opensecuritybot v0.5.2

Authorized engagements only

The reasoning layer between your scanner and your report.

Turn raw scanner findings into verified triage and a client-ready VAPT report. Scope is enforced in local code — findings outside scope.json never reach a model.

Read the docs View source

$ npm i -g opensecuritybot

$ vapt scan --skill http-baseline --target https://app.acme.com
[1/2] httpx -json -silent -u https://app.acme.com
saved: findings/http-baseline-2026-10-17T15-30-11-724Z.json
$ vapt report -f findings/... -s scope.json --html
methodology: 2 scan step(s) from the execution ledger
  1. scope.json
  2. scope guard
  3. triage
  4. verify
  5. report

Built in

Six guarantees, enforced in code

The model reasons about findings. Everything that has to be trusted — scope, verification, execution — happens in deterministic code around it.

Scope-safe by construction

Out-of-scope findings are dropped in local code before any model call, every scan step re-checks its target against scope.json, and cloud metadata endpoints are refused even if listed.

Deterministic verification

Programmatic replies are schema-checked, cited CVE IDs are cross-checked against your local cve-cache, and a malformed reply gets one corrective retry. Unverifiable claims are flagged for manual review.

Reviewed scan skills

nmap, nuclei and httpx playbooks run argv-only — no shell string to inject into. Each step is printed, confirmed and re-checked against scope before it executes.

Reports that ship

Markdown and HTML reports cover sections 1–5, executive summary through prioritized remediation roadmap, with methodology pulled from the execution ledger.

Any provider

OpenAI, OpenRouter, Groq, Meta, Anthropic, Ollama or any OpenAI-compatible endpoint. The first-run wizard configures it; environment variables override it.

Execution ledger

Every scan step appends tool, argv, exit code, duration and stdout SHA-256 to report/scan-ledger.jsonl, so the report shows what actually ran.

Scan skills

Two reviewed playbooks, ready on install

A skill is a declarative, reviewed playbook — not an LLM-generated command. The shell never sees free-form input.

http-baseline passive

Passive HTTP fingerprint and low-noise misconfiguration/exposure templates.

  • httpx
  • nuclei

service-discovery active

TCP service and version discovery on the top 1000 ports.

  • nmap

Read how the safety model works →

Get started

Scope in. Report out.

Install the CLI, run the wizard, point it at an authorized target.

Read the docs View source

$ npm i -g opensecuritybot

Node 20+ · MIT · one runtime dependency (commander)