Security testing for web apps, APIs, and AI systems.
Run repeatable scans, investigate targets with your AI coding agent, and review findings with supporting evidence, all from your own environment.
curl -fsSL https://install.shakerscan.com | shThen open http://localhost:3000. The installer places ShakerScan under your home directory, creates the shakerscan command, and binds the UI and API to localhost.
Only test systems you own or are explicitly authorized to assess. Active testing can change application state, generate traffic, and trigger defenses.
What ShakerScan does.
Run repeatable security scans
Test web applications and APIs, from fast posture checks to explicitly authorized active testing.
Explore ScanInvestigate with your AI agent
Use Hunt with Codex, Claude Code, OpenCode, or Pi to investigate a registered target while ShakerScan controls scope, budgets, execution, and evidence.
Explore HuntReview evidence and track fixes
Findings, evidence, retests, and testing history stay together across runs.
See the findings workflowTwo workflows. One record of findings and evidence.
| Scan | Hunt | |
|---|---|---|
| Best for | Repeatable automated testing | Adaptive investigation |
| Behavior | Deterministic pipeline | AI-planned investigation |
| AI required | No | Yes, your coding agent |
| You control | Target, budget, active-testing authorization | Target, capabilities, approvals, budgets |
| Output | Findings, evidence, coverage | Leads, findings, evidence, investigation history |
Other workflows.
Not ready to install? Check a domain first.
DNS, email, HTTP, and TLS facts for any public domain or IP address, measured by the same engine as a self-hosted instance. No account and no pass/fail scores, just what was observed; the hosted service applies per-IP rate limits.
or from a terminal: $ shakerscan check example.com
check your own connection: $ curl -fsSL https://shakerscan.com/x | sh
Scan does not require AI. Hunt uses the agent you choose.
Scans work without an AI agent. Hunt adds adaptive investigation through Codex, Claude Code, OpenCode, or Pi when you choose to use it. Your agent session is the planner, so Hunt needs no separate LLM API key. Every action still passes through scope, budget, and approval checks.
Read the Hunt authorization workflowYour deployment holds the data.
ShakerScan stores its project data, scan results, and evidence in your deployment. Outbound traffic besides your targets: image pulls from Docker Hub, public DNS-over-HTTPS fallback for public names, optional threat-intel lookups, and optional AI features, which use the agent or model provider you configure.
Built to be inspected.
Open source
AGPL-3.0, developed in the open, with releases built once from an exact source revision.
Evidence
Severity and proof state are separate. A label or an HTTP 200 never counts as exploit proof.
Authorization
Active testing is off by default. Active Hunt capabilities need a target-bound approval, revalidated on every call.
Public security model
Authorization behavior, Hunt boundaries, and the Fleet trust model are documented in the repository.
Need SSO, organizational controls, or support?
ShakerScan Enterprise puts the open-source engine behind single sign-on, roles, audit, and an offline licence on your own host. The self-hosted edition is in public beta; managed hosting is in development. Pilots are open.
Common questions.
Is ShakerScan open source?
Yes. ShakerScan is licensed under the GNU Affero General Public License v3.0 and developed in the open at github.com/andriyze/shakerscan, where releases, issues, and the security policy live.
Where does ShakerScan run?
In Docker on infrastructure you control: locally on Linux or macOS, or on a VPS in a Tailscale-bound remote mode. The UI and API bind to localhost by default. A trusted-LAN mode lets a laptop client drive an engine on another machine; it adds no authentication or encryption. Optional multi-node Fleet adds Linux workers over outbound-only HTTPS.
What is the difference between ShakerScan Open Source and Enterprise?
The open-source release is the complete platform: web UI, API, CLI, Scan, Hunt, findings, evidence, Continuous ASM, connected devices, Fleet, and the AI Gate and Model Intake previews. Enterprise is a self-hosted edition, in public beta, that puts the open-source engine behind single sign-on, roles, audit, and an offline licence; managed hosting is in development.
Can I run ShakerScan in CI?
Yes, against an engine you run. Install the engine-less client with pipx install shakerscan, submit with shakerscan scan --json, and gate on the deployment-decision endpoint; the scanner CLI can also write SARIF 2.1. There is no packaged CI action. The only hosted service is the free posture check.
Can ShakerScan replace a penetration tester?
No. ShakerScan automates and assists security testing. It does not replace expert judgment.
Run ShakerScan on an authorized target.
One command installs the stack. The first scan needs no account, no email, and no AI key.
curl -fsSL https://install.shakerscan.com | sh