Comprehensive DAST
Assess DNS, TLS, HTTP headers, cookies, CORS, exposed files, JavaScript dependencies, secrets, subdomains, ports, and known CVEs.
Open-source edition
Run the ShakerScan core on your own infrastructure.
The open-source edition is a complete self-hosted DAST platform for web applications and APIs. Run comprehensive assessments from your own machine with a modern web UI, persistent scan history, a REST API, and scalable workers.
ShakerScan Cloud removes the infrastructure work and adds AI Gate adversarial testing, GitHub required checks, and signed allow, block, and needs_approval decisions your CI can verify.
The recommended installer starts the Docker runtime and local web UI for you. Docker with Compose and 8 GB or more of memory are recommended.
recommended install
Docker$ curl -fsSL https://install.shakerscan.com | shWeb apphttp://localhost:3000
Scanner APIhttp://localhost:8080
API docshttp://localhost:8080/docs
ImagesPrebuilt by default
DataPostgreSQL + Redis
Workers5 by default, scale to 20
PlatformsLinux, macOS, Windows via WSL2
Included in open source
A working security platform, not a scanner binary.
The default start command launches the API, worker queue, dashboard, PostgreSQL, and Redis using published Docker images. Build the images locally with ./scanner.sh start --local when you want to modify the code.
Opt-in active testing
Use Full, Aggressive, or Smart scans for authorized XSS, SQL injection, API, authentication, and business-logic testing.
Modern local workspace
Manage targets, scans, findings, schedules, reports, queue health, and worker capacity from the browser dashboard.
Authenticated coverage
Crawl JavaScript applications and APIs with headers, cookies, login credentials, or two user contexts for access-control testing.
CLI and REST API
Start scans from the terminal, use the web interface, or integrate with the FastAPI service and interactive API documentation.
Optional AI assistance
Configure an OpenAI-compatible model for finding correlation, verification, and interactive browser-based security sessions.
After installation
Use an AI agent or drive it directly.
Open Claude, Codex, or OpenCode inside the ShakerScan runtime and ask for security work in plain English. The CLI remains available when you prefer explicit commands.
AI agent
$ shakerscan agent claude # or: codex, opencode> Start ShakerScan
> Run a quick scan on https://example.com
> Show active high and critical findings
> Red team my chatbot API with AI Gate smoke tests
Direct CLI
$ shakerscan scan https://example.com$ shakerscan statusPrefer a source checkout?
Clone the repository when you want to inspect, modify, or build the Docker images yourself.
$ git clone https://github.com/andriyze/shakerscan.git$ cd shakerscan$ ./scanner.sh startActive scan profiles send intrusive probes. Only scan systems you own or have explicit written permission to test.
Editions
What ships in each edition.
Open source gives you the complete self-hosted DAST experience. Cloud operates the infrastructure and adds the release-control layer for AI and API changes.
editions.compare
Self-hostedCloud
Web and API DAST with DNS, TLS, headers, discovery, and CVE checks
✓✓
Active testing for XSS, SQLi, Nuclei findings, and API security
✓✓
Authenticated crawling, scan history, findings, and schedules
✓✓
Web UI, REST API, PostgreSQL, Redis, and scalable workers
✓✓
Runs on your own infrastructure with Docker Compose
✓—
Hosted scanner workers, no infrastructure to operate
—✓
AI Gate adversarial testing (probe packs, judge layers)
—✓
Signed attestations and evidence packets
—✓
allow / block / needs_approval decisions verified in CI
—✓
GitHub App required checks and scoped approval tokens
—✓
Managed quotas, billing portal, and commercial support
—✓
Which edition
Self-host the DAST platform. Use Cloud for release control.
Choose open source when you want to operate a capable web and API scanner, keep the data on your infrastructure, and tailor the code to your workflow. Choose Cloud when you need managed operations and release decisions that GitHub and CI verify before a merge or deploy.
Open-source edition
Comprehensive DAST, active and authenticated testing, a persistent dashboard, REST API, worker scaling, schedules, and full visibility into the code.
ShakerScan Cloud
Hosted workers, AI Gate red teaming, signed evidence, GitHub App required checks, and approval workflows for release control.
Contribute
Issues and pull requests are welcome. If you find a security issue, report it through the security policy instead of a public issue.
Clone it, run it, read the code.
Start with the open-source edition on your own machine, and switch to Cloud when your team needs verified deploy gates.