The open-source scanner your security team already trusts, behind your identity provider, on your own servers.
Single sign-on through your OpenID Connect provider, passkeys and recovery codes, enforced roles, audit and an offline licence in front of the public engine. No data leaves your network. Public beta, pilots open.
Pilots run on a time-boxed evaluation licence with the maintainers on the call; there is no self-service purchase.
One Linux host with Docker Engine and Compose 2.20+, x86_64 (linux/amd64 images).
Ubuntu 24.04 LTS
Recommended. Validated with the one-command installer, including reboot and backup.
Ubuntu 26.04
Validated in continuous operation.
AWS ECS (Fargate)
Reference deployment available for evaluation.
Amazon EKS / Kubernetes
Reference manifests available for evaluation.
Roles come from provider groups or per-person admission.
Okta
Group-to-role mapping and console test sign-in, with a setup guide.
Keycloak
Including deployments behind a private certificate authority.
Microsoft Entra ID
Standard OpenID Connect flow with group claims.
Other OpenID Connect providers
S256 PKCE, RS256 or ES256 ID tokens, client_secret_basic or _post.
Google Workspace
Sign-in with per-person admission; group-to-role mapping in development.
Local accounts
Password, passkeys, authenticator app, recovery codes, invitations.
SCIM provisioning
Access is revoked by disabling the person in the console.
For anything in development, ask about timing in the pilot conversation.
The gateway sits in front of the engine and authenticates and authorizes every request, so nobody reaches a scanner, a finding or a credential without signing in through your policy.
OpenID Connect with PKCE, supported with Okta, Keycloak, Microsoft Entra ID and other providers with S256 PKCE and RS256 or ES256 ID tokens. Configure it in the console and run a test sign-in at the provider before saving; changes apply without a restart and are audited. Two-step verification for these accounts is your provider’s policy.
Local accounts sign in with a passkey (fingerprint, face or PIN; phishing-resistant and a second factor on its own) or a password plus authenticator-app codes. Ten single-use recovery codes replace a lost passkey or phone. The policy is yours: off, required for local administrators, or required for every local account.
People are admitted by exact subject or by mapping your identity-provider groups to a role on first sign-in. Nobody gets in by default.
Viewer reads results; operator runs scans, retests and Hunt; administrator manages people, tokens, settings and updates. Every request is checked against reviewed per-role allowlists, and unknown routes are refused.
Server-side sessions with short absolute and idle lifetimes set in the console. Changing a role, password or factor ends that person’s sessions, and an administrator can sign anyone out everywhere.
Scoped viewer or operator tokens for CI and agents, shown once, stored hashed, valid for at most 90 days and revocable. They cannot open the console.
One-time invitation links (valid three days) where people choose their own password; disable and re-enable; one-time reset codes issued by an administrator; a break-glass local administrator next to single sign-on, and server-side recovery commands for the operator.
Sign-ins, administration, settings changes and every engine request (method and path, never bodies or secrets), with who and when. Filter in the console, export as NDJSON.
September 2026, Ubuntu 24.04. Every figure comes from a recorded run, not an estimate.
~4 min
one command, clean Ubuntu 24.04 host
From published, signed artifacts to a running stack with the first administrator, a daily backup and the engine updater installed. Re-running it resumes an interrupted install.
7 checks
one verification command
Gateway signature, SBOM attestation and the build attestations of all five engine images, before anything is deployed. The installer runs it for you.
140 s
engine update from the console
From the administrator’s click to the new engine verified (2.3.6 to 2.3.9): backup, install, render, pull, restart, verify, with scans, evidence, identities and the licence intact.
You install two things on one Linux server: the open-source ShakerScan engine (public images, pinned by digest) and the Enterprise gateway (a private, signed image). The gateway handles login through your OpenID Connect provider, viewer, operator and administrator roles, an audit trail, and a signed licence that never phones home. Scans run on your host against your applications; findings and evidence stay there.
Outward, the host talks to your targets and your identity provider, and, at install and update time, to the image registries, GitHub and Sigstore; Let’s Encrypt too, unless you bring a certificate.
People
Browser, agent, CLI
Sign-in via your IdP
Your Linux host
Targets
Your applications
Inside your network
Public beta means published, signed, exercised on real hosts, and offered to pilots. Preview means it works and is included, with gaps stated.
The installer checks the host, verifies the signed images, installs the public engine pinned by digest with the private gateway in front of it, and starts everything with Docker Compose. The gateway passes each request through reviewed per-role allowlists; unknown routes are refused.
A signed, installation-bound licence file checked offline. It sets how many scans run at once; the gateway reserves a slot per scan and refuses beyond it. Expiry stops new scans only. Renewal works from a usage summary you export yourself.
A one-time connect link from the console, then pipx install shakerscan (or brew install andriyze/shakerscan/shakerscan) and shakerscan agent claude, codex or opencode: your coding agent works against your instance over MCP, under your identity and in the audit log.
An administrator picks a newer published engine release this gateway has reviewed; the host updater backs up, installs, restarts and verifies, and, if a step fails, puts the previous engine back, restoring its database from the pre-update backup when needed. Gateway upgrades are by new digest, with the previous rendering kept.
An encrypted daily backup of the engine database, evidence, identities and deployment files; restore onto the same or another host. Start at boot, log rotation, your own certificate or Let’s Encrypt, a corporate proxy for the certificate authority and the identity provider.
On for operators by default. Operators drive it in the browser, through their agent over MCP or from the CLI; viewers read. Your own model credentials are needed only for the engine’s autonomous features, and the autonomous Hunt does not work yet in this beta.
Week 1
Questionnaire, licence and pull access; install on your host with us on a call.
Weeks 2–3
Your operators scan your applications; we review findings and fix what blocks you.
Week 4
Backup, upgrade and restore drill on your side; decision. The pilot fee is credited to the annual subscription.
The email opens with the questions a pilot starts from: your company and role, your identity provider, where the host would run, how many applications you scan and whether any are internal-only, and the concurrent scans you expect. We reply within one business day with the full questionnaire and a proposed pilot plan.
Enterprise runs the public engine images unchanged. Identity, administration, licensing and support sit in front of them; nothing is removed from the open-source release. In this beta the gateway exposes a reviewed part of the engine, listed above.
See what the open-source release includes