Describe a target.
Get a pentest report.
XCloak Recon is an AI-orchestrated penetration testing platform — describe a goal in plain English, and it plans, runs, and reports a real security assessment using industry-standard tools. Built by the makers of XCloak Security Suite.
> describe your goal
"Scan example.com for vulnerabilities"▌
🧠 AI Planner selecting tools: nmap → nuclei → gobuster
🐳 Docker running each tool in an isolated container
📊 AI Analysis validating findings, removing false positives
⚖️ CVSS Scoring 1 critical (9.8) · 2 medium · 4 low
⏸ Approval 2 follow-up tasks proposed — waiting on you
📄 Report report_example-com.pdf readyIllustrative example of the Recon pipeline — see app.xcloak.tech for the live beta
Pentesting, AI-orchestrated.
Traditional scanners run one tool at a time and dump raw output. Recon's AI planner reads your goal, decides which tools to run and in what order, executes each one in an isolated Docker container, then re-analyzes the combined output to strip false positives before scoring and reporting on what's actually there.
One goal, eight steps, one report.
Every scan follows the same auditable pipeline — nothing happens off to the side.
You describe a goal
AI Planner breaks it into tasks
Plan validated
Docker tools execute
AI analysis removes false positives
CVSS risk scoring
Follow-ups proposed — you approve
PDF report generated
Every step streams live over WebSocket — you watch it happen, not just the result.
Built for real assessments, not toy scans.
Core scanning, real-time visibility, and the enterprise controls a real engagement needs.
Core
- AI planning — GPT-4o, Claude, or local Ollama
- 7 tools: nmap, nuclei, gobuster, sqlmap, nikto, ffuf, whatweb
- Every tool isolated in its own Docker container
- Human-in-the-loop approval before follow-ups run
- CVSS risk scoring with automatic stop conditions
Real-Time
- WebSocket streaming — output appears line-by-line
- Visual 6-step execution pipeline
- Live terminal with colored event stream
- Risk score updates as findings come in
Data & Reports
- Professional downloadable PDF reports
- All findings stored and searchable across scans
- Full scan history — risk trends, duration, tool usage
Enterprise
- JWT + API key auth, target allow/deny lists
- Full audit log, queryable
- Scheduled scans with reusable templates
- Switch LLM provider at runtime — no restart
- Webhook notifications — Slack, Discord, HTTP
A full platform around every scan.
Threat intel, a community exploit database, and hands-on learning — all in the same dashboard.
Live Threat Intelligence
Real-time CVE feed from NVD, threat events from AlienVault OTX, and a live threat map.
Exploit Database
Community-submitted PoC exploits with DNA analysis, AI explanation, voting, and comments.
CTF Platform
Challenge submission, flag hashing, solve tracking, and a live leaderboard.
Security Learning
A structured curriculum from beginner to red team, linked to real resources with progress tracking.
Vulnerable Lab Playground
Docker-based lab setup guides — DVWA, WebGoat, Juice Shop, Metasploitable — to practice safely.
Authorized use only
Recon only scans targets you own or have explicit written permission to test. Target allowlisting is enforced at the platform level, not just policy.
What runs under the hood.
| Frontend | Next.js 15, TypeScript, Tailwind CSS |
| Database | Supabase (PostgreSQL via Prisma) |
| Storage | Supabase Storage |
| Scan Engine | FastAPI, Python 3.12 |
| Scan Tools | Docker — nmap, nuclei, gobuster, nikto, ffuf, sqlmap, whatweb |
| AI | Ollama (local) / OpenAI GPT-4o / Anthropic Claude |
| Threat Intel | NVD API, AlienVault OTX |
| Payments | Razorpay |
Start free. Scale when you need to.
Beta pricing — subject to change as Recon moves out of testing.
# or skip the UI and start a scan directly
curl -X POST https://app.xcloak.tech/api/v1/hybrid/execute \
-H "Content-Type: application/json" \
-d '{"goal": "Scan scanme.nmap.org for open ports and vulnerabilities", "target": "scanme.nmap.org"}'Try XCloak Recon.
Currently in beta and under active testing — expect rapid changes.