A focused CLI security scanner for web applications, aligned with the OWASP Top 10 and the OWASP Web Security Testing Guide (WSTG).
Agrasandhani (अग्रसन्धानी) is, in Hindu tradition, the ledger in which every deed is meticulously recorded — a fitting name for a tool that audits and keeps account of a web application's security posture.
Agrasandhani is a security testing tool. Use it only against systems you own or are explicitly authorized in writing to test. Unauthorized scanning is illegal in most jurisdictions. The software is provided "as is", with no warranty and no liability for misuse.
Full terms: DISCLAIMER.md. If you don't agree, don't use it.
- Clean, modern CLI built with Typer + Rich
- Single-URL scanning with basic reconnaissance
- Security Headers check (maps to Security Misconfiguration) — being wired in
- JSON and table output
- Extensible, plugin-based check architecture
This project is pre-1.0 and built in public. Expect rapid change. See the Roadmap & Coverage Ledger for exactly what is and isn't done.
# Using uv (recommended)
uv venv
source .venv/bin/activate
uv pip install -e .
# Or using pip
pip install -e .Requires Python 3.11+.
# Basic scan
agrasandhani scan https://example.com
# Verbose output
agrasandhani scan https://example.com -v
# JSON output
agrasandhani scan https://example.com -o jsonEvery check maps to at least one OWASP Top 10 category and one WSTG test ID, so coverage is auditable. The authoritative, always-updated status lives in ROADMAP.md. A snapshot:
Legend: ✅ Done · 🟡 Partial · ⬜ Planned
| OWASP Top 10 (2021) | Status |
|---|---|
| A02 Cryptographic Failures | 🟡 |
| A05 Security Misconfiguration | 🟡 |
| A01 · A03 · A06 · A07 · A08 · A10 | ⬜ |
| Phase | Theme | Focus |
|---|---|---|
| 0 | Foundation (mostly done) | CLI, config, async HTTP, plugin architecture |
| 1 | MVP — passive config & crypto hygiene | Headers, cookies, TLS/HSTS, info disclosure, HTML report |
| 2 | Crawling & content discovery | Playwright crawler, endpoint/form enumeration |
| 3 | Active input validation (opt-in) | XSS/SQLi/redirect probes with safety guards |
| 4 | AuthN / AuthZ / Session | Authenticated scans, IDOR heuristics |
| 5 | Components, integrity & SSRF surface | Vulnerable JS libs, SRI, SSRF detection |
| 6 | Reporting & ecosystem | SARIF/CI, Docker, GitHub Action |
- Practical, focused testing mapped to real-world risk (OWASP Top 10 / WSTG)
- Safe-by-default: intrusive checks are always opt-in
- Clean, extensible architecture
- High code quality, built in public
Contributions are welcome — see CONTRIBUTING.md and our Code of Conduct. To report a vulnerability in Agrasandhani itself, follow SECURITY.md.
MIT © 2026 Prasun Chakraborty