An open-source, self-hosted vulnerability scanner orchestration platform with AI-powered analysis.
BugBuddy.AI coordinates multiple industry-standard security scanning tools through a unified web dashboard, streams real-time results via SSE, and uses AI to summarise, score, and recommend remediation for findings. Everything runs locally — no cloud dependency, full data sovereignty.
- Multi-tool orchestration — Runs Nuclei, Nikto, Wapiti, OWASP ZAP, Nmap, Subfinder, HTTPX, WhatWeb, and SSLyze in a phased pipeline
- Three scan profiles — Basic (passive/safe), Medium (active in-scope), Advanced (full active) with configurable sensitivity (Low-Noise/Normal/Aggressive)
- Real-time streaming — Live terminal console with colour-coded logs and findings via Server-Sent Events
- AI Mission Intelligence — Post-scan summarisation, scoring (0–100), risk assessment, and remediation recommendations via any OpenAI-compatible endpoint
- AI Chatbot — Built-in assistant that answers questions about scans, findings, and navigation
- Findings management — Browse, filter, search, and examine vulnerabilities across all scans with severity breakdowns
- Export — JSON and HTML report export for findings and AI intelligence
- Full data sovereignty — All scan data, logs, and AI reports stored locally in SQLite
Legal: Only scan targets you own or have explicit written permission to test. Unauthorised scanning may violate computer fraud laws.
Browser (port 8080) Flask API (port 5000)
│ │
│── /api/* ──(proxy)──────────────────► │
│ │
│◄── SSE (real-time logs/findings)──────│
│ │
orchestrator.py (subprocess)
│
┌─────────┼──────────┐
Nuclei Nikto Wapiti ZAP Nmap ...
- Frontend: React 18 + TypeScript + Vite 5 (port 8080)
- Backend: Flask Python REST API (port 5000)
- Orchestrator: Standalone Python subprocess managing tool execution lifecycle
- Database: SQLite with WAL mode (auto-created on first run)
| Requirement | Minimum |
|---|---|
| OS | Kali Linux (recommended), Debian 11+, Ubuntu 22.04+, Arch Linux |
| Python | 3.10+ |
| Node.js | 18+ |
| npm | 9+ |
| RAM | 4 GB (8 GB recommended for aggressive scans) |
| Disk | 2 GB free |
git clone <your-repo-url> && cd FINAL_PUSHpip install -r requirements.txt --break-system-packagesnpm installMost tools come pre-installed on Kali. Install any missing ones:
sudo apt update
sudo apt install -y nikto wapiti zaproxy nmap whatweb sslyzeInstall ProjectDiscovery tools (nuclei, subfinder, httpx):
# Nuclei
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
# Subfinder
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
# HTTPX
go install github.com/projectdiscovery/httpx/cmd/httpx@latestOr download pre-built binaries from the ProjectDiscovery releases page.
sudo apt update
sudo apt install -y nikto wapiti zaproxy nmap whatweb sslyze
# ProjectDiscovery tools (option 1 — Go)
sudo apt install -y golang-go
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
# ProjectDiscovery tools (option 2 — pre-built binaries)
# Visit: https://github.com/projectdiscovery/nuclei/releases
# https://github.com/projectdiscovery/subfinder/releases
# https://github.com/projectdiscovery/httpx/releasessudo pacman -S nikto wapiti nmap whatweb sslyze
yay -S zaproxy nuclei-bin subfinder-bin httpx-binFor ZAP integration, start the daemon before running scans:
zap.sh -daemon -port 8090 -host 127.0.0.1 -config api.disablekey=trueThe orchestrator can also auto-start ZAP if the daemon is not already running.
python3 start.pyThis starts both the Flask backend (port 5000) and Vite frontend (port 8080), then opens your browser.
| Flag | Purpose |
|---|---|
--no-browser |
Skip opening browser automatically |
--backend-only |
Start only the Flask API server |
--frontend-only |
Start only the Vite dev server |
--backend-port PORT |
Custom backend port (default: 5000) |
--frontend-port PORT |
Custom frontend port (default: 8080) |
--force |
Auto-kill processes on conflicting ports |
- Web UI: http://localhost:8080
- API: http://127.0.0.1:5000
- Open the UI and register an account
- Configure your AI endpoint in Settings (e.g. OpenAI, local Ollama, or any OpenAI-compatible API)
- Go to Tools to verify which scanners are installed
- On the Dashboard, enter a target URL, select a profile (Basic/Medium/Advanced) and sensitivity, then click EXECUTE SCAN_
- Monitor the live terminal as the scan runs through Recon → Asset Intelligence → Vulnerability Engine phases
- When the scan completes, view the AI Mission Intelligence report with scoring, summary, and recommendations
- Browse all findings in the Intelligence Hub (Findings page)
| Mode | Tools | What it does |
|---|---|---|
| Basic | All selected | Passive, low/medium templates, passive ZAP |
| Medium | All selected | Active in-scope, SQLi/XSS, ZAP active in-scope |
| Advanced | All selected | Full active, all severities, ZAP full scan |
| Low-Noise | Normal | Aggressive | |
|---|---|---|---|
| Basic | 45–90 min | 10–20 min | 3–8 min |
| Medium | 2–4 hrs | 30–60 min | 12–25 min |
| Advanced | 4–8 hrs | 60–120 min | 25–50 min |
| Method | Endpoint | Auth | Purpose |
|---|---|---|---|
| POST | /api/auth/register |
No | Register |
| POST | /api/auth/login |
No | Login |
| GET | /api/scans |
Yes | List scans |
| POST | /api/scan |
Yes | Launch scan |
| GET | /api/scan/<id>/stream |
Token | SSE live stream |
| GET | /api/scan/<id>/intelligence |
Yes | Get AI report |
| POST | /api/chat |
Yes | AI chatbot |
| GET | /api/tools |
Yes | Tool status |
| GET | /api/settings/ai |
Yes | AI config |
| POST | /api/settings/ai |
Yes | Save AI config |
Frontend: React 18, TypeScript, Vite 5, Tailwind CSS 3, Framer Motion, Radix UI, TanStack Query, Recharts
Backend: Python 3, Flask, SQLite, bcrypt, Fernet encryption
Scanners: Nuclei, Nikto, Wapiti, OWASP ZAP, Nmap, Subfinder, HTTPX, WhatWeb, SSLyze
See LICENSE.