ShakerScan Open Source
Run ShakerScan on your own infrastructure with the web UI, API, CLI, Scan, Hunt, findings, evidence, and the specialized security workflows: Continuous ASM, AI Gate and Model Intake (both preview), connected devices, and Fleet.
Only test systems you own or are explicitly authorized to assess. ShakerScan is a trusted-operator self-hosted product; keep the ordinary UI and API private.
The complete platform, not a community edition.
ShakerScan is an open-source security testing platform for web applications, APIs, AI systems, and network-connected devices. It runs locally in Docker and provides a web UI, REST API, CLI, persistent findings, evidence, repeatable Scan workflows, and AI-assisted Hunt workflows.
Scan
Deterministic web and API DAST: reviewed passive templates plus bounded XSS, SQL injection, and two-principal BOLA verification, with explicit active-testing authorization, budgets, findings, proof state, coverage, and retests.
Explore ScanHunt
Adaptive investigation planned by your Codex, Claude Code, or OpenCode session, with ShakerScan enforcing scope, capabilities, approvals, budgets, execution, and evidence.
Explore HuntContinuous ASM
Endpoint inventory, coverage gaps, bounded discovery and test waves, subdomain discovery, and certificate-transparency monitoring.
Explore Continuous ASMAI Gate
Probe-pack testing for chat APIs, RAG endpoints, agent traces, MCP servers, and widgets, with transcripts, findings, and exports.
Explore AI GateModel Intake
Pre-deployment review of model artifacts: pinned provenance, dependencies, licenses, unsafe serialization, isolated runtime checks, and a signed, revocable admission.
Explore Model IntakeConnected devices
Inventory and posture for TVs, cameras, printers, routers, NAS systems, and appliances with coverage profiles, safety profiles, and a health circuit breaker.
Explore Connected devicesFleet
Opt-in multi-node execution on Linux: one control plane places work on remote workers that connect over outbound-only HTTPS and return results centrally. A WireGuard transport is an operator preview.
Read the guideFindings, evidence, and exports
One review surface across workflows: severity, proof state, source, lifecycle, retests, evidence export, HTTP transaction and HAR export, JSON and PDF reports.
Explore Findings, evidence, and exportsOne command. Then open localhost:3000.
The installer places ShakerScan under your home directory, creates the shakerscan command, starts the Docker stack, and binds the UI and API to local interfaces only. Clone the repository when you want to read or change the source. Docker and Docker Compose v2 are required; the first image pull can take several minutes.
Your first Scan
Install, open your agent, then paste the prompt.
- 1
Install ShakerScan
$ curl -fsSL https://install.shakerscan.com | sh - 2
Launch your coding agent
$ shakerscan agent opencodealso: claude · codex
or skip the agent$ shakerscan startthen open http://localhost:3000 for the dashboard
- 3
Ask for a Scan, then a Hunt
> Run a balanced passive Scan on https://app.example.test> Run a Hunt on this registered target.
Replace the example with a target you own or are authorized to test. Hunt needs the target registered first; Scan works without an AI agent.
Running ShakerScan on a remote VPS?
TailscaleUse remote mode instead of the local start command. ShakerScan binds the UI and API to the VPS Tailscale address, saves the setting, and prints the private URLs to open from your laptop.
$ curl -fsSL https://install.shakerscan.com | SHAKERSCAN_REMOTE=1 shRemote VPS mode is not Fleet
Remote mode exposes one ShakerScan installation privately over Tailscale. Fleet connects multiple Linux worker machines to one control plane over outbound-only HTTPS. Never expose the ordinary UI or API directly to the public internet.
Client only: laptops, CI, and trusted LANs
The engine-less client needs Python 3.10+ and no Docker. It runs public posture checks, drives a remote engine, and serves MCP to your agent. LAN mode adds no authentication or encryption; use it on a trusted network only.
$ pipx install shakerscan# or: uv tool install shakerscan · brew install andriyze/shakerscan/shakerscan$ shakerscan check example.com# engine machine on a trusted LAN$ shakerscan start --lan# laptop$ shakerscan connect http://192.168.1.50:8080In CI, submit with shakerscan scan --json and gate on GET /scans/{id}/deployment-decision; the scanner CLI can also write SARIF 2.1.
Proof that persists, and one check everywhere.
Highlights from the 2.5 release line. Hunt findings remain evidence-backed candidates until a deterministic proof contract verifies them.
Methodology-first Hunt
A Hunt starts with no methodology, gets at most three suggestions from shared target knowledge, and binds one only when it is used. Scan, Hunt, and imports share service evidence.
Persisted cross-principal proof
Deterministic BOLA authorization proof is now kept as a finding with its evidence, and works with selected bearer or header credential pairs.
shakerscan check parity
The hosted check and a self-hosted instance (POST /public/check) run the same posture engine and return the same schema. Instance checks are not sent to the public service.
Hunt on connected devices
Hunts on device targets reach services on nonstandard ports and can run four allowlisted Nmap scripts with server-controlled ports, scripts, and output bounds.
Signed SBOMs
Releases attach SPDX and CycloneDX inventories with a Sigstore-signed index and expanded runtime coverage. Coverage is stated as partial.
Trusted-LAN control
Run the engine on one machine with shakerscan start --lan and drive it from a laptop client with shakerscan connect. No authentication or encryption is added.
A trusted-operator system on infrastructure you control.
Standalone ShakerScan runs on Linux, macOS, and Windows through WSL2. Project data, scan results, evidence, and artifacts are stored in your deployment, and there is no telemetry. It does pull images from Docker Hub, may fall back to public DNS-over-HTTPS for public names, and can call optional threat-intel services. It does not provide application login, users, roles, or tenant isolation; keep it behind a VPN, firewall, or authenticated reverse proxy. Optional Hunt and AI analysis use the agent or model provider you configure.
Operator UI / API / agents
One place to launch, schedule, review, and verify work.
Control plane
Scope, approvals, budgets, placement, findings, and evidence provenance.
Local workers
Default standalone execution.
Fleet workers (optional)
Outbound-only HTTPS, scoped credentials and job leases, no database credentials.
Open source is the platform. Enterprise adds organizational controls.
The self-hosted Enterprise edition is in public beta on top of the open-source release; managed hosting is in development. Nothing is sold as generally available yet; each row carries its current status.
| Capability | Open source | Enterprise |
|---|---|---|
| Complete platform: UI, API, CLI, Scan, Hunt, findings, evidence | Included | Included (built on open source) |
| Continuous ASM, AI Gate (preview), Model Intake (preview), connected devices, Fleet | Included | Included (built on open source) |
| Runs on infrastructure you control | Included | Self-hosted edition, public beta |
| Managed hosted environments | — | In development |
| OIDC single sign-on, roles, service tokens, audit | — | Public beta |
| Backup, restore, in-place upgrades, offline licence | — | Public beta |
| Support and pilot engagements | Community (GitHub issues) | On request |
Need SSO, organizational controls, or support?
Read the Enterprise page for current maturity labels, or talk to us about a pilot.
Issues, pull requests, and security reports are welcome.
Fork and clone the repository, create a feature branch, make and test the change, and open a pull request that describes the behavior and how you verified it. Report vulnerabilities through the security policy rather than a public issue.
Keep the evidence where you can operate it.
ShakerScan does not claim multi-user authentication, tenant isolation, a hardened public SaaS boundary, guaranteed vulnerability discovery, or unrestricted autonomous exploitation. Review scope and authorization before every active test.