Catch security issues before they cross the boundary.
Antra is a static analysis security linter for React Server Components and the Next.js App Router. It finds the exact point where a value crosses a trust boundary without validation.
What if you caught it before you pushed?
A value that crosses a trust boundary costs minutes to fix while the file is still open in your editor. The same crossing after release means an incident review and a deploy under pressure. Antra runs where the code is written, so the cheapest fix is also the first one available.
Security checks, from code to production.
Parse the project into syntax trees and classify every file's boundary role.
Trace concrete values across React Flight, Server Actions, and route handlers.
Antra Studio shows the path a value took, from origin to the crossing that fired.
Insert a reasoned suppression, or change the code and let `antra scan` confirm the fix.
What Antra actually looks for.
Antra is a static analysis security linter. Every check below runs on your source, locally: a scan makes no network calls and no code leaves the machine.
Detects values passed from Server Components into Client Components through the React Flight payload.
Reads your schema to know which fields are sensitive, with providers for Prisma, Zod, Supabase, OpenAPI, and Drizzle.
Follows a value from its source through assignments, function returns, component props and up to three imports to the boundary it crosses.
Recognizes the sanitizers you already use and stays quiet when a value has been validated.
What it does, and what it does not.
A security tool is only useful if you know where it stops. Antra is deliberately narrow: it looks at how values move across boundaries in your own code.
- +Flag values that cross a trust boundary without validation
- +Read sensitive-field names from your own schema providers
- +Trace taint from a source to the crossing it reaches
- +Respect sanitizers and suppressions you have already written
- +Scan your source with no network access
- −Scan your dependencies for published advisories
- −Audit infrastructure, Docker, or Kubernetes manifests
- −Detect leaked credentials or committed secrets
- −Replace a runtime application firewall or a penetration test
Findings are error or warning. Nothing in between, because a level nobody agrees on is a level nobody acts on.
Fits the pipeline you already have.
Antra runs as a CLI step. There is nothing to host and nothing to install on a server, so a GitHub Action, a generic CI job, or a pre-commit hook all work the same way.
Add Antra as a dev dependency and run `antra init` to write a config for your project.
`antra scan` reports findings in the terminal, as JSON, or as SARIF for your code host.
`--fail-on-violation` turns a scan into a non-zero exit code your pipeline can block on.
`antra studio` opens the graph view for triage when a finding needs human judgement.
Run one scan. See what crosses.
Antra is local, static, and fast. Point it at your App Router project and read the first report in a few minutes.