DeepZero · House #20,177

What it is

Calls itself “vulnerability research framework”.

• Calls itself: vulnerability research framework

“DeepZero is an automated vulnerability research framework that parses, decompiles, and analyzes thousands of Windows kernel drivers for exploitable IOCTLs natively using AI agents.”

Who it sells to

Sells to developers. Available in 3 languages.

• Sells to: developers
• Languages: English · Français · 简体中文

“DeepZero turns vulnerability research into repeatable YAML pipelines: ingest samples, filter, decompile with Ghidra, scan with Semgrep, and optionally assess results with LLMs.”

“English | 简体中文 | Français”

How it runs

A API and command-line tool for POSIX and Windows. Runs locally and works offline. Distributed through the npm. Offers an API. Open source. AI is the core of the product. You can bring your own API key.

• Kind: api · cli
• Runs on: POSIX · Windows
• Runs where: on the device, offline
• Distributed via: npm
• API: yes
• Open source: yes
• AI role: core to the product
• Bring your own key: yes

“🌐 REST API (WIP) - query run state and sample data over HTTP (currently experimental and incomplete)”

“…deepzero run pipelines/demo/samples -p pipelines/demo/pipeline.yaml”

What it works with

Integrates with Ghidra, LiteLLM and Semgrep. Names GitHub Copilot and MCP Registry on its pages.

• Integrates with: Ghidra · LiteLLM · Semgrep
• Names: GitHub Copilot · MCP Registry

“DeepZero turns vulnerability research into repeatable YAML pipelines: ingest samples, filter, decompile with Ghidra, scan with Semgrep, and optionally assess results with LLMs.”

“GitHub Copilot Write better code with AI”

What it offers as proof

Live, no waitlist. Publishes docs.

“You must be signed in to change notification settings”

“…docs -> https://github.com/416rehman/DeepZero/tree/main/docs”