A free attack-surface engine that only reports what's actually exploitable

What it does You give it a domain and it continuously maps everything you expose — subdomains, IPs, ports, products, versions, TLS — using bbot, naabu, nmap, and Nuclei. It then correlates that inventory against actively exploited CVEs (CISA KEV, EPSS, Exploit-DB, Metasploit, and more) and attempts read-only validation so you get evidence, not a pile of alerts. Everything runs self-hosted in one Docker Compose stack, with an MCP server so AI agents can query your inventory.

The interesting bit The fire/smoke/ice rating ranks CVEs by real-world exploitation rather than raw severity, and a match now requires the same product with a version inside a bounded affected range — a product name alone doesn’t count. Version 1.3 adds Sentinels: lightweight agents you drop inside private networks so the same scanning pipeline reaches hosts no external scanner can.

Key highlights

• Shodan-style search over your own inventory (port:3389 -host:vpn, tech:"apache tomcat" sev:high)
• Change timeline with screenshot diffs, so new hosts and opened ports don’t slip past
• Bring your own AI: Anthropic, OpenAI, Ollama, LM Studio, or vLLM — and it works without any model
• Bug bounty workbench pulling scope from HackerOne, Bugcrowd, Intigriti, and YesWeHack
• Pinned scanner versions and a CycloneDX SBOM with every release

Caveats

• It’s an orchestration layer over well-known scanners — the value is the loop and the correlation, not novel scanning tech.
• Wants Python 3.14 and PostgreSQL 18, so expect a fairly fresh host; 4 GB RAM minimum.
• The “most advanced you can get for free” tagline is the README’s, not a benchmark.

Verdict Worth a look if you want commercial-style attack surface management without per-asset pricing and with full self-hosting. Skip it if you only need a one-off Nuclei run — this is built for continuous operation.