htunn/offsec-ai Security Scanner

AI-powered offensive security scanner: OWASP, MCP, K8s, OpenClaw, port, L7, mTLS, cert, and auth scans in your CI pipeline.

Trust Signals

name	description	required	default
scan-type	Scan command to run. One of: scan, l7-check, cert-check, mtls-check, owasp-scan, ai-owasp-scan, mcp-scan, k8s-scan, openclaw-scan, auth-scan, full-scan.	yes	—
target	Target hostname, IP address, or URL to scan. For mcp-scan / ai-owasp-scan, use a full URL (e.g. https://api.example.com/v1/chat/completions).	yes	—
version	Version of offsec-ai to install from PyPI. Defaults to "latest" (always installs the newest release).	no	latest
timeout	Per-request timeout in seconds.	no	30
output-format	Output format for the scan report. One of: json, csv, table. Defaults to json (required for the report-json output).	no	json
output-file	Path to save the scan report. Defaults to offsec-ai-report.json.	no	offsec-ai-report.json
extra-args	Additional CLI arguments passed verbatim to the scan command. Examples: "--categories A01,A02" / "--ports 443,8443" / "--mode deep"	no	""
fail-on-findings	Set to "true" to fail the workflow step when any findings are detected.	no	false
api-key	Gemini API key for LLM-powered scans (ai-owasp-scan). Passed as the GEMINI_API_KEY environment variable. In your workflow, set api-key to your repository secret (recommended: GEMINI_API_KEY).	no	""
python-version	Python version to use on the runner.	no	3.12

name	description
report-path	Absolute path to the generated scan report file.
risk-level	Top-level risk level string from the scan result (e.g. CRITICAL, HIGH, MEDIUM, LOW, INFO). Empty string when not available for the scan type.
findings-count	Number of findings / vulnerabilities detected.
report-json	Full JSON scan report as a base64-encoded string (first 65 kB). Decode with `base64 -d`.