For authorized security work

The terminal agent
for offensive security.

Excession reads your code, runs your tools and writes up what it finds. Recon, code audit, exploit development and reverse engineering, from your shell, with every command under your approval.

$curl -fsSL https://excessionlabs.ai/install.sh | sh

Then run excession login and approve in your browser.

Get access Use the API

excession — ~/engagements/acme-api

scope: api.acme.test (staging) · rules of engagement loaded

❯ audit the auth service for broken access control

• reading src/routes/*.ts  (41 files)
• found   PATCH /users/:id checks session, not ownership
? run     curl -s -X PATCH api.acme.test/users/1042 -H @tok
          allow once · always · deny  ▸ allow once
• result  200 OK — role changed on another tenant's user

■ HIGH  IDOR on PATCH /users/:id
         evidence, repro and fix written to findings/001.md

❯

Works with Claude CodeCodexOpenCodeany OpenAI SDKany Anthropic SDK

Built for the work, not around it.

General assistants stall on security tasks. Excession is set up for in-scope offensive work from the first prompt.

Purpose-built for security

Prompts, tools and skills for recon, web and API testing, code audit, exploit development and malware analysis.

You approve every action

Shell commands, file writes and network calls stop for approval. Allow once, always for a pattern, or deny.

Scope stays in front

Load rules of engagement once. The agent keeps targets and limits in context and flags anything outside them.

Your harness, your choice

excession connect claude points Claude Code, Codex or OpenCode at the same model. No other account needed.

1M-token context

Whole repositories, long captures and big binaries' disassembly fit in one session.

Findings, not chat logs

Every finding lands as a file with evidence, reproduction steps and a fix, ready for the report.

Launch pricing · 50% off list

One API, three wire formats.

Drop-in for OpenAI Chat Completions, OpenAI Responses and Anthropic Messages. Same key, same balance as the agent.

Input: $0.075/ 1M tokens
Cached input: $0.0015/ 1M tokens
Output: $0.30/ 1M tokens

Context 1,048,576 tokens. Tool calls, streaming, JSON output and images supported.

curl https://api.excessionlabs.ai/v1/chat/completions \
  -H "Authorization: Bearer $EXCESSION_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "excession-1",
    "messages": [{"role": "user",
      "content": "Review this nginx config for SSRF paths."}]
  }'

from openai import OpenAI

client = OpenAI(
    base_url="https://api.excessionlabs.ai/v1",
    api_key=os.environ["EXCESSION_API_KEY"],
)
r = client.chat.completions.create(
    model="excession-1",
    messages=[{"role": "user", "content": "Triage this crash log."}],
)
print(r.choices[0].message.content)

# one command does this for you:
excession connect claude

# or by hand:
export ANTHROPIC_BASE_URL=https://api.excessionlabs.ai
export ANTHROPIC_AUTH_TOKEN=$EXCESSION_API_KEY
export ANTHROPIC_MODEL=excession-1
claude

Plans

Each plan is monthly usage credit for the agent and the API. Credit renews every billing month. Top up any time.

Starter

$20/ month

$20 of usage every month

Side projects, CTFs and learning.

Choose Starter

Pro

$100/ month

$100 of usage every month

Daily engagements for one operator.

Choose Pro

Max

$200/ month

$200 of usage every month

Long-horizon agents and big codebases.

Choose Max

Ultra

$500/ month

$500 of usage every month

Teams and parallel agent fleets.

Choose Ultra

Access in three steps.

Most people are approved on the spot. If not, a reviewer answers within two business days.

Verify your emailA six-digit code. No password to remember.
Add a cardA $0 check, never charged. Prepaid cards aren't accepted.
Accept the Acceptable Use PolicyTest only systems you are authorized to test. Read it.

Questions

Who is Excession for?

Penetration testers, red teams, bug bounty hunters, security engineers and researchers doing authorized work. You confirm that you have permission to test every system you point it at.

What won't it do?

Work against targets you are not authorized to test, and anything outside cyber security: weapons, biological or chemical harm, and child sexual abuse material are blocked. See the Acceptable Use Policy.

How does billing work?

A plan adds its price in usage credit at the start of every billing month; unused plan credit does not roll over. Top-ups never expire. Every request shows its exact cost in your dashboard.

Can I use my existing tools?

Yes. excession connect configures Claude Code, Codex or OpenCode to use your Excession key, and the API works with any OpenAI or Anthropic SDK.

Do you train on my data?

No. Prompts and outputs are not used for training. We keep request metadata (token counts, cost, time) for billing. See the Privacy Policy.

Can I cancel?

Any time from the billing page. Your plan runs to the end of the month you paid for.

Start in two minutes.