# nirikshak

**निरीक्षक** — someone who watches, observes, keeps an eye on something over time. That's basically what this does, just for your domain's attack surface instead of a person.

So: nirikshak. It runs the standard passive recon checks, but it **remembers the last scan and tells you what changed**, and it's built MCP-native from the start so Claude (or any MCP client) can drive it directly, not just as a CLI you wrap.

## what it actually does

- Checks security headers (HSTS, CSP, X-Frame-Options, etc) against a real page fetch, not a hardcoded list
- Pulls the TLS cert and flags anything expiring soon or running an old protocol version
- Passive subdomain enumeration off certificate transparency logs (crt.sh) — doesn't touch the target at all for this
- WHOIS/RDAP lookup for registration + expiry info
- Basic tech stack fingerprinting (CMS, framework, CDN)
- **Subdomain takeover detection** — resolves CNAMEs on discovered subdomains and checks if they point at an unclaimed cloud resource (dangling GitHub Pages, S3 bucket, Heroku app, Azure, Netlify, etc). This is the classic "forgot to delete the DNS record after decommissioning the service" bug and it's a real bounty-worthy finding
- **Snapshot + diff engine** — every scan is saved locally (`~/.nirikshak/snapshots/`), and the next scan tells you exactly what's new, what disappeared, what regressed. New subdomain shows up → flagged. Header that was there last week is gone now → flagged. Cert crossed the 30-day mark → flagged.
- A 0-100 exposure score with a letter grade so you don't have to read the whole report to know if things are fine or not
- One active tool (`port_scan`, nmap-backed) that's opt-in only and requires you to actually confirm you're authorized to scan the target

Everything except `port_scan` is 100% passive — it either does what a browser would do (fetch a page, do a TLS handshake) or queries a public third-party dataset (crt.sh, RDAP). Nothing here brute-forces, exploits, or attacks anything.

## example output

```
$ python cli.py scan github.com

nirikshak — surface report for github.com
Score: 81/100  (grade B)

Findings:
  -  4  Missing security header: Permissions-Policy
  - 15  TLS certificate expires in 28 days

Since last scan:
  [WARNING] Security header(s) that were present before are now missing: Content-Security-Policy.
  [INFO] 1 new subdomain(s) appeared since last scan — worth confirming these are yours.

Attack surface:
  Subdomains found: 3
  Tech stack: react
```

(that's a real run against github.com's public headers, not a mockup — the diff part was simulated for the demo but the scoring/header/TLS numbers are actually pulled live)

## install

```bash
git clone https://github.com/ewwhardik/nirikshak.git
cd nirikshak
pip install -r requirements.txt
```

### run it from the terminal

```bash
python cli.py scan example.com
python cli.py scan example.com --json     # raw output if you want to pipe it somewhere
python cli.py scan example.com --no-takeover
```

### or hook it up to Claude / any MCP client

```json
{
  "mcpServers": {
    "nirikshak": {
      "command": "python",
      "args": ["/absolute/path/to/nirikshak/mcp_server.py"]
    }
  }
}
```

There's also a Claude Skill in `skill/SKILL.md` — drop it in your skills folder and Claude will know to run `full_surface_scan` and write the report in plain English instead of dumping raw JSON at you.

## how this compares to what's already out there

Not trying to pretend this replaces Amass or SpiderFoot, those are way more mature and have way more data sources. Being honest about where this fits:

| | Amass / theHarvester / Recon-ng | SpiderFoot | nirikshak |
|---|---|---|---|
| Passive recon (subs, headers, whois, tech) | yes | yes, way more sources | yes, smaller source list |
| Remembers previous scans & tells you what changed | no | no | **yes** |
| Subdomain takeover detection | some forks have it | no | yes |
| Usable as an MCP tool by an AI agent out of the box | no | no | **yes** |
| Setup | CLI, some config | needs a server/DB for the full experience | `pip install`, done |

If you need deep OSINT with 200 data sources, use SpiderFoot. If you want something lightweight that tells you what actually changed since last Tuesday and that an AI agent can run for you without you touching a terminal, that's this.

## roadmap / stuff I haven't gotten to yet

- [ ] Scheduled scans (cron wrapper, so it actually monitors instead of you remembering to run it)
- [ ] Email notification / webhook when a new critical finding shows up
- [ ] More takeover fingerprints (the list right now covers the common ones, not exhaustive)
- [ ] Basic web dashboard instead of just CLI/JSON output
- [ ] IPv6 support in the port scanner

PRs welcome if you want to knock any of these out.

## ⚠️ before you scan anything

Only run this against domains you own or have explicit permission to test. `port_scan` especially — that one's active, everything else just reads public data.

## license

MIT, see [LICENSE](LICENSE).

— Hardik