frameseven

A CLI-first offensive web security scanner for authorized security testing.

frameseven maps a target's attack surface and runs active checks for common web vulnerabilities and misconfigurations, then produces structured reports. It also ships an MCP server so AI agents can drive the same Framework v1 tooling.

[!WARNING] Only scan systems that you own or have explicit permission to test. Framework v1 performs active requests and may send methods or payloads that affect a target application.

Highlights

• Attack-surface mapping — recon, crawling, port and banner discovery, and subdomain enumeration before any active probing.
• Active vulnerability checks — XSS, SQL injection, LFI, SSRF, SSTI, XXE, command injection, open redirect, access control, and rate-limit testing.
• Misconfiguration and content audits — security headers, exposed content, and external resource review.
• Structured reporting — generates reports under a configurable output directory, with optional PDF rendering.
• Authenticated scans — -auth-browser opens a browser to log in before the scan so authenticated surface is covered.
• MCP server — exposes versioned Framework v1 tools to AI agents over stdio or Streamable HTTP.
• Standard-library focused — a small, explicit Go codebase that is easy to read and extend.

Video Demo

Watch a walkthrough and demonstration of frameseven in action:

Recommended: frameseven demo on YouTube

Get Frameseven

frameseven is distributed through three clear paths:

• GitHub Releases and pre-releases are the recommended option for most users who want a packaged binary without building from source.
• Docker is the easiest way to run the scanner with a self-contained runtime and the external tooling bundled in the image.
• Source builds are best for development, local changes, or when you need to work directly from the repository.

See Installation v1 for the full distribution matrix and platform-specific instructions.

Source Build Requirements

• Go 1.26.5 or later in the Go 1.26 release line
• Python 3 with fpdf2 for PDF report generation
• Git
• Network access to the authorized target
• Linux, macOS, or another environment supported by Go

Quick Start

git clone https://github.com/sayseven7/frameseven.git
cd frameseven

# Optional: enable PDF report generation for local builds
python3 -m venv .venv
.venv/bin/python -m pip install "fpdf2>=2.8"

# Verify the build
go test ./...

# Run a scan against an authorized target from source
go run cmd/cli/v1/main.go -url https://target.example

If you prefer a packaged release, download a stable release or pre-release artifact from GitHub Releases and run the installed frameseven command.

To run the published Docker image:

docker pull ghcr.io/sayseven7/frameseven:<version>

mkdir -p reports
docker run --rm \
  -v "$PWD/reports:/workspace/reports" \
  ghcr.io/sayseven7/frameseven:<version> \
  -url https://target.example \
  -out /workspace/reports

Run without -url in a terminal to open the interactive setup wizard:

go run cmd/cli/v1/main.go

Build an installable binary from source:

go build -o bin/frameseven/cli/v1 cmd/cli/v1/main.go
./bin/frameseven/cli/v1 -url https://target.example

Usage

frameseven -url https://target.example [flags]

See CLI v1 for the complete flag reference and environment variables.

Scanner tools

recon, crawler, ports, bannergrab, subdomain, external, content, misconfig, access, auth, xss, sqli, lfi, ssrf, ssti, xxe, cmdi, redirect, ratelimit.

List them at any time:

frameseven -list-tools

Reports

PDF reports are rendered by the Go wrapper through Python. The wrapper uses FRAMESEVEN_PYTHON when set, otherwise it looks for .venv/bin/python, then falls back to python3. If Python or fpdf2 is missing, PDF generation returns a clear error instead of silently producing a broken report.

See Report Format v1 for the output contract.

MCP Server

frameseven includes an MCP server at cmd/mcp that exposes versioned Framework v1 tools to AI agents.

# stdio transport
go run ./cmd/mcp -transport stdio

# Streamable HTTP transport
go run ./cmd/mcp -transport http -addr 127.0.0.1:8080

[!CAUTION] Scanner tools send active security probes. Do not expose the HTTP MCP endpoint openly to the internet; place it behind an access-controlled network, reverse proxy, tunnel, or firewall rule.

See MCP Server and MCP configuration for client setup.

Documentation

• Documentation overview
• Installation v1
• Getting started v1
• CLI v1
• Report format v1
• MCP server
• Prompt suggestions — ready-to-use mission prompts to run in your own agents
• GitHub Releases
• Go reference

Contributing

Contributions are welcome. Please read CONTRIBUTING.md and the Code of Conduct before opening a pull request. Project conventions and agent rules live in AGENTS.md.

License

Released under the MIT License.