kiyooo doesn't reimplement subdomain scanners or vulnerability crawlers — it wraps best-in-class open-source tools (Prowler, Trivy, TruffleHog, apktool, plus its own passive recon) and puts an LLM adjudicator in front of every hit they produce. A raw finding is a candidate, never something shown to a human on its own — it has to survive category matching and cited-evidence adjudication first. Below is the complete console: the original recon/triage/cost pipeline (Stages 0–12) plus the cloud, containers, repo, and mobile modules added on top of it (Stages 13–17) — one nav, one pipeline, nothing set aside.
Whether a hit comes from Prowler scanning an AWS account or from kiyooo's own recon against your external perimeter, it goes through the identical five steps before a person ever sees it.
Prowler / Trivy / TruffleHog / apktool run against your own infra — never a third party's.
Vendor severity is discarded. raw_severity always comes from the matched category.
An LLM verdict, every claim cited to an evidence ID. It has no authority to close anything.
A human confirms true/false-positive. Nothing auto-closes a critical.
A ticket drafts. A human sends it — sinks never fire on their own.
This is a faithful recreation of kiyooo's real Next.js UI — same nav grouping, same CSS tokens, same on-page copy shipped in the repo — populated with example data standing in for a scan you haven't run yet. Click anything in the sidebar, or flip a switch on Settings.
MCP servers, vector stores, model registries, notebook servers, shadow AI SaaS
tenants — kiyooo fingerprints these with its own passive recon, the same way it finds a subdomain or an
open port. Its own nav page — AI attack surface, above — is only part of
the picture: these 10 categories and 5 new asset types (llm_endpoint, mcp_server,
vector_db, model_registry, notebook) also flow through Asset
explorer, Categories, and the Triage queue you clicked through above — try the Asset explorer tab again,
mcp-legacy.acme.com and vectors.acme.com are in there.
Self-contained, offline, resettable Docker environments that plant real instances of
kiyooo's shipped categories — including their false-positive paths — so a demo isn't just a screenshot.
kiyoo-labs starts all three and adds every /etc/hosts entry they need.
Conventional attack surface: exposed DB, leaked secrets, an expired cert, an SSO false-positive, a
WAF-reduced severity, a seeded-data downgrade. Everything binds to 127.0.0.1 only.
staging.acmecorp.lab, admin.acmecorp.lab.The AI attack surface above, planted for real: MCP twin servers (harmless / dangerous / poisoned), a vector store, a model registry, a notebook server, a shadow AI SaaS tenant, plus a drift scenario.
Not a planted-asset lab — the interactive front door onto both of the above. One page per shipped category (30 infra + 10 AI), each with a live-evidence fetch against the real decoy, not a static link.
Per-tool star counts and licenses, checked before anything got wrapped — the project rule is real community adoption plus a permissive-enough license, never a random GitHub repo.
| Tool | Wraps | Stars | License | Module |
|---|---|---|---|---|
| Prowler | AWS / Azure / GCP / Kubernetes account audits | ~14,000★ | Apache-2.0 | Cloud posture |
| Trivy | Container image & Kubernetes cluster scanning | ~36,500★ | Apache-2.0 | Containers |
| TruffleHog | Verified live-secret scanning (git & filesystem) | ~25,700★ | AGPL-3.0 | Repos & Mobile |
| apktool | Android APK manifest & resource decoding | ~19,000★ | Apache-2.0 | Mobile |
Not aspirations — enforced at the network-executor and pipeline layer, regardless of what a task or a prompt asks for.
No exploitation primitives. Verification proves reachability, never compromise.
All outbound traffic routes through ScopeGuard, enforced at the executor, never the planner.
Passive by default. Active scanning needs a config flag, a CLI flag, and an attestation.
The LLM has no authority. It cites evidence; it never closes a finding.
Evidence is data, never instruction — even an instruction found inside it is just a finding to report.
A human approves outbound. Sinks draft; people send.
Secrets are redacted at ingest — a credential_ref pointer, never a live value.
Models are pinned. Changing one needs an eval re-run and a changelog entry.