BugTraceAI-CLI
An agentic web scanner: terminal workspace, six stages from recon to report, browser validation of findings, REST and MCP
- 183 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- The Exploit stage sends attacking requests to the target, and scanning someone else's application without the owner's permission breaks the law.
- The model provider key and target credentials (tokens, a YAML login with TOTP) enter the scan session, and part of the data goes to an external provider.
Install
- Works in
Manual install
curl -fsSL https://raw.githubusercontent.com/BugTraceAI/BugTraceAI-Launcher/main/install.sh | bashThe universal Launcher: pick only the CLI module there, then enter the provider key and the install mode. The script runs from the network, so it is worth reading first.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The Exploit stage sends attacking requests to the target, and scanning someone else's application without the owner's permission breaks the law.
- The model provider key and target credentials (tokens, a YAML login with TOTP) enter the scan session, and part of the data goes to an external provider.
This is third-party code. Review the repository files before installing.
What it does
BugTraceAI-CLI is a web application scanning engine for authorized penetration tests. A scan runs through six stages: Recon, Discovery, Strategy, Exploit, Validate and Report. A language model steers the investigation while specialists check SQL injection, XSS, SSRF, IDOR, LFI, RCE, template injection, XXE, JWT and redirects. Findings are confirmed by tools and browser validation. A scan is driven from the terminal interface: the Pipeline, Findings, Agents, Timeline and Logs tabs, model provider setup on F7 and target sign-in on F8 (a Bearer token or a YAML login with TOTP). For scripts there are `./bugtraceai-cli scan <url>` and `serve`, and `./bugtraceai-cli mcp` hands scan control to MCP clients. The output is `final_report.md`, `validated_findings.json`, `engagement_data.json` and `report.html`.
Who it is for. Security specialists and bug bounty hunters who test applications with the owner's permission and want to automate recon and finding validation.
Good fit when
- An agreed pentest starts with recon: the engine crawls the site and finds entry points.
- A bug bounty participant checks a target by vulnerability class: SQL injection, XSS, SSRF, IDOR and JWT.
- A scan is launched from an agent through MCP with a request to return only confirmed findings.
- The target sits behind a login: a Bearer token or a YAML login with TOTP is set and the scan runs as a test user.
- Scan results are handed to a team as `report.html` and JSON.
Not a fit when
- You do not own the target and have no written permission from the owner: the authors allow scans of authorized applications only.
- The Exploit stage sends attacking requests, which is dangerous for a production system outside an agreed window.
- There is no model provider key: a real scan will not start without it and only the demo works.
- You expect a settled product: the public version remains a beta.
Example request
Run `./bugtraceai-cli scan https://staging.example.com` on a staging host I have permission to test, and return the confirmed findings with evidence.Limitations
The public version remains a beta. A real scan needs a model provider key (OpenRouter, Anthropic, Z.ai or Bedrock), so part of the target's data goes to an external service. Python 3.10 or newer is required, and some specialist tools start Docker during a local scan. A scan is acceptable only against applications you have permission to test. The `api` profile in Docker brings up REST and MCP on ports recorded in `.env`, and MCP works over stdio by default.
How to disable. Delete the cloned repository directory and the `btai` command registration if it was installed globally. Provider keys sit in the local `.env`; remove them and revoke them with the provider.
FAQ
How do I install BugTraceAI-CLI?
The easiest way is the Launcher: `curl -fsSL https://raw.githubusercontent.com/BugTraceAI/BugTraceAI-Launcher/main/install.sh | bash`. The direct route is to clone the repository and run `./scripts/install-runtime.sh --interface tui --runtime local --global yes`, after which the `btai` command is available.
How do I open the terminal interface?
Run `./bugtraceai-cli` or `btai`, configure the provider with F7, enter a target and press Start. Without a provider key you can watch the demo with `./bugtraceai-cli tui --demo`.
How do I connect MCP?
`./bugtraceai-cli mcp` starts the server over stdio. For HTTP and SSE add `--sse --host 127.0.0.1 --port 8001`: the client connects to `http://localhost:<MCP_PORT>/sse`.
How do I give the scan a sign-in to the target?
In the interface open Auth on F8 and enter a Bearer token or a WEB-compatible YAML with an optional TOTP. For scripts the `scan` command takes the `--auth-config auth-config.yaml` flag.
Where are reports saved?
`final_report.md`, `validated_findings.json`, `engagement_data.json` and `report.html` land in the configured report directory. Findings from the interface are exported to JSON with Ctrl+E or the `/export` command.
Discussion
No questions or reviews yet.
Related
CLI toolsA static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Burp Suite extension with AI: analyzes requests, runs scanners and opens Burp over MCP to Claude Desktop, Claude Code, Codex and Gemini CLI
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
MCP server that gathers your HackerOne history and 3,600 disclosed reports into a database the agent uses to plan program work
Tracekit checks an AI agent's tool calls before they run and keeps a signed log whose tampering shows up in an offline check
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| BugTraceAI-CLI (this card) | no | 183 | ||
| Strix | no | 74,108 | a set of skills through which an agent runs the Strix pentest and adds checks to CI; BugTraceAI-CLI runs the scan itself through six stages with its own terminal interface | |
| Pentest Agent Suite | no | key is optional | 1,060 | a set of subagents and commands for bug bounty inside Claude Code; BugTraceAI-CLI is a separate scan engine with REST and MCP |
README in short
The project page describes installation in three ways (the Launcher, a direct script, a prompt for an agent), shows the terminal interface hotkeys and the API and MCP modes. Details on profiles and authentication live in `INSTALLATION.md`.