ShakerScan Open Source
Run ShakerScan on your own infrastructure with the web UI, API, CLI, Scan, findings, evidence, Hunt, Continuous ASM, connected devices, and Fleet, plus two previews: AI Gate and Model Intake.
Only test systems you own or are explicitly authorized to assess. ShakerScan is a trusted-operator self-hosted product; keep the ordinary UI and API private.
Everything except Enterprise’s organizational controls.
ShakerScan is an open-source security testing platform for web applications, APIs, AI systems, and network-connected devices. It runs locally in Docker and provides a web UI, REST API, CLI, persistent findings, evidence, repeatable Scan workflows, and AI-assisted Hunt workflows.
Scan
Deterministic web and API DAST with explicit active-testing authorization, budgets, findings, proof state, coverage, and retests.
Explore ScanHunt
Adaptive investigation planned by your Codex, Claude Code, OpenCode, or Pi session, with ShakerScan enforcing scope, capabilities, approvals, budgets, execution, and evidence.
Explore HuntContinuous ASM
Endpoint inventory, coverage gaps, bounded discovery and test waves, subdomain discovery, and certificate-transparency monitoring.
Explore Continuous ASMAI Gate
Probe-pack testing for chat APIs, RAG endpoints, agent traces, MCP servers, and widgets, with transcripts, findings, and exports.
Explore AI GateModel Intake
Pre-deployment review of model artifacts: pinned provenance, dependencies, licenses, unsafe serialization, isolated runtime checks, and a signed, revocable admission. Off by default.
Explore Model IntakeConnected devices
Inventory and posture for TVs, cameras, printers, routers, NAS systems, and appliances with coverage profiles, safety profiles, and a health circuit breaker.
Explore Connected devicesFleet
Opt-in multi-node execution on Linux: one control plane places work on remote workers that connect over outbound-only HTTPS and return results centrally. A WireGuard transport is an operator preview.
Read the guideFindings, evidence, and exports
One review surface across workflows: severity, proof state, source, lifecycle, retests, evidence export, HTTP transaction and HAR export, JSON and PDF reports.
Explore Findings, evidence, and exportsOne command. Then open localhost:3000.
The installer places ShakerScan under your home directory, creates the shakerscan command, starts the Docker stack, and binds the UI and API to local interfaces only. Clone the repository when you want to read or change the source. Docker and Docker Compose v2 are required; the first image pull can take several minutes.
Your first Scan
Install, open your agent, then paste the prompt.
- 1
Install ShakerScan
$ curl -fsSL https://install.shakerscan.com | sh - 2
Launch your coding agent
$ shakerscan agent opencodealso: claude · codex
or skip the agent$ shakerscan startthen open http://localhost:3000 for the dashboard
- 3
Ask for a Scan, then a Hunt
> Run a balanced passive Scan on https://app.example.test> Run a Hunt on this registered target.
Replace the example with a target you own or are authorized to test. Hunt needs the target registered first; Scan works without an AI agent.
Running ShakerScan on a remote VPS?
TailscaleUse remote mode instead of the local start command. ShakerScan binds the UI and API to the VPS Tailscale address, saves the setting, and prints the private URLs to open from your laptop.
$ curl -fsSL https://install.shakerscan.com | SHAKERSCAN_REMOTE=1 shRemote VPS mode is not Fleet
Remote mode exposes one ShakerScan installation privately over Tailscale. Fleet connects multiple Linux worker machines to one control plane over outbound-only HTTPS. Never expose the ordinary UI or API directly to the public internet.
Client only: laptops, CI, and trusted LANs
The engine-less client needs Python 3.10+ and no Docker. It runs public posture checks, drives a remote engine, and serves MCP to your agent. LAN mode adds no authentication or encryption; use it on a trusted network only.
$ pipx install shakerscan# or: uv tool install shakerscan · brew install andriyze/shakerscan/shakerscan$ shakerscan check example.com# connect to an engine started with: shakerscan start --lan$ shakerscan connect http://192.168.1.50:8080In CI, submit with shakerscan scan --json and gate on GET /scans/{id}/deployment-decision; the scanner CLI can also write SARIF 2.1.
The latest release, from its notes.
ShakerScan 2.12.2, released November 9, 2026. Every release is built from a tagged commit and published with SBOMs and build attestations.
The client for this release is shakerscan 0.12.0 (unchanged).
A patch release: the certificate-transparency monitor no longer leaves a gungnir process running at
every domain reload, plus two small web UI corrections. No schema changes; a rollback restores the
pre-upgrade database dump, as for every release (docs/upgrade-and-rollback.md).
Fixes
- The CT monitor stops gungnir at every domain reload. The
gungnir-workerservice reloads the monitored root domains every five minutes by cancelling the running monitor. The process cleanup ran only when the monitor ended on its own, so each reload left the previous gungnir running: the worker gathered one more process every five minutes, each taking CPU, until the container's memory limit killed them. The cleanup now runs on every way out (reload, worker shutdown, error): gungnir runs in its own process group, the group is signalled (SIGTERM, SIGKILL after 5 s) and the process is reaped before the next one starts. Any install that runs the CT monitor (--profile gungnir) should take this release. - The CT monitor skips address roots. A target whose root is an IP address (for example
10.0.0.5) is no longer passed to gungnir: certificate-transparency logs name DNS names, so watching an address could never match.
Interface
- The Targets row menu offers a Hunt only to someone who may start one. "Start Hunt" (and, on
a managed workspace, "Copy the Hunt command") now follows the
hunts.managesession capability, the action that already decides the Hunt page's Stop. A viewer, or an installation without Hunt, no longer sees it (docs/session-capabilities.md). - A cancelled discovered-secret step-up says how to retry. The notice now says the decision was not made and can be chosen again to confirm it in the browser, with the terminal command as the alternative.
Known limits
- The session capabilities answer hides controls; it does not authorize anything. Every request is still decided by the server that receives it.
A trusted-operator system on infrastructure you control.
Standalone ShakerScan runs on Linux and macOS. Project data, scan results, evidence, and artifacts stay in your deployment. It has no application login, users, roles, or tenant isolation; keep it behind a VPN, firewall, or authenticated reverse proxy.
Operator UI / API / agents
One place to launch, schedule, review, and verify work.
Control plane
Scope, approvals, budgets, placement, findings, and evidence provenance.
Local workers
Default standalone execution.
Fleet workers (optional)
Outbound-only HTTPS, scoped credentials and job leases, no database credentials.
Open source is the platform. Enterprise adds organizational controls.
The self-hosted Enterprise edition is in public beta on top of the open-source release; there is no managed hosting. Nothing is sold as generally available yet; each row carries its current status.
| Capability | Open source | Enterprise |
|---|---|---|
| UI, API, CLI, Scan, Hunt, findings, evidence | Included | Included (built on open source) |
| Scheduled scans | Included | Included (recurring scans in the console) |
| Continuous ASM | Included | Not available (on-demand recon and the CT monitor are) |
| Fleet workers | Included | Not exposed through the gateway |
| AI Gate and Model Intake (previews) | Included | Not exposed through the gateway |
| Network scans and connected devices | Included | Included, on by default |
| Runs on infrastructure you control | Included | Self-hosted edition, public beta |
| Managed hosted environments | — | Not available |
| OIDC single sign-on, roles, service tokens, audit | — | Public beta |
| Retests that close findings on proof, Jira tickets | — | Public beta |
| Offline licence | — | Public beta |
| Support and pilot engagements | Community (GitHub issues) | On request |
Need SSO, organizational controls, or support?
Read the Enterprise page for current maturity labels, or talk to us about a pilot.
Issues and security reports are welcome.
Bug reports, false positives and misses, feature requests and documentation gaps help most. Outside code contributions are not accepted; see the contributing guide. Report vulnerabilities through the security policy, not a public issue.
Keep the evidence where you can operate it.
ShakerScan does not claim multi-user authentication, tenant isolation, a hardened public SaaS boundary, guaranteed vulnerability discovery, or unrestricted autonomous exploitation. Review scope and authorization before every active test.