Metadata-Version: 2.4
Name: fsv
Version: 2.4.0
Summary: Web security scanner + MCP server: dangling DNS, orphaned buckets, compromised script CDNs, debug mode, attack paths — with paste-ready fixes.
Author-email: "twayst0 (tways)" <statways1707@gmail.com>
Maintainer-email: "twayst0 (tways)" <statways1707@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/twayst0/fsv
Project-URL: Documentation, https://github.com/twayst0/fsv/tree/main/docs
Project-URL: Changelog, https://github.com/twayst0/fsv/blob/main/CHANGELOG.md
Project-URL: Issues, https://github.com/twayst0/fsv/issues
Project-URL: Security, https://github.com/twayst0/fsv/blob/main/SECURITY.md
Keywords: security,scanner,vulnerability,dast,owasp,mcp,model-context-protocol,subdomain-takeover,supply-chain,spf,dmarc,appsec,devsecops
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Environment :: Web Environment
Classifier: Framework :: AsyncIO
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Internet :: WWW/HTTP
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: fastapi>=0.115.6
Requires-Dist: uvicorn[standard]>=0.30
Requires-Dist: aiohttp>=3.10
Requires-Dist: aiosqlite>=0.20
Requires-Dist: pydantic>=2.8
Requires-Dist: click>=8.1
Requires-Dist: rich>=13.8
Requires-Dist: mcp<3,>=2.0
Requires-Dist: python-multipart>=0.0.9
Requires-Dist: jinja2>=3.1
Requires-Dist: websockets>=13
Requires-Dist: httpx>=0.27
Requires-Dist: certifi>=2024.8.30
Requires-Dist: cryptography>=43
Requires-Dist: dnspython>=2.6
Requires-Dist: beautifulsoup4>=4.12
Requires-Dist: lxml>=5.3
Requires-Dist: tldextract>=5.1
Requires-Dist: colorama>=0.4.6
Requires-Dist: tabulate>=0.9
Dynamic: license-file

<p align="center">
  <img src="https://raw.githubusercontent.com/twayst0/fsv/main/docs/assets/hero.svg" alt="FSV — finds what checklists miss" width="100%">
</p>

# FSV — web security scanner & MCP server

<!-- mcp-name: io.github.twayst0/fsv -->

**For the problems nobody is watching:** dangling DNS and subdomain takeover, orphaned cloud buckets,
scripts from compromised or expired CDN domains, SPF includes that no longer exist, debug mode left on in
production, secrets in your JavaScript, end-of-life software — and the **attack paths** that turn small
findings into a real compromise, each with the cheapest fix that breaks it.

Runs as a **CLI**, a **dashboard**, an **MCP server** for AI assistants (Claude, Cursor, VS Code), and a **CI step**.
Detection only: it never exploits, never claims a resource, never tests a credential.

> **Authorized use only.** Scan only systems you own or are explicitly authorized in writing to test.

## Install

```bash
pip install fsv            # Python 3.11+
fsv doctor                 # checks dependencies, DNS, database
```

## Scan

```bash
fsv scan example.com --authorize                     # full scan of a site you own
fsv scan example.com --authorize --profile passive   # read-only: no payloads sent
fsv fixes <scan_id> nginx                            # paste-ready config for what was found
fsv web                                              # dashboard → http://127.0.0.1:7474
```

## Connect your AI assistant

```bash
fsv mcp-config --client claude-code      # prints:  claude mcp add fsv -- /path/to/fsv-mcp
fsv mcp-config --client claude-desktop   # or: cursor · vscode
```

Then ask: *“Use the **security_review** prompt on https://my-site.example — I own it.”*
The assistant confirms authorization, runs a passive check and a full scan, leads with attack paths and
hands you the fixes.

## What it finds

<p align="center">
  <img src="https://raw.githubusercontent.com/twayst0/fsv/main/docs/assets/detections.svg" alt="Detection cards: dangling DNS, orphaned bucket, dead SPF include, source map and secrets, end-of-life software, attack path, compromised CDN, debug mode" width="100%">
</p>

40 modules — DNS takeover, cloud storage, script supply chain, SPF/DMARC/DKIM, TLS (certificate trust, key strength, legacy protocols),
JavaScript secrets and source maps, DOM-XSS static analysis, OIDC/JWKS/OpenAPI exposure, vulnerable and end-of-life libraries,
~100 content-validated exposure checks (~190 with `--profile deep`, plus ~600 guessed paths and backup-copy probing with `--profile full`), framework debug pages, headers/CSP/cookies, and benign
context-aware active checks for common reflected issues. Findings carry severity,
confidence, CWE, OWASP Top 10 category and remediation; reports in Markdown, JSON, HTML, SARIF and CSV.

## Links

- Source, full documentation and screenshots: https://github.com/twayst0/fsv
- Changelog: https://github.com/twayst0/fsv/blob/main/CHANGELOG.md
- Security policy: https://github.com/twayst0/fsv/blob/main/SECURITY.md
- Contact: statways1707@gmail.com · Discord **.tways**

**License:** MIT — free for everyone, including commercial use.
