           verified-green ✓

Opened by wrokin Builder · reviewed by wrokin code-review before merge
Open the full page

Issue Triage

issue-triage · Live — running in production on every installation

It can only apply labels that already exist in your repo, so it cannot invent taxonomy. The summary, priority and duplicate flag land as a comment; nothing is closed or reassigned automatically.

Sample output — what lands on a new issue

issue-triage · real output 
### 🤖 wrokin triage

The pre-push hook fires on tag pushes and runs the full suite to bless a tag
that ships no commits. Skip refs under refs/tags/.

**Suggested priority:** low
**Labels applied:** enhancement
**Possible duplicate:** no

<sub>Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)</sub>
Open the full page

Warden

repo-audit · Live — running in production on every installation

Every row is a fact traceable to a check id, with evidence naming specific paths. Re-running on an unchanged tree produces byte-identical rows. The half nothing else does: whether your codebase is legible to an agent — guidance-file coverage, module size, generated-file markers, reproducible installs.

Sample output — its live report on this repo — 35 checks, verbatim

repo-audit · real output 
## 🏰 Warden — repository posture report

**bytesbrains/wrokin** at `410a816` — 35 checks evaluated:
**1 must fix** · 4 should fix · 10 optional · 20 already right.

### 🔴 Must fix
- **Default branch is protected** — dev is covered by ruleset(s)
  dev-protection, but no status check is required `settings/branch-protection`

### 🟡 Should fix
- **Third-party actions pinned to a commit SHA** — 4 workflows use actions
  pinned to a mutable tag `workflows/pin-actions-by-sha`
- **Workflows declare explicit token permissions** — 3 workflows run with
  default GITHUB_TOKEN permissions `workflows/explicit-permissions`

### 🔵 Optional
- **Code areas have tests next to them** — 5 of 33 code directories have no
  test file in or beside them — a path-level fact, not coverage
  `structure/untested-areas`
- **No overcrowded directories** — apps/pi-backend/src/services (94 files)
  `structure/directory-fanout`

### ⚪ Not checked
- Code / secret scanning — the same status means "off" and "you may not look",
  so this can be confirmed but not refuted `settings/scanning-enabled`
Open the full page

Project Management

project-management · Roadmap — nothing runs it today

Listed here because it appears in the agent catalog, but nothing runs it today. It is on the roadmap rather than in the product, and we would rather say so than let you find out after installing.

Open the full page