The agentic security workspace

Pentests,
orchestrated.

JULS brings scope, browser evidence, source context and specialist agents into one controlled workflow—then turns the work into clear, reviewable findings.

See JULS work ↓ Explore the system ↗

Assessment planner

Your review

PORTAL REVIEW / PLAN 003

Authentication boundary review

5 / 5

Alex · Pentester

Review authentication boundaries. Use the approved scope and verified test identities.

P M A S

4 agents completed the plan

Mapper mapped login and recovery flows Done

Analyst compared authenticated identities Done

Source traced authorization handlers Done

Planner drafted 8 targeted test cases Done

READY FOR YOUR REVIEW8 draft tests ready for review

Planning is complete. You decide what runs next.

Review tests ↗

One secure workspace Specialist agents Human-reviewed output

01 / THE SYSTEM

One continuous loop.

JULS keeps every stage connected, so evidence, decisions and output remain traceable from first scope to final report.

Scope

Targets, identities, repositories and rules begin in one bounded workspace.

Discover

Capture the authorized HTTP surface through an isolated browser session.

Plan

Specialist agents map evidence and source context into targeted test cases.

Verify

Run focused checks, retain evidence and keep the tester in control.

Report

Turn reviewed findings into an immutable, client-ready security report.

02 / PRODUCT

See the work.

JULS is built to make progress and coverage clear. Do not trust AI models alone, inspect the work, edit the tests, run them and review the findings before publishing a report.

JULS / DEMO WORKSPACE Product UI

JULSSecurity planner

Ready

Plan a full assessment of this application. Focus on attacker tests.

✓

Planning complete72 steps · 14m 19s

P M S

JULS12:04 PM

The capture-based baseline is ready. Every captured request has been reviewed and mapped to a test or an explicit exclusion.

Coverage includes authentication, session handling, authorization and input validation across both verified users and anonymous access.

READY FOR REVIEW47 structured tests

Inspect the objective, identity and linked requests. Approve or reject each draft before execution.

Source context enriches the plan. Coverage gaps remain visible for your review.

Ask about or refine this plan…

TESTS

Plan tests

This plan⌄Completed47 tests＋ Add test

All 47Draft 46Approved 0Running 0Complete 1Failed 0Cancelled 0

SeverityStatusTestCoverageActions

• HighDraftTest CSRF protection on user123 snippet creationCSRF ⚿ user123⌁ Traffic · 1‹/› Code · 2✎× Reject✓ Approve

Status

Awaiting review.

Check whether a cross-site navigation can create a snippet in user123’s session. Source context points to a state-changing GET without a CSRF check; runtime verification is still required.

⌁ Requests 1

GET/newsnippet2

‹/› Code 2

gruyere.pyL366–381

The creation handler adds the supplied snippet to the logged-in user’s list without a CSRF-token or method check.

SOURCE CONTEXT · DEMO REFERENCE

resources/newsnippet.gtlL19–23

The form uses GET and provides no anti-CSRF value.

<form method="GET" action="/newsnippet2">
  <input name="snippet" />
</form>

ILLUSTRATIVE EXCERPT

• HighDraftAuthenticate as user124 and establish a protected sessionauthentication/session ⚿ user124⌁ Traffic · 2✎× Reject✓ Approve

Status

Awaiting review. No test has run.

Verify the login flow and protected session using the second approved identity.

GET/login

GET/snippets.gtl

• HighDraftVerify user123 logout invalidates the sessionsession invalidation ⚿ user123⌁ Traffic · 3✎× Reject✓ Approve

Status

Awaiting review. No test has run.

Check that protected content is no longer accessible with the same session after logout.

GET/logout

GET/snippets.gtl

• HighDraftBlock anonymous access to the snippets areaauthorization/access control Anonymous⌁ Traffic · 1✎× Reject✓ Approve

Status

Awaiting review. No test has run.

Request protected snippets without an authenticated session and inspect the access boundary.

GET/snippets.gtl

• HighDraftBlock anonymous access to profile editingauthorization/access control Anonymous⌁ Traffic · 1✎× Reject✓ Approve

Status

Awaiting review. No test has run.

Verify that an anonymous request cannot access or modify the profile form.

GET/editprofile.gtl

REPORTS

Portal review

REPORT REVIEW / FINDING 01

Cross-workspace finding access

Critical · 9.1

CRITICALFINDING 01

Cross-workspace
finding access

An authenticated user can access a finding from another workspace by supplying its identifier directly.

CVSS: 9.1
CWE: 639
Status: Confirmed

Observation

The finding endpoint returned data outside the caller’s assigned workspace. The server accepted the record identifier without validating tenant ownership against the active session.

Evidence

REQUESTHTTP

GET /api/v1/findings/finding_b
Host: portal.example.test
Cookie: session=workspace_a_user

RESPONSE200 OK

{
  "id": "finding_b",
  "workspace": "workspace_b",
  "severity": "critical"
}

Complete all required sections and review the PDF before publishing.

01 / TESTS

Every test, visible.

Refine the plan in chat. Inspect each draft’s objective, identity and linked requests, then approve or reject it before execution.

03 / CLI

Your terminal.
Same workspace.

Capture traffic from your local browser, bring in committed source and keep everything connected to your assessment.

juls — local connectorILLUSTRATIVE DEMO

~/assessments authenticated session

juls browser start --assessment ASSESSMENT_ID

01Connecting to your JULS assessment

02Local Chromium connected

03Captured traffic sent to the assessment

✓Discovery is visible in JULS

Browse from your own network. Captured traffic stays attached to the assessment.

CONNECTED WORKSPACE

PORTAL REVIEW / DEMO ASSESSMENT

Discovery

Local browser

Traffic from your browser, ready for the planner.

GET

/loginAuthentication surface

GET

/accountAuthenticated session

POST

/api/profileCaptured request and response

Local capture. Shared assessment context.

YOUR MACHINE → YOUR JULS ASSESSMENT

Examples show the connection flow. Commands use your assessment ID.

Private targets.Local browser.Shared context.

04 / CONTROL

Agents with boundaries.

Automation should make expert work clearer—not opaque. JULS keeps authorization, evidence and decisions visible at every step.

Discuss your workflow ↗

Strict scope

Authorized targets, identities and workspace rules travel with each run.

Private evidence

Credentials stay vaulted and production files remain in private object storage.

Clear review

Testers approve findings and publish immutable versions for clients.

Tenant isolated

Agents run in isolated sandboxes with access only to approved targets; everything else is blocked at the network layer.

The best security work is

FOCUSED. TRACEABLE. ACCOUNTABLE.

05 / NEXT STEP

Bring your next assessment.

See how JULS turns real scope and evidence into a reviewable security workflow.

Request demo ↗ Back to top ↑

HUMAN-LED / AGENT-ASSISTED JULS by DCODX

CODE AGENTReview sourceif user.can_read…

HTTP AGENTProbe requestsGET /account 200

Agents investigate. You decide.

Pentests,
orchestrated.

Authentication boundary review

One continuous loop.

Scope

Discover

Plan

Verify

Report

See the work.

Plan tests

Authorization coverage

Portal review

Portal review

Every test, visible.

Your terminal.
Same workspace.

Discovery

Agents with boundaries.

Strict scope

Private evidence

Clear review

Tenant isolated

Bring your next assessment.

See JULS work.

Pentests,orchestrated.

Authentication boundary review

One continuous loop.

Scope

Discover

Plan

Verify

Report

See the work.

Portal review

Portal review

Observation

Evidence

Every test, visible.

Your terminal.Same workspace.

Discovery

Agents with boundaries.

Strict scope

Private evidence

Clear review

Tenant isolated

Bring your next assessment.

Pentests,
orchestrated.

Your terminal.
Same workspace.