npmCITSNode
_

Crawl web applications with a headless browser, run 10 built-in vulnerability plugins, and pipe results through OpenAI, Anthropic, Gemini, or Mistral for context-aware remediation reports.

$npm install -g kramscancopy
Documentation →
user@kramscan: ~
~ $

Find vulnerabilities before they ship.
Vulnerability Detection

XSS, SQL injection, CSRF, insecure headers, CORS misconfigurations, open redirects — detected automatically across every crawled page.

Dev Watch Mode

Point it at localhost, change a file, and KramScan re-scans instantly. Shows a diff of new vs. resolved findings after each save.

CI/CD Gate

Exits with code 1 when vulns exceed your threshold. Drop one line into GitHub Actions and block insecure deploys.

Headless Crawling

Puppeteer-powered browser renders SPAs and executes JavaScript to catch issues hidden from static analysis.

AI Agent

Conversational security assistant that independently verifies reported findings using non-destructive payloads.

Report Export

PDF, DOCX, Markdown, JSON, and TXT. AI executive summaries included. Every report ships with remediation steps.


10 built-in plugins. Extend with your own.
XSSPluginSQLInjectionPluginCSRFPluginSecurityHeadersPluginCORSAnalyzerPluginOpenRedirectPluginDebugEndpointPluginDirectoryTraversalPluginCookieSecurityPluginSensitiveDataPlugin

Each plugin extends BaseVulnerabilityPlugin. Drop a new file into src/plugins/vulnerabilities/ and the PluginManager picks it up.


Bring your own model.

KramScan pipes scan results through your chosen LLM for risk scoring, remediation advice, and executive summaries.

OpenAI
Anthropic
Gemini
Mistral
Groq
OpenRouter
Kimi

Commands
kramscan scan <url>Full vulnerability scan
kramscan dev [url]Watch-mode localhost scanner
kramscan gate <url>CI/CD security gate
kramscan agentAI security assistant
kramscan analyzeAI analysis of past scans
kramscan reportGenerate reports
kramscan onboardSetup wizard
kramscan doctorVerify environment
kramscan configView/edit config
kramscan initGenerate .kramscanrc