Introducing Incursion
Incursion by Excession Labs is an AI agent for offensive security that runs in your terminal. A planner splits the job, workers run it in parallel, and every finding comes back with proof.
What it is
Incursion is a terminal workspace for authorized security work: reconnaissance, web and API testing, code audit, exploit development, reverse engineering and malware analysis. It is its own harness: it runs the agent loop, the tools, the planner, the workers, the task graph and the session history.
It is for pentesters, red teams, bug bounty hunters and security engineers who work from a terminal. It does in-scope work without refusing it. The Acceptable Use Policy sets the scope: you test only systems that you own or have written permission to test.
How it works
- You give a goal, and a planner breaks it into assignments, which are tasks in a task graph.
- Workers run the assignments in parallel, 12 at most by default. Open
/agentsto see each assignment and its latest action. Set the limit with/agents 8, or with-and+in that view. Presspthere to pause or resume the selected assignment. The composer stays open while work runs. - Each command, file write and network call can run on its own, be blocked, or wait for your approval. You set the rules with
excession rules. Tools run with your full user access, so set a rule for anything you want blocked or held for approval. - Each finding has a severity, a status, the target and source line, a summary, the evidence, steps to reproduce and a fix. You can retest a finding in a fresh session.
/resultslists the findings with severity and status, and/reportwrites a Markdown findings report,report.md.
Incursion works with the tools you already use: MCP servers, skills, AGENTS.md project instructions, custom slash commands and hooks. Long sessions compact their own context. You can save, resume, fork and export sessions.
Models
Run /model to choose one of two models. Both run through your Excession account and use your plan credit and balance. You do not need separate provider API keys.
- DeepSeek V4.1 Flash,
deepseek/deepseek-v4.1-flash-1017(the default) - DeepSeek V4.1 Flash Abliterated,
deepseek-v4.1-flash-abliterated
Kimi K3.1 Pro, GLM 5.5 and GLM 5.3 are coming soon. Prices per model are on the API page. /effort sets the reasoning level. The default is high.
How to start
1. Install Incursion. On macOS and Linux:
curl -fsSL https://excessionlabs.ai/install.sh | shOn Windows (PowerShell):
irm https://excessionlabs.ai/install.ps1 | iex2. Sign in by running excession or excession login. The terminal shows a code and opens the browser. Check that the codes match, then approve. There is no access request and no review.
3. Use the $5 API credit included once with every new account. No card required. When you need more, add funds from $0.50 or pick a plan in Billing. See how pricing works.
4. Open your project and give a concrete first request:
excession whoami
excession -C /path/to/your/projectReview this repository's authentication flow. Explain confirmed issues with file
references and reproduction steps, then propose fixes and regression tests.Scripts and CI
Headless mode runs without the interface. With --json, stdout is a JSONL event stream and the exit code reports the result.
excession exec 'Review this repository and verify confirmed findings.' --json
git diff | excession exec 'review this'The API
The Excession API serves the same models. The base URL is https://api.excessionlabs.ai/v1. It accepts OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, with streaming and tool calls. The limit is 600 requests per minute per key. The CLI and your API keys use the same account, plan credit and balance. Details are on the API page and in the API docs.