v0.1 · now in private beta

Your entire attack surface,
scanned as one.

ACYRA_Scan orchestrates best-in-class open-source scanners and threat-intel APIs behind a single normalized data model. Scan an IP, a CIDR, a range, or a fleet of domains — get back one deduplicated set of assets and findings.

Request access →Read the docs

◦ 17+ tools & integrations◦ CLI + REST API◦ multi-tenant & scope-enforced

acyra — assessment consoleidle

acyra ~ $

orchestrates the tools you already trust

nmapnaabusubfinderamassdnsxhttpxwhatwebniktonucleiwpscanshodancensysvirustotalcrt.shsecuritytrailsgreynoiseabuseipdb

One normalized model

nmap, nuclei, Shodan and crt.sh — merged, deduplicated, scored.

Everything a tool or integration produces normalizes into two objects. Results merge automatically, so you reason about your target — not about tool output formats.

Asset

pydantic model

Anything discovered about a target.

kind: host · subdomain · port · service · url · email · cert · dns
value: the discovered identifier
source: which tool or integration found it
services: port · protocol · product · version · banner

Finding

pydantic model

A severity-rated, actionable issue.

severity: info → low → medium → high → critical
category: vuln · misconfig · exposure · info-leak · osint · cve
cve / cvss: enriched identifiers & scores
remediation: how to fix it, with references

Capabilities

Composable skills, chained into one scan.

A skill is a phased workflow. Later phases consume the assets earlier phases discover — enumerate subdomains, probe them, then vuln-scan each live surface.

network_reconskill

Port & service discovery across hosts, CIDRs and ranges.

web_reconskill

Subdomain enum → probe → fingerprint live web surfaces.

secret_huntskill

Exposed config, leaked keys, .git disclosure & history.

vuln_scanskill

Template-driven CVE & misconfig detection with CVSS.

osintskill

Passive intel from threat-intel APIs & certificate logs.

full_scanskill

Everything, orchestrated: recon feeds web feeds vuln.

How it works

A bounded-concurrency engine that feeds itself.

1
Targets in
Single IP, 10.0.0.0/24, ranges, domains or URLs — mixed freely and expanded with a safety cap.
2
Orchestrator
An async engine runs tools & integrations with bounded concurrency across phases.
3
Feed-forward
Assets discovered in one phase become inputs to the next — subdomains → probes → vuln scans.
4
Normalize & score
Every result becomes an Asset or Finding, deduplicated and severity-ranked.
5
CLI · API · Console
Read results through the CLI, the REST API, or this console.

orchestration

        targets (ip / cidr / range / domain)
                    │
         ┌──────────▼───────────┐
         │     Orchestrator     │  bounded-concurrency
         │  (phases, feeding)   │  async engine
         └──────────┬───────────┘
         ┌──────────┼───────────┐
      Tools     Integrations
         └──────────┬───────────┘
        normalized Assets + Findings
                    │
          ┌─────────┴─────────┐
         CLI                REST API

High-value recon

Leaked secrets are treated as first-class.

Exposed config and leaked credentials are among the highest-impact findings — so ACYRA hunts them relentlessly and verifies every hit by content signature to kill soft-404 false positives.

secret_scanner — Probes .env, .git, backups & dumps; regex-scans pages and linked JS for AWS/GCP/Slack/Stripe/JWT keys — values redacted before storage.
git_dumper — Mirrors exposed .git repos and recovers secrets deleted from HEAD but still live in history.
nuclei_exposures — Runs nuclei's maintained exposure / config / token / backup templates.

findings · acme.com3 exposures

critical.git/ source disclosure

GET /.git/config → 200

highAWS access key in JS bundle

AKIA…MPLE (len 20)

highSecret recovered from git history

config/prod.env @ a1b2c3d

Built for authorized use

Cross-client scanning, structurally impossible.

Scope enforcement

Each tenant carries its own allow/deny list. Out-of-scope targets are rejected with 403 before a single packet is sent.

Attestation

Every scan requires an explicit authorization attestation. No attestation, no scan.

Hashed API keys

Keys are shown once, stored as SHA-256 with constant-time compare. Roles: admin, operator, viewer.

Append-only audit

Every client change and scan.create is logged with actor, client, action and source IP.

Map your attack surface in one command.

Bring an API key and start scanning authorized targets in minutes — through the console, CLI, or REST API.

Request access →or read the quickstart

Your entire attack surface,scanned as one.