Discovery
Playwright Webserver Capture
Feed a list of web servers to playwright. Each URL opens in Chromium, Firefox, or WebKit in parallel and keeps a screenshot, rendered HTML, and meta.json.
Workflow library
- Discovery
Find exposed API and debug surfaces
Enumerate a domain and confirm exposed OpenAPI specs, Spring Actuator endpoints, and debug paths from response content, not from a bare HTTP 200.
- Content
Webpage Reading Queue Digest
Turn an ordered list of public webpage URLs into concise Markdown and HTML summaries with HTTP fetching and an AI-assisted pipeline.
- Content
YouTube Transcript to Podcast
Turn one YouTube video URL or ID into a podcast script and MP3 with Get Transcript, AI, and Speak.
- Discovery
Exposed MCP Server Scanner
Scan a target domain with subfinder and httpx for MCP servers, then write authentication, capability, and poisoning-risk findings to JSONL.
- Discovery
Audit SSH algorithms on port 22
Enumerate a domain and flag weak SSH host keys, key exchange, ciphers, and MACs from an unauthenticated banner. The check does not log in.
- Content
Podcast Episode Transcripts
List a public RSS feed, download each enclosure with yt-dlp, then transcribe the audio with Whisper. The report writes one text file per episode.
- Content
GitHub Trending Scraper
Scrape the GitHub Trending page and extract repository names, languages, descriptions, and URLs into a structured JSONL table.
- Content
Stock Market Analysis Digest
Turn ticker lists, market headlines, and macro inputs into a stock analysis digest with technical calculations and sentiment context.
- Content
RSS News Podcast
Turn public RSS feed URLs into a podcast script and spoken MP3 with Collect Feeds, AI, and Speak.
- Discovery
Find Origin IPs Behind Cloudflare
Find the origin server behind Cloudflare or another WAF by resolving subdomains, filtering CDN ranges, and confirming which IP serves the site.
- Content
arXiv Paper Summarizer
Fetch an arXiv paper abstract and HTML body, then use the Trickest Agent to produce a structured research summary in Markdown and HTML.
- Content
HIBP Breach Monitor
Scrape Have I Been Pwned for recent data breaches, fetch per-breach detail pages, and classify exposure severity into a JSONL report.
- Content
YouTube Transcript Summarizer
Turn one YouTube video URL or ID into a concise written transcript summary in Markdown and HTML with Get Transcript and AI.
- Discovery
Fingerprint front-end JS library versions
Enumerate a domain and read public pages for JavaScript library names and versions, including jQuery, AngularJS, Bootstrap, and Lodash.
- Content
AI Sample Dataset Generator
Turn a topic, row count, and optional schema into a synthetic sample dataset with JSONL, CSV, and a Markdown data dictionary.
- Discovery
Find exposed SAP Commerce surfaces
Enumerate a domain and fingerprint SAP Commerce HAC, Backoffice, and Data Hub from public pages. The check does not sign in.
- Discovery
Playwright Page Capture
Open one URL in Chromium, Firefox, or WebKit with playwright and keep a screenshot, rendered HTML, and meta.json, or a HAR and Playwright trace.
- Content
Company Enrichment from Website
Turn company homepage URLs into structured value proposition, industry, audience, and market context records in JSONL, Markdown, and HTML.
- Content
Hacker News, TechCrunch and arXiv Briefing
Turn Hacker News, TechCrunch, and arXiv RSS inputs into a cross-source Markdown and HTML briefing that connects research, news, and discussion.
- Content
Podcast Episode Download
List a public RSS feed, then download each enclosure with yt-dlp on its own worker. The report copies the media and writes downloads.jsonl.
- Discovery
Find exposed admin and management panels
Enumerate a domain and confirm admin panels such as Tomcat Manager, Jenkins, and phpMyAdmin from page markers or auth realms.
- Content
Ask HN Learning Resources
Turn an Ask HN topic into a cited study list of books, courses, articles, and community context.
- Discovery
Audit TLS certificates on port 443
Enumerate a domain and classify expired, mismatched, self-signed, and untrusted certificates on port 443. The check reads the handshake only.
- Content
Daily AI and ML News Digest
Turn AI and ML RSS feeds into a deduplicated HTML and Markdown digest covering model releases, research, and product news.
- Content
Daily Technology and Tools Newsletter
Turn broad technology and product RSS feeds into a deduplicated HTML and Markdown newsletter with clear topic sections.
- Discovery
Find exposed Docker Engine APIs
Enumerate a domain and probe ports 2375 and 2376 for a Docker Engine API that returns version JSON. The check does not run containers.
- Discovery
Find exposed DevOps config files
Enumerate a domain and confirm web-exposed Terraform state, Docker config, npmrc, and netrc files from their content, not from a bare HTTP 200.
- Vulnerability scanning
OpenAPI IDOR & BOLA Scanner
Read a target's OpenAPI spec, enumerate every GET that takes an object id, and probe each with altered ids and stripped auth.
- Cloud
AWS Bedrock Phantom IAM
Scan Bedrock phantom IAM, decode leaked ABSK keys offline, emit SCP and detection packs, and a dry-run cleanup plan.
- Vulnerability scanning
Browser Extension Threat Scanner
Seed a Chrome MV3 zip into ThreatXtension, then correlate permission and threat findings you can retest.
- CI/CD
CICD Attack Surface Scanner
Seed GitHub Actions YAML into Trajan and a coding-agent CI scan, then correlate inventory, findings, and a retest delta.
- Vulnerability scanning
Coding Agent Policy Gate
Decide allow, alert, or block on coding-agent file, shell, and network actions with AgentsLeak rules and a GolemHalt Cedar/YARA corpus.
- Discovery
Full Network Port & Service Assessment
Point one domain, ASN or CIDR at it and get a graded report of every open port and exposed service, distributed and token-free.
- Secrets
Scan GitHub for Leaked Secrets
Enumerate an organization's public GitHub repos and scan full commit history with TruffleHog for leaked keys and credentials.
- Vulnerability scanning
HTTP/3 Race Fuzzer
Compare QuicDraw baseline GET vs concurrent HTTP/3 race traffic, then correlate race evidence you can retest.
- Vulnerability scanning
MCP Trust Boundary Suite
Inventory HoneyMCP ghost tools and MCParasite channels, then correlate MCP trust-boundary findings you can retest.
- Discovery
Multi-Cloud Dangling DNS
Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.
- Discovery
PQ Crypto Surface Scanner
Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.
- Discovery
Sitemap URL & Metadata Extractor
Read a site's sitemap, fetch every page it lists, and inventory each URL's title, description, page type and metadata gaps in one table.
- Discovery
SPA Endpoint & Parameter Map
Map the route, API and parameter attack surface of a modern JS app (Next, Nuxt, React) from its JS bundles. No browser, no auth.
- Discovery
Typosquat & Look-alike Domain Scanner
Generate typo, homoglyph, TLD-swap and combosquat variants of a brand domain, probe every candidate, and score the live ones for phishing readiness.
- Discovery
Find Secrets in Wayback Responses
Pull a domain's archived URLs from web archives, fetch the stored response bodies, and scan them for leaked secrets without touching the live site.
- Vulnerability scanning
Web AI Agent Audit
Probe embedded web chat agents for injection, prompt leak, jailbreak, and role confusion with WebAgentAudit.
- Discovery
Cloud Bucket Finder (S3, GCS, Azure)
Permute a keyword into candidate bucket names and check each anonymously across Amazon S3, Google Cloud, Azure Blob and DigitalOcean.
- Discovery
Passive Port & CVE Scan (Shodan)
Read a target's open ports, product versions and matching CVEs out of Shodan's own data, so nothing you run reaches the target.
- Discovery
Directory & Content Discovery
Confirm which hosts are live, then brute-force paths against each one from a wordlist fetched at run time, and report what answered.
- Discovery
Domain OSINT & Footprinting
Profile a domain without sending it a packet: subdomains, DNS, WHOIS and certificate history, plus which hosts are live and what they run.
- Discovery
Check Email Spoofing (DMARC SPF DKIM)
Check whether an attacker can send mail as your domain by querying SPF, DKIM, DMARC, MTA-STS and BIMI across every subdomain.
- Discovery
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
- Discovery
Attack Surface Discovery by Company Name
Start from a company's registered name and find the domains it has certified, the networks those resolve into, and the hosts that answer.
- Vulnerability scanning
Find Open Redirects on a Domain
Mine a domain's archived URLs for redirect parameters, then confirm which ones send a browser to an attacker-controlled host.
- Vulnerability scanning
Find SSRF in HTTP Parameters
Crawl a target and mine its archived URLs, then test every parameter that takes a URL for server-side request forgery using out-of-band detection.
- Vulnerability scanning
Scan WordPress for Known CVEs
Fingerprint a WordPress site's core, plugins and themes while scanning for known CVEs next to the component and version they hit.
- Vulnerability scanning
Find Reflected XSS on a Domain
Collect a domain's archived URLs, keep parameters that reflect input, and fuzz each one for reflected and DOM cross-site scripting.
- Vulnerability scanning
ASN-Wide Vulnerability Scan
Turn an ASN into its live hosts, then scan the raw ports and the web surface for CVEs, misconfigurations, and exposures. Findings land in one report.
- Vulnerability scanning
Find Exposed Databases
Port-scan a range for eight database engines and check every open service for unauthenticated access, from MongoDB and Redis to PostgreSQL.
- Vulnerability scanning
Find Subdomain Takeovers
Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.
- Discovery
Website Screenshot & Visual Recon
Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.