owasp-noir/OWASP Noir Action
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 11, 2026
- License
- MIT
Pinned Snippet
uses: owasp-noir/noir@0da26f38b412621239c7366a52c27e9792eccfc6 # v1.1.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| base_path | The base path to analyze for endpoints (equivalent to -b/--base-path) | yes | . |
| url | Set base url for endpoints (equivalent to -u/--url) | no | "" |
| format | Set output format (plain, yaml, json, jsonl, markdown-table, curl, httpie, oas2, oas3, etc.) | no | json |
| output_file | Write result to file (equivalent to -o/--output) | no | "" |
| techs | Specify the technologies to use (equivalent to -t/--techs) | no | "" |
| exclude_techs | Specify the technologies to be excluded (equivalent to --exclude-techs) | no | "" |
| passive_scan | Perform a passive scan for security issues (equivalent to -P/--passive-scan) | no | false |
| passive_scan_severity | Set minimum severity level for passive scan (critical, high, medium, low) | no | high |
| use_all_taggers | Activates all taggers for full analysis coverage (equivalent to -T/--use-all-taggers) | no | false |
| use_taggers | Activates specific taggers (equivalent to --use-taggers) | no | "" |
| include_path | Include file path in the result (equivalent to --include-path) | no | false |
| verbose | Show verbose messages (equivalent to --verbose) | no | false |
| debug | Show debug messages (equivalent to -d/--debug) | no | false |
| concurrency | Set concurrency level (equivalent to --concurrency) | no | "" |
| exclude_codes | Exclude specific HTTP response codes (comma-separated, equivalent to --exclude-codes) | no | "" |
| status_codes | Display HTTP status codes for discovered endpoints (equivalent to --status-codes) | no | false |
| ai_provider | Specify AI provider prefix or full custom URL (equivalent to --ai-provider) | no | "" |
| ai_model | Specify AI model name (equivalent to --ai-model) | no | "" |
| ai_key | Specify AI API key (equivalent to --ai-key) | no | "" |
| ai_agent | Enable agentic AI workflow (equivalent to --ai-agent) | no | false |
| probe | Fire HTTP requests at discovered endpoints (equivalent to --probe) | no | false |
| probe_via | Route probes through this proxy URL (equivalent to --probe-via) | no | "" |
| export_es | Index endpoints in Elasticsearch or OpenSearch (equivalent to --export-es) | no | "" |
| export_webhook | POST endpoint catalog as JSON to a webhook URL (equivalent to --export-webhook) | no | "" |
| diff_path | Old code version path for diff analysis (equivalent to --diff-path) | no | "" |
| no_log | Hide execution progress/diagnostic logs and only show results (equivalent to --no-log) | no | true |
Outputs
| name | description |
|---|---|
| endpoints | Full Noir result document (`{"endpoints":[...],"passive_results":[...]}`) when format=json|jsonl. Empty otherwise. |
| passive_results | JSON array of passive-scan findings when format=json|jsonl. `[]` otherwise. |