ShakerScan
Install ShakerScan
Hunt

Adaptive investigation with your AI coding agent.

Hunt is ShakerScan’s AI-assisted investigation workflow. Your Codex, Claude Code, OpenCode, or Pi session plans the investigation of one registered, authorized target. ShakerScan enforces scope, capabilities, budgets, and approvals, runs each action, and records the evidence. Your agent session is the planner, so Hunt needs no separate LLM API key.

Install ShakerScanRead the docs

Who it is for. Penetration testers and security engineers who want an AI agent working inside server-enforced limits, not an unattended scanner.

What problem it solves

Scanners repeat fixed checks. AI agents adapt, but need limits and evidence before their conclusions can be trusted.

In Hunt, you own scope and final judgment. The agent proposes each next action. ShakerScan decides whether it is allowed, runs it, and records the proof.

How it works

  1. 01Register the authorized target and confirm authorization. Active Hunt capabilities also need a target-bound approval, either a standing, revocable target authorization or an expiring one, revalidated on every call.
  2. 02Launch your coding agent with shakerscan agent codex, claude, opencode, or pi, then ask it to run a Hunt on the registered target.
  3. 03The agent reads a redacted target context, composes its own same-origin probes, queries stored endpoints, findings, leads, and principal state, and runs bounded active scanner templates when authorized.
  4. 04When managed principals are configured, it can compare responses across controls and principals, for example anonymous versus authenticated behavior.
  5. 05The agent records only findings backed by tool-output evidence. Suspected findings become Verified only through ShakerScan’s deterministic proof workflows.

What you get

  • Leads: a hypothesis backlog the agent and the verifier work from.
  • Evidence-backed investigation candidates, which become Verified findings only through deterministic proof, including persisted cross-principal (BOLA) authorization proof.
  • A durable investigation record that survives any single AI context window, searchable in Hunt history.
  • A Hunt record export with explicit capability decisions and the final debrief, never hidden model chain-of-thought.
  • Separate exports of Hunt HTTP transactions, redacted by default.

Example workflow

Start a Hunt from your agentagent session
$ shakerscan agent claude> Run a Hunt on this registered staging target.> Show active high findings from this hunt.> Send the SQL injection lead to deterministic verification.

Security and authorization

  • Hunt requires explicit confirmation that the target is owned or authorized, plus a live target-bound approval that is revalidated on every call.
  • Every Hunt keeps hard ceilings for capability calls, requests, active actions, wall time, ports, hosts, browser actions, device fragility, and candidates.
  • State-changing HTTP (POST, PUT, PATCH, DELETE) is off by default and needs an explicit Hunt permission.
  • Credentials stay server-side. The agent never sees stored secrets.
  • Data handling for the AI side depends on the coding agent and model provider you configure.

Limitations

  • Hunt needs an installed, signed-in Codex, Claude Code, OpenCode, or Pi session. It does not run without a coding agent.
  • AI leads are evidence-cited hypotheses, not findings, until deterministic proof promotes them.
  • Hunt is not a coverage guarantee. Use Scan for repeatable coverage.
  • An investigation can run for minutes or hours and consumes the agent provider’s tokens. Budgets bound the work, not the wall clock of your review.

Get started

  1. 01Install ShakerScan and add the authorized target under Targets.
  2. 02Run shakerscan agent codex (or claude, opencode, or pi) so the agent loads ShakerScan’s instructions and skills.
  3. 03Ask: “Run a Hunt on this authorized target.” Confirm the approval prompt.
  4. 04Review leads and findings in AI Investigator → Hunts, then send claims to deterministic verification.
Install ShakerScanView on GitHub

Related product areas

ScanRun repeatable web and API security tests with explicit active-testing controls, retained findings, evidence, coverage information, and retesting.Connected devicesInventory and assess authorized TVs, cameras, printers, routers, NAS systems, and appliances with coverage profiles, safety profiles, and a health circuit breaker.All product areas