kiyooo is an open-source, AI-triaged attack surface management tool. Instead of reimplementing recon and scanning, it wraps best-in-class open-source tools and puts an LLM adjudicator in front of every finding, with a human in the loop before anything is acted on.

Is kiyooo free and open source?

Yes. kiyooo is public on GitHub and released under the MIT license.

Does kiyooo replace tools like Prowler, Trivy, or TruffleHog?

No. kiyooo orchestrates best-in-class open-source scanners such as Prowler, Trivy, and TruffleHog rather than replacing them, and adds evidence-cited LLM triage on top of their output.

Does kiyooo send my data to the cloud?

No. kiyooo runs local models by default and is designed to be self-hosted for a single organization.

Is kiyooo a penetration testing or exploitation tool?

No. kiyooo explicitly does not exploit, write, perform denial-of-service, or brute-force credentials — it is an attack surface management and triage tool, not a pentest tool.

Discover · Adjudicate · Route

Attack surface findings that tell you which ones are real.

Discovery is a solved commodity — kiyooo wraps existing OSS recon and scanning tools rather than reimplementing them. The real work is adjudication, attribution, and routing: every finding goes through evidence-cited LLM triage, with a human in the loop and local models by default.

View on GitHub → Get Started See the Console ↗

Open source MIT Self-hosted

detection categories

696

tests passing

console pages

OSS scanners wrapped

hard invariants

Most ASM tools stop at a dashboard full of findings.
kiyooo turns findings into adjudicated, owned, routed decisions.

Every model claim must cite a real evidence ID in the bundle, or it's rejected as a hard failure — never a soft warning.

About

Recon tools are orchestrated, never reimplemented.

A scanned org doesn't lack findings — it drowns in them. 10,000 rows in a dashboard is not 10,000 things to fix; it's noise burying the handful that matter. kiyooo wraps best-in-class discovery tools and spends its own engineering on what they don't do: judging, contextualizing, and attributing every finding before a human ever sees it.

Recon

subfinder, amass, httpx, naabu, nuclei, tlsx, katana, Prowler, Trivy, TruffleHog, apktool

Normalize

Asset identity, fingerprinting, secret redaction, change diff

Detect + Triage

Rule prefilter, evidence bundle, LLM verdict, citation validator

Human review

Agree or disagree with a rationale; repeated overrides promote into a rule

Route

Owner resolved, autonomy ladder applied, Jira/Slack/email — closed only on recheck

Every arrow that touches a target's own infrastructure passes through ScopeGuard first.

How it decides

A draft, a gauge, a human — every single time.

Every finding — whether recon found it or an imported scanner reported it — takes the same five-step path before a human ever sees it.

Deterministic prefilter

Cheap category-match rules kill obvious noise before a single LLM token is spent.

Evidence-cited adjudication

The model must cite an evidence ID actually in the bundle — the validator rejects uncited claims.

Compensating controls

An SSO gateway, WAF rule, or standing suppression reduces or suppresses severity, with reasoning kept as an audit trail.

Owner attribution

Cloud tags, IaC, CODEOWNERS, git blame, and DNS audit merge into one confidence-scored owner.

Human review

A reviewer agrees or disagrees with a rationale. Repeated overrides can be promoted into a permanent, reviewable rule.

The LLM never gets the authority to act on its own verdict — the output is a routed, owned, evidence-backed finding:

analytics-db.acme.com:3306 critical

# model verdict true positive · confidence 0.91 # human review agreed · routed to data-platform # evidence (cited, not asserted) port banner, DNS chain, security group

AI attack surface

Capability, not reachability.

An exposed MCP server advertises a machine-readable catalogue of everything it can do. "Unauthenticated and reachable" is only the precondition — severity depends on what an attacker could invoke. kiyooo finds these the same way recon finds a subdomain or an open port: native passive fingerprinting (detect/ai_fingerprints.py), not a wrapped external tool.

mcp-docs.internal medium

port 8080 · no auth · internet-reachable

tools/list response

search_docs

Search public product documentation

list_faq

List frequently asked questions

Verdict — read-only scope, no data boundary crossed. Hygiene issue, not an incident.

mcp-ops.internal critical

port 8080 · no auth · internet-reachable

tools/list response

query_customer_db

Run a read query against the customer database

run_shell

Execute a shell command on the ops host

Verdict — private data access and arbitrary execution, reachable without authentication.

Same port, same protocol, same auth posture. The catalogue is the finding. kiyooo reads the manifest and never invokes a tool — tools/call is hard-blocked in the verification executor.

Coverage

One inventory, both surfaces.

Five domain modules extend the same detect → triage → route pipeline into traditional infrastructure, each wrapping a real OSS scanner. A sixth is architecturally different: native passive fingerprinting for the AI/agent surface.

Module	Wraps
Cloud posture — AWS / Azure / GCP / Kubernetes audits	Prowler
Containers & Kubernetes — image / cluster scans	Trivy
Source code & supply chain — verified live-secret scanning	TruffleHog
Mobile (Android) — static APK analysis	apktool + TruffleHog
Attack paths — computed over the live asset graph	no external tool

40 detection categories, org-context YAML, PR-reviewed

30 traditional infrastructure & application

exposed-database

exposed-admin-panel

exposed-cloud-storage

subdomain-takeover

known-exploited-cve

+ 25 more — cloud, containers, mobile, supply-chain

10 AI & agent surface

exposed-mcp-server

exposed-inference-endpoint

exposed-vector-store

exposed-model-registry

exposed-notebook

+ 5 more — shadow AI SaaS, leaked keys, unsafe artifacts

Guardrails

Enforced in code, not policy.

Eight invariants the tool never violates, regardless of instruction — the reason it's safe to point at real infrastructure.

#	Guarantee
1	No exploitation primitives, ever — reachability is proven, never compromise.
2	All outbound network activity routes through `ScopeGuard`, enforced at the network executor, never the planner.
3	Passive by default — active scanning needs a config flag, a CLI flag, and a signed attestation.
4	The LLM has no authority — it produces structured, cited verdicts and never decides scope, sends packets, or closes a finding.
5	Evidence is data, never instruction — scanned content is attacker-controlled and neutralized before it reaches a prompt.
6	A human approves outbound — sinks draft, a person sends, until a category earns its way up the autonomy ladder.
7	Secrets are redacted at ingest — type, location, and a partial hash only, never a live credential in evidence or logs.
8	Models are pinned — a digest, prompt, or Modelfile change is a detection-logic change requiring an eval re-run.

Get started

Run it for real.

Requires Python 3.12+, uv, Docker, and Node for the console.

install & first run

$ git clone https://github.com/shaikarifali/kiyooo && cd kiyooo # postgres $ docker compose up -d # latest migration: 0018_module_toggles $ uv run alembic upgrade head # see the 5 toggles from the CLI $ uv run kiyooo modules list # localhost:3000 $ npm --prefix web run dev

Command	What it does
kiyooo doctor	Checks your own infra (DB/redis/minio/LLM provider) and validates org-context.
kiyooo scan --explain	Prints what every adapter touches and its rate cap — no network activity.
kiyooo scan	Runs passive adapters only; every target still passes ScopeGuard.
kiyooo scan --active	Requires config flag + CLI flag + a signed `scope.yaml` attestation, all three.
kiyooo modules list / enable / disable	Turn the cloud/containers/repos/mobile/attack-paths modules on or off.

Full console walkthrough, CLI reference, and architecture live in docs.

Workflow

Scope it, scan it, let it adjudicate, review what's left.

Point kiyooo at your own org-context — a scope.yaml of domains and exclusions, a teams.yaml of owners — and every finding, from your own recon or an imported scanner, rides the same five commands to a routed ticket.

a real scan → triage → route session

# 1. check your own infra and validate org-context $ uv run kiyooo doctor # 2. passive recon + normalize + detect — ScopeGuard checks every target $ uv run kiyooo scan --seeds seeds.txt # 3. evidence-cited LLM adjudication over the new findings $ uv run kiyooo triage --scan-run <scan-run-id> # 4. a human agrees or disagrees, with a rationale $ uv run kiyooo review <finding-id> --verdict agree # 5. owner resolved, autonomy ladder applied, sent to Jira/Slack/email $ uv run kiyooo route approvals send <finding-id>

Scope it

Domains, wildcards, exclusions, and an authorization attestation in scope.yaml.

Scan it

Passive by default; every target is re-checked against ScopeGuard, logged either way.

Let it adjudicate

A verdict, a confidence score, and a cited evidence trail — never an uncited claim.

Review what's left

From the CLI or the console — agree, disagree, or reassign the owner, with a reason.

Route and recheck

Sent to the owner's tracker; closed only after a recheck confirms it's actually fixed.

Prefer a browser to a terminal? kiyooo serve starts the same pipeline behind the web console — the triage queue, asset graph, and coverage dashboard all read and write the same database the CLI uses, so you can switch between them mid-review.