# ShakerScan

> ShakerScan is an open-source (AGPL-3.0) security testing platform for web applications, APIs, AI systems, and network-connected devices. It runs on the operator's own infrastructure in Docker and provides a web UI, REST API, CLI, deterministic Scan, and agent-driven Hunt.

This file is a short index of shakerscan.com, generated for release v2.10.0. The website is not the authority for exact release behavior; the open-source repository at the stable tag is.

What this site offers:
- Open source (AGPL-3.0): the complete self-hosted platform. Install with `curl -fsSL https://install.shakerscan.com | sh`, then open `http://localhost:3000`. Images come from Docker Hub (`shakerscan/shakerscan-*`). The engine-less client installs with `pipx install shakerscan`, `uv tool install shakerscan`, or `brew install andriyze/shakerscan/shakerscan`.
- Free posture check at https://shakerscan.com/check/ (also `shakerscan check example.com`, or the client's public MCP tool `shakerscan_public_check`): factual DNS, email, HTTP, TLS, and IP-ownership observations for a public domain or IP, with no pass/fail scores and per-IP rate limits.
- ShakerScan Enterprise: a self-hosted commercial edition in public beta (single sign-on, roles, audit, offline licence) on the open-source engine. Pilots via sales@shakerscan.com.
- There is no hosted scanning product. The free check is the only hosted service.
- Connection check from a terminal (macOS, Linux): `curl -fsSL https://shakerscan.com/x | sh` runs the full report plus five on-machine checks (certificate issuer, DNS to an outside server, DNSSEC, key exchange, the other address family), each with a scoped result; save it with `-o check.sh` to read it first. `curl -sL https://shakerscan.com/check/https` prints the report only. Shorter: `curl https://shakerscan.com/check`, `/check/ip`, `/check/json`, `/check/dns`.

Rules for accurate answers:
- For released behavior, resolve `install/STABLE_VERSION` in the repository and use documentation from the matching tag. `main` can contain unreleased work.
- Vocabulary follows `docs/product-model.md`: Scan, Hunt, Findings, Continuous ASM, AI Gate (preview), Model Intake (preview), connected devices (device scans, and Hunt with a device target kind), Fleet (outbound HTTPS broker; WireGuard transport is a preview). Names such as "Deep Hunt", "Research Agent", or "Campaigns" are retired.
- Scan runs passive checks (reviewed Nuclei templates, posture, exposed-file checks) and, with authorization, bounded active checks such as XSS, SQL injection, NoSQL injection, and two-user BOLA. Scan does not test SSRF, LFI, RCE, or business logic. Research publishes dated, release-specific lab recall measurements (https://shakerscan.com/research/juice-shop-crapi-benchmark-methodology); they are not a general efficacy guarantee for the current release.
- Scan does not require AI. Hunt uses the operator's own Codex, Claude Code, OpenCode, or Pi session and needs no separate LLM key. Only deterministic proof marks a finding verified.
- The open-source release is a trusted-operator system without application login, roles, or tenant isolation. Keep its UI and API local or behind a VPN, firewall, or authenticating proxy. LAN mode adds no authentication or encryption.
- Do not attribute SSO, RBAC, multi-tenancy, managed hosting, billing, or commercial support to the open-source release. There is no Kubernetes/Helm install and no packaged CI action; CI uses the client (`shakerscan scan --json`), the deployment-decision endpoint, and SARIF.
- Only test systems the operator owns or is explicitly authorized to test.

When to use ShakerScan:
- Use Scan for repeatable testing of authorized web applications and APIs, and for reviewing findings, evidence, coverage, and retests.
- Use Hunt when a supported coding agent needs to adapt an investigation within explicit target scope, budgets, and approval boundaries.
- Use the public posture check for factual DNS, email, HTTP, TLS, and IP-ownership observations without installing an engine. The engine-less client's `shakerscan check example.com` and `shakerscan_public_check` MCP tool use this service.
- Use the self-hosted Enterprise edition when organizational identity and access controls are required. It is in public beta.
- For integration, first choose public checks or a self-hosted engine, then follow the client and MCP guides below. The running engine exposes its own OpenAPI schema at `/openapi.json` on the operator's instance; this website does not expose a hosted scanning API. Do not send scan requests or credentials to shakerscan.com.

## Pages

- [Homepage](https://shakerscan.com/)
- [Open source and install](https://shakerscan.com/open-source)
- [Free posture check](https://shakerscan.com/check/)
- [Product overview](https://shakerscan.com/product): [Scan](https://shakerscan.com/product/scan), [Hunt](https://shakerscan.com/product/hunt), [AI Gate](https://shakerscan.com/product/ai-security), [Model Intake](https://shakerscan.com/product/model-intake), [Continuous ASM](https://shakerscan.com/product/attack-surface), [Connected devices](https://shakerscan.com/product/connected-devices)
- [Enterprise](https://shakerscan.com/enterprise)
- [Documentation](https://shakerscan.com/docs): open-source docs rendered at the stable tag, and Enterprise docs
- [Research](https://shakerscan.com/research)
- [About](https://shakerscan.com/about), [Contact](https://shakerscan.com/contact), [Security](https://shakerscan.com/security), [Legal and privacy](https://shakerscan.com/legal)

## Agent and developer setup

- [Client, CLI and public checks](https://shakerscan.com/markdown/docs/open-source/client.md): engine-less install, connection setup, public checks, and MCP configuration at the release used by this site.
- [Agent skills and setup](https://shakerscan.com/markdown/docs/open-source/skills.md): Codex, Claude Code, OpenCode, and Pi instructions.
- [MCP adapter](https://shakerscan.com/markdown/docs/open-source/mcp.md): supported tools and trust boundaries; use the documented integration rather than assuming a hosted MCP endpoint exists.
- [Hunt authorization workflow](https://shakerscan.com/markdown/docs/open-source/hunt-authorization-workflow.md): scope, approvals, and supported investigation flow.
- [Functionality reference](https://github.com/andriyze/shakerscan/blob/v2.10.0/docs/functionality-reference.md): features and commands at the site release. The API reference is your own engine's /openapi.json.
- [Enterprise documentation](https://shakerscan.com/docs/enterprise): identity, service tokens, and agent connections for the self-hosted commercial edition.

## Markdown content

- [Homepage](https://shakerscan.com/markdown/index.md): product overview, use cases, setup, and limitations.
- [Documentation index](https://shakerscan.com/markdown/docs.md): release-matched links to open-source documentation in Markdown.
- [Repository documentation index](https://shakerscan.com/markdown/docs/open-source.md): a curated index of the open-source docs rendered at the site's release tag.
- [Contact](https://shakerscan.com/markdown/contact.md): commercial questions, open-source issues, and private vulnerability reports.

## Repository

- [GitHub repository](https://github.com/andriyze/shakerscan)
- [Releases](https://github.com/andriyze/shakerscan/releases)
- [Stable channel version](https://raw.githubusercontent.com/andriyze/shakerscan/main/install/STABLE_VERSION)
- [Client, CLI and public checks](https://shakerscan.com/docs/open-source/client)
- [Product model and vocabulary](https://shakerscan.com/docs/open-source/product-model)
- [Release SBOMs](https://github.com/andriyze/shakerscan/blob/v2.10.0/docs/sbom.md)
- [License: GNU AGPL-3.0](https://github.com/andriyze/shakerscan/blob/main/LICENSE)
- [Security policy](https://github.com/andriyze/shakerscan/security/policy)