For authorized security work

The terminal agent
for offensive security.

Excession reads your code, runs your tools and writes up what it finds. Recon, code audit, exploit development and reverse engineering, from your shell, with every command under your approval.

$curl -fsSL https://excessionlabs.ai/install.sh | sh

Then run excession login and approve in your browser.

Get access How it works

excession — ~/engagements/acme-api

scope: api.acme.test (staging) · rules of engagement loaded

❯ audit the auth service for broken access control

• reading src/routes/*.ts  (41 files)
• found   PATCH /users/:id checks session, not ownership
? run     curl -s -X PATCH api.acme.test/users/1042 -H @tok
          allow once · always · deny  ▸ allow once
• result  200 OK — role changed on another tenant's user

■ HIGH  IDOR on PATCH /users/:id
         evidence, repro and fix written to findings/001.md

❯

Web & API testingCode auditExploit developmentReverse engineeringMalware analysisCloud & network

Built for the work, not around it.

General assistants stall on security tasks. Excession is set up for in-scope offensive work from the first prompt.

Purpose-built for security

Prompts, tools and skills for recon, web and API testing, code audit, exploit development and malware analysis.

You approve every action

Shell commands, file writes and network calls stop for approval. Allow once, always for a pattern, or deny.

Scope stays in front

Load rules of engagement once. The agent keeps targets and limits in context and flags anything outside them.

Steer it mid-run

Message the planner or any worker while it runs. Pause a worker, change its direction, then let it continue.

1M-token context

Whole repositories, long captures and big binaries' disassembly fit in one session.

Findings, not chat logs

Every finding lands as a file with evidence, reproduction steps and a fix, ready for the report.

A harness, not a chat window.

Excession runs an engagement the way a team does: plan the work, split it, run it in parallel, and keep evidence for every claim.

01
Scope
Give it a goal and the rules of engagement. Targets and limits stay in every agent's context.
02
Plan
A planner breaks the goal into tasks, orders them, and re-plans as results come in.
03
Run in parallel
Workers take tasks at the same time. Every tool call follows your rules: allow, deny, or ask you.
04
Prove
A goal closes only when a finding is linked to its evidence. Findings, traces and the report stay on disk.

Building your own tools on the same model? See the Excession API.

Plans

Each plan is monthly usage credit for the agent and the API. Credit renews every billing month. Top up any time.

Starter

$20/ month

$20 of usage every month

Side projects, CTFs and learning.

Choose Starter

Pro

$100/ month

$100 of usage every month

Daily engagements for one operator.

Choose Pro

Max

$200/ month

$200 of usage every month

Long-horizon agents and big codebases.

Choose Max

Ultra

$500/ month

$500 of usage every month

Teams and parallel agent fleets.

Choose Ultra

Access in three steps.

Most people are approved on the spot. If not, a reviewer answers within two business days.

Verify your emailA six-digit code. No password to remember.
Add a cardA $0 check, never charged. Prepaid cards aren't accepted.
Accept the Acceptable Use PolicyTest only systems you are authorized to test. Read it.

Questions

Who is Excession for?

Penetration testers, red teams, bug bounty hunters, security engineers and researchers doing authorized work. You confirm that you have permission to test every system you point it at.

What won't it do?

Work against targets you are not authorized to test, and anything outside cyber security: weapons, biological or chemical harm, and child sexual abuse material are blocked. See the Acceptable Use Policy.

How does billing work?

A plan adds its price in usage credit at the start of every billing month; unused plan credit does not roll over. Top-ups never expire. Every request shows its exact cost in your dashboard.

Is there an API?

Yes. The model behind Excession is available through an OpenAI- and Anthropic-compatible API, with the same key and balance as the CLI. See the API page.

Do you train on my data?

No. Prompts and outputs are not used for training. We keep request metadata (token counts, cost, time) for billing. See the Privacy Policy.

Can I cancel?

Any time from the billing page. Your plan runs to the end of the month you paid for.

Start in two minutes.