SensAI · Secure AI coding
The key never moves.
SensAI is a coding assistant for the terminal, the desktop IDE and the web whose model calls run through an audited proxy, so no raw API key ever sits on your disk.
Install in one line
curl -fsSL https://sensai.immunisense.com/install | bashsensai-cli auth loginWindows, npm and the desktop IDE are in Download.
Request path
What happens to every request.
Four stages, the same on every surface. The provider key is attached at stage three and nowhere else.
- 01
You sign in once
OAuth plus the OS keyring. The CLI, IDE and SensAI-Agent share the session. No provider key is ever issued to you.
- 02
Secrets scan before send
Every request is scanned on your machine first. A leaked key or token is stopped there and marked blocked.
- 03
The proxy holds the key
The audited proxy attaches the provider key server-side and logs the call. The key never moves to your disk.
- 04
One ledger for credits
Each call is charged to one account across the four surfaces: tier credits, then bonus, then top-up.
Surfaces
Four surfaces, one account.
sensai-cli
The engine in the terminal.
SensAI IDE
The desktop app.
SensAI-Agent
Extension for VS Code, Cursor and Windsurf.
Web Chat Mode
sensai.immunisense.com. Chat only, no tools.
Capabilities
How work runs.
| # | Capability | What it does |
|---|---|---|
| 01 | Spec-driven plan mode | Requirements (EARS), design (Mermaid, TDD), then file-by-file tasks. Approval gates with diff previews. Run all or step through. |
| 02 | Multi-agent teams | A conductor runs Coder, Explore, Scout and Designer sub-agents with parallel tool calls. Hard cap of 12 at once. |
| 03 | Checkpoints and sessions | Per-turn snapshots with full undo and restore on every message. Rename sessions, group them per feature, filter by group. |
| 04 | Safe analysis | Read-only exploration in a throwaway git worktree. HEAD is never written. |
| 05 | Code intelligence | 9 LSP tools with delta-aware feedback after every edit, plus ast-grep structural search across 18 languages. |
| 06 | Chat and Design modes | Chat is tool-free conversation. Design writes architecture and DESIGN.md, with no shell. |
| 07 | Guarded MCP | Capability discovery instead of prompt stuffing. Circuit breaker, rate limits, health checks, response scanning, audit log. |
| 08 | Project context | SENSAI.md, then AGENTS.md; DESIGN.md is additive. Skills and rules import, and 14 lifecycle hook event types. |
Models
Every model, one proxy.
All catalog models run through the SensAI proxy. Free tier is Grok Build and Gemma 4. The Sense column is the long-context window; prompts above Base use that rate card. Sense Mode (/sense) selects it where the model offers the toggle. Security Mode (/security) is the Sense Protocol hunt included with Sense, Sense Pro, and Sense Ultra.
| Model | Type | Base | Sense | Provider |
|---|---|---|---|---|
| Grok Build | Reasoning | 200K | 256K | xAI |
| Grok 4.5 | Reasoning | 200K | 500K | xAI |
| Grok 4.3 | Reasoning | 200K | 1M | xAI |
| Grok 4.6 | Reasoning | 200K | 500K | xAI |
| Grok 4.7 | Reasoning | 200K | 500K | xAI |
| Claude Sonnet 5 | Reasoning | 1M | n/a | Anthropic |
| Claude Sonnet 5.5 | Reasoning | 1M | n/a | Anthropic |
| Claude Haiku 5.5 | Reasoning | 100K | 1M | Anthropic |
| Claude Opus 5 | Reasoning | 1M | n/a | Anthropic |
| Claude Opus 5.5 | Reasoning | 1M | n/a | Anthropic |
| Claude Fable 5.1 | Reasoning | 1M | n/a | Anthropic |
| GPT-6 Astra | Reasoning | 272K | 1.05M | OpenAI |
| GPT-6 Sol | Reasoning | 272K | 1.05M | OpenAI |
| GPT-6.1 Sol | Reasoning | 272K | 1M | OpenAI |
| GPT-6 Luna | Reasoning | 272K | 1.05M | OpenAI |
| GPT-5.6 Sol | Reasoning | 272K | 1.05M | OpenAI |
| GPT-5.6 Terra | Reasoning | 272K | 1.05M | OpenAI |
| GPT-5.6 Luna | Reasoning | 272K | 1.05M | OpenAI |
| GLM-5.3 | Reasoning | 1M | n/a | Z.ai |
| GLM-5.3 Flash | Reasoning | 1M | n/a | Z.ai |
| Kimi K3 | Reasoning | 1M | n/a | Moonshot |
| MiniMax M3 | Reasoning | 512K | n/a | MiniMax |
| MiniMax M3.1 Flash | Reasoning | 976K | n/a | MiniMax |
| DeepSeek V4 Flash | Reasoning | 1M | n/a | DeepSeek |
| DeepSeek V4.1 Flash | Reasoning | 1M | n/a | DeepSeek |
| DeepSeek V4 Pro | Reasoning | 1M | n/a | DeepSeek |
| Gemma 4 | Reasoning | 256K | n/a | |
| Gemini 3.8 Flash | Reasoning | 1M | n/a | |
| Gemini 4 Argon | Reasoning | 1M | n/a |
Security Mode
Sense Protocol v1.2.
Read-only by contract
Security Mode runs a coverage-led defensive hunt under Sense Protocol v1.2. The same contract on every catalog model. Included with Sense, Sense Pro, and Sense Ultra.
Allowed
- code_map
- search_code
- scan_secrets
- ast_search / lsp_*
- agent / wait_agent (read-only)
Blocked
- write_fileblocked
- shellblocked
- editblocked
- MCPblocked
- live probingblocked
Seven phases, in order
00
Scope
Rules of engagement, in-scope paths, and the profile: quick, standard, or deep. Source-only. No live exploitation.
01
Recon
Read-only architecture pass. Code map, search, LSP, then AST only when the pattern needs it. Identity, money, and trust edges.
02
Coverage
Hunt units are surface, boundary, and class. A class is skipped only with a one-line reason. The ledger is never silent.
03
Hunt
Read-only class hunters, up to 12 at once. File and line evidence. The hunter does not confirm its own candidate.
04
Refute
A fresh verifier tries to disprove each candidate. One NO on the 7-question gate keeps it unconfirmed.
05
Critic
A coverage critic looks for unmapped surfaces and skipped classes. It proposes coverage, not findings. quick records those gaps as deferred.
06
Report
Markdown, Mermaid, SARIF-shaped findings, JSON, and executive notes. Secrets are redacted. Coverage limits are stated.
The operating contract
- Authorization first
- Confirms scope, targets, exclusions, and rules of engagement before a full audit. Default scope is this workspace.
- Read-only first
- Security Mode never grants write, edit, or shell. Remediation is proposed as text. An approved fix continues in Code Mode.
- Evidence before severity
- Verdicts are confirmed, needs validation, rejected, or hardening. Only a confirmed finding receives a severity.
- Defensive boundaries
- No exploit payloads, live probing, credential theft, or public disclosure. A finding is a trust-boundary failure with a named principal and result.
- Source-first
- The hunt reads this repository. If a decisive fact lives off-box, the verdict stays needs validation.
- Threat intelligence
- Confirmed findings can be correlated with CISA KEV, NVD, CWE, MITRE ATT&CK, and EPSS. Search is for advisories, not a live proof against a service.
- Visual reasoning
- A full audit includes Mermaid diagrams for attack surface, trust boundaries, data flows, and major paths.
- Approval gates
- Discovery, verification, remediation proposal, and fix execution stay separate. The mode does not start writing on its own.
- Hypothesis before report
- A candidate is not a finding until the 7-question gate passes. One NO means it is not confirmed.
- Focused or full
- Focused reviews one surface, file, or class. A full audit walks the hunt classes and states what it skipped.
- quick, standard, deep
- quick is one hunter wave. standard is the default: hunt, refute, coverage critic. deep splits large subsystems. A partial run never implies the rest is fine.
Hunt classes
- AuthZ / IDOR
- AuthN / MFA / session
- JWT / crypto
- OAuth
- Injection
- XSS
- SSRF
- Path traversal
- Secrets
- LLM / tools / MCP
- Data lifecycle
- Billing / credits
- Supply chain
- Business logic
Every finding records
- Fingerprint · ID · Title
- Verdict · Hunt class
- Severity only when confirmed
- Principal · Resource · Control
- Entrypoint to sink (file:line)
- Remediation as text · Residual risk
- CWE · CVE · CVSS · EPSS
Separate roles
- Class hunter
- One class, read-only. Returns candidates. It does not confirm them.
- Independent verifier
- A fresh agent that did not hunt the candidate. It tries to refute it. One NO on the gate is not confirmed.
- Coverage critic
- Looks for skipped classes and unmapped surfaces. It proposes coverage, not findings.
Pricing
Credits, not contracts.
Three balance buckets are consumed in order: tier, then bonus, then top-up. Only tier credits reset each billing cycle.
Core
Start free, then scale credits.
Free
$0
free, no card
50 credits/month
Create free accountPro
$20
/month
500 credits/month
Subscribe to ProUltra
Recommended for daily use$40
/month
1,050 credits/month
Subscribe to Ultra
Sense
High-volume credits with Security Mode included.
Sense
$100
/month
2,650 credits/month
Subscribe to SenseSense Pro
$200
/month
5,500 credits/month
Subscribe to Sense ProSense Ultra
$400
/month
11,000 credits/month
Subscribe to Sense Ultra
Compare plans
| Feature | Free | Pro | Ultra | Sense | Sense Pro | Sense Ultra |
|---|---|---|---|---|---|---|
| Credits per month | 50 | 500 | 1,050 | 2,650 | 5,500 | 11,000 |
| Models | Grok Build and Gemma 4 | All catalog models | All catalog models | All catalog models | All catalog models | All catalog models |
| Reasoning | Auto-reasoning (no effort picker) | All reasoning levels | All reasoning levels | All reasoning levels | All reasoning levels | All reasoning levels |
| Context | 256K context | Up to 1.05M context (Sense) | Up to 1.05M context (Sense) | Up to 1.05M context (Sense) | Up to 1.05M context (Sense) | Up to 1.05M context (Sense) |
| Priority routing | Not included | Not included | Not included | Not included | Included | Included |
| Security Mode | Not included | Not included | Not included | Included | Included | Included |
- Sense Mode
- The long-context window, opened with /sense. Up to 1.05M tokens on paid plans.
- Sense, Sense Pro, Sense Ultra
- Subscription tiers. They are plan names, not a mode.
- Sense Protocol v1.2
- The read-only audit contract that Security Mode runs on every catalog model.
An upgrade applies immediately. A downgrade keeps the current plan until the next billing cycle.
Questions
Keys, install, and price.
What is SensAI?
SensAI is immunisense's secure AI coding assistant for the terminal, desktop IDE, SensAI-Agent, and web Chat Mode. Spec-driven planning, Security Mode (Sense Protocol v1.2), multi-agent orchestration, nine LSP tools, and proxy-backed model access. Zero raw API keys on disk.
Does SensAI store API keys on disk?
No. SensAI routes every model call through an audited proxy. Authentication uses OAuth and the OS keyring. Developers never handle raw API keys, and pre-flight secrets scanning runs on every request.
How do I install SensAI?
Download SensAI IDE from immunisense.com/solutions/sensai. SensAI-Agent is the extension on the Visual Studio Marketplace as IMMUNISENSECORP.sensai-ide, for VS Code, Cursor, and Windsurf. Windows is the current IDE installer; macOS and Linux follow as builds are published. The CLI is curl -fsSL https://sensai.immunisense.com/install | bash on macOS and Linux, irm https://sensai.immunisense.com/install.ps1 | iex on Windows, or npm install -g sensai-cli. Use one CLI installer per machine, then run sensai-cli auth login. Web Chat Mode is at sensai.immunisense.com.
What does SensAI cost?
SensAI has a free tier with 50 credits per month for Grok Build and Gemma 4. Pro is $20 per month (500 credits), Ultra $40 (1,050), Sense $100 (2,650), Sense Pro $200 (5,500), and Sense Ultra $400 (11,000). Every plan includes AI-powered agent creation. Sense, Sense Pro, and Sense Ultra include Security Mode. Priority routing is included with Sense Pro and Sense Ultra.
When does a plan change take effect?
An upgrade applies immediately. A downgrade keeps the current plan until the next billing cycle, then switches. Security Mode follows the plan you still have until that date.
How do Sense Mode, the Sense plans, and Security Mode differ?
Sense Mode, reached with /sense, is the long-context window on models that support it. Sense, Sense Pro, and Sense Ultra are subscription tiers and include Security Mode, the Sense Protocol v1.2 defensive hunt reached with /security. Priority routing is included with Sense Pro and Sense Ultra.