Validate and explain whether a target is authorized; performs no network request.

Canonicalize and evaluate up to 100 targets without network activity.

Generate a bounded typo-oriented candidate list for one authorized domain without resolving or contacting any candidate.

Classify security-relevant query parameters locally while hashing, rather than returning, their values.

Inspect supplied text locally for common credential formats and return only redacted fingerprints and locations.

Extract AWS S3, Google Cloud Storage, Azure Blob, and Firebase references from supplied text without accessing them.

Validate a CVSS v3.1 base vector and calculate its score, rating, impact, and exploitability locally.

Analyze supplied JSON or alias-free YAML for operations, authentication coverage, deprecated endpoints, and security signals.

Resolve selected DNS record types for one authorized domain.

Inspect DNSKEY, DS, and RRSIG publication for an authorized domain without claiming full resolver validation.

Resolve up to five random, authorized labels beneath a domain to identify wildcard DNS behavior.

Inspect CNAME targets and report unresolved aliases as takeover indicators requiring manual verification.

Inspect MX, SPF, DMARC, MTA-STS, and SMTP TLS reporting records for an authorized domain.

Query certificate-transparency logs and optionally resolve a bounded candidate list.

Fetch one authorized URL with bounded redirects/body size and return metadata, not body data.

Fetch metadata for up to 20 authorized HTTP(S) URLs with bounded concurrency and per-target errors.

Analyze security and disclosure headers on one authorized HTTP endpoint.

Fetch an authorized endpoint and assess CSP directives for unsafe, missing, duplicate, and deprecated controls.

Fetch and summarize the RFC 9309 robots.txt file for an authorized origin without crawling disclosed paths.

Fetch a same-origin sitemap, inventory bounded URLs, and distinguish authorized from external entries.

Fingerprint likely frameworks, platforms, servers, and generators using bounded response evidence.

Probe a bounded set of standardized and conventional metadata paths on an authorized origin.

Inspect one authorized page or script plus a bounded set of same-scope scripts for literal URL and path references.

Inspect a bounded set of authorized JavaScript files for sourceMappingURL references and check map availability without returning map contents.

Probe conventional same-origin discovery documents and summarize endpoints, grants, response types, and PKCE support.

Send bounded read-only __typename probes to conventional or supplied same-origin paths; optional introspection checks remain read-only.

Issue HEAD requests for a small curated set of high-risk paths and report candidates without reading their contents.

Assess Cache-Control, Vary, validators, CDN signals, and sensitive-path caching on one authorized response.

Inventory external script and stylesheet resources and measure Subresource Integrity coverage.

Fetch a discovered or conventional same-scope favicon and return stable hashes and metadata, never image bytes.

Send one OPTIONS request and assess advertised methods without attempting state-changing methods.

Send bounded cross-origin probes and identify permissive CORS responses.

Inspect Set-Cookie attributes without sending authentication material.

Discover and validate RFC 9116 security.txt metadata on an authorized origin.

Probe a bounded list of conventional paths and summarize OpenAPI/Swagger documents without returning their full contents.

Inspect certificate identity, validity, protocol, cipher, and trust for an authorized host.

Test TLS 1.0 through 1.3 support against scope-pinned addresses and identify obsolete protocols.

Perform a bounded TCP connect scan against one authorized host.

Crawl a bounded number of same-host HTML pages and inventory links and forms.

Probe a bounded path list on one authorized web origin.

Decode JWT metadata locally and flag unsafe algorithms or claim timing; does not verify a signature.

Run the locally installed Nuclei scanner against one authorized target when explicitly enabled.

Run the explicitly enabled Subfinder binary for one authorized domain and retain only in-scope subdomains.

Run the explicitly enabled Amass passive enumeration mode and retain only in-scope subdomains.

Run the explicitly enabled Assetfinder binary and retain only in-scope subdomains.

Run the explicitly enabled gau archive discovery binary and retain only authorized HTTP(S) URLs.

Persist a structured security finding in the local finding store.

Store a private, hashed text evidence artifact and link it to a finding.

List locally persisted findings with optional filters.

Update status, remediation, and audit history for a local finding.

Export current findings as JSON, Markdown, escaped HTML, or SARIF 2.1.0.

Summarize finding severity/status, targets, scope readiness, and runtime metrics.

Report safe configuration and optional dependency status without exposing secrets.