pip install cognis-dastlite
dastlite scan https://your-app.example   # → prioritized passive findings in seconds

🔎 Example output

Real, reproducible output from the tool — runs offline:

$ dastlite-emit --version
dastlite 1.0.0

$ dastlite-emit --help
usage: dastlite [-h] [--version] {scan,scan-input,active} ...

Config-as-code baseline DAST. PASSIVE by default; an authorization-gated ACTIVE mode is available for owners.

positional arguments:
  {scan,scan-input,active}
    scan                PASSIVE live scan of URLs.
    scan-input          PASSIVE offline scan of a capture file (no network).
    active              ACTIVE scan (AUTHORIZED USE ONLY) — off by default,
                        scope + rate-limit required.

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit

Blocks above are real dastlite output — reproduce them from a clone.

Sample result format (illustrative values — run on your own data for real findings):

{
  "results": [
    {
      "id": "123456",
      "title": "Vulnerable Web App",
      "description": "A web app is vulnerable to a SQL injection attack.",
      "severity": "high",
      "tags": ["sql-injection", "web-app"],
      "findings": [
        {
          "id": "1",
          "type": "vulnerability",
          "name": "SQL Injection",
          "description": "A SQL injection vulnerability exists in the web app.",
          "severity": "high"
        }
      ]
    },
    {
      "id": "789012",
      "title": "Misconfigured Server",
      "description": "A server is misconfigured, allowing unauthorized access.",
      "severity": "medium",
      "tags": ["misconfiguration", "server"],
      "findings": [
        {
          "id": "2",
          "type": "vulnerability",
          "name": "Unsecured Server",
          "description": "A server is not properly secured, allowing unauthorized access.",
          "severity": "medium"
        }
      ]
    }
  ]
}

Passive (default) vs Active (authorized-use only)

dastlite has two scanning postures. Passive is the safe default.

Mode	Command	Network	Default
Passive — offline	dastlite scan-input capture.json	none	✅ safest
Passive — live	dastlite scan https://app	one GET per URL	✅ on
Active — gated	dastlite active https://app --authorized --scope app --rate-limit 2	extra read-only probes	⛔ OFF by default

Passive mode

Passive mode only analyzes responses — it never probes. Either feed it a captured response file (fully offline, ideal for CI on artifacts/HAR exports):

dastlite scan-input capture.json --format sarif -o results.sarif   # offline

…or let it fetch each URL once and inspect what comes back:

dastlite scan https://example.com https://example.org
dastlite scan --targets urls.txt --fail-on warning --format sarif -o out.sarif

It flags missing/weak security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy), insecure cookie flags, permissive CORS, mixed content, clear-text credential forms, verbose banners, and information-disclosure (stack traces, SQL errors, leaked keys).

Active mode — ⚠️ AUTHORIZED USE ONLY

Active scanning sends real requests to a live target. It is OFF by default and will refuse to run unless you (1) pass --authorized to attest you have explicit written permission, (2) supply a non-empty --scope / --target-allowlist, and (3) set a positive --rate-limit. Anything not in scope is skipped, never probed. There are no exploit payloads — active probes are benign read-only GETs (e.g. is /.env or /.git/HEAD publicly reachable, does the server honor TRACE). Scanning systems you do not own or are not authorized to test may be illegal.

dastlite active https://app.example.com \
    --authorized \
    --scope app.example.com \
    --rate-limit 2 \
    --format sarif -o active.sarif

A loud authorized-use banner is printed to stderr whenever active mode engages.

--fail-on {error,warning,note,never} controls the CI gate in every mode; exit 0 = clean, 1 = findings at/above threshold, 2 = usage / authorization error.

Contents

• Why dastlite? · Features · Quick start · Example · Architecture · AI stack · How it compares · Integrations · Install anywhere · Related · Contributing

Why dastlite?

ZAP's automation is YAML-heavy and JVM-bound; dastlite is a Go single-binary 'ZAP-baseline-but-faster' that fits a 5-minute PR gate and speaks SARIF natively.

dastlite is single-purpose, scriptable, and self-hostable: point it at a target, get prioritized results in the format your workflow already speaks (table · JSON · SARIF), gate CI on it, and let agents drive it over MCP.

Features

• ✅ Passive checks (default): security headers, HSTS, cookie flags, CORS, mixed content, clear-text forms, info-disclosure
• ✅ Offline scan-input mode — analyze captured responses / HAR with zero network
• ✅ Authorization-gated active mode — off by default, scope-enforced, rate-limited, no exploit payloads
• ✅ SARIF 2.1.0 + JSON + table output; CI exit-code gating (--fail-on)
• ✅ Runs on Linux/macOS/Windows · Docker · devcontainer
• ✅ Ports in Python, JavaScript, TypeScript, Go, and Rust (ports/) — Go/Rust verified in CI

Quick start

pip install cognis-dastlite
dastlite --version
dastlite scan https://example.com              # passive live scan
dastlite scan-input capture.json --format json # passive OFFLINE scan
dastlite scan --targets urls.txt --fail-on warning   # CI gate (non-zero exit)

Example

$ dastlite scan .
  [HIGH    ] DAS-001  example finding             (./src/app.py)
  [MEDIUM  ] DAS-002  another signal              (./config.yaml)

  2 findings · risk score 5 · 38ms

Architecture

flowchart LR
  IN[target / manifest] --> P[dastlite<br/>checks + rules]
  P --> OUT[findings (JSON / SARIF)]

Use it from any AI stack

dastlite is interoperable with every popular way of using AI:

• MCP server — dastlite mcp (Claude Desktop, Cursor, Cognis.Studio, uncensored-fleet)
• OpenAI-compatible / JSON — pipe dastlite scan . --format json into any agent or LLM
• LangChain · CrewAI · AutoGen · LlamaIndex — wrap the CLI/JSON as a tool in one line
• CI / scripts — exit codes + SARIF for non-AI pipelines

How it compares

	Cognis dastlite	OWASP ZAP automation framework, distilled to a single binary
Self-hostable, no account	✅	varies
Single command, zero config	✅	⚠️
JSON + SARIF for CI	✅	varies
MCP-native (AI agents)	✅	❌
Polyglot ports (JS/TS/Go/Rust)	✅	❌
Open license	✅ COCL	varies

Built in the spirit of OWASP ZAP automation framework, distilled to a single binary, re-framed the Cognis way. Missing a credit? Open a PR.

Integrations

Pipes into your stack: SARIF for code-scanning, JSON for anything, an MCP server (dastlite mcp) for AI agents, and a webhook forwarder for SIEM/Slack/Jira. See docs/INTEGRATIONS.md.

Install — every way, every platform

pip install "git+https://github.com/cognis-digital/dastlite.git"    # pip (works today)
pipx install "git+https://github.com/cognis-digital/dastlite.git"   # isolated CLI
uv tool install "git+https://github.com/cognis-digital/dastlite.git" # uv
pip install cognis-dastlite                                          # PyPI (when published)
docker run --rm ghcr.io/cognis-digital/dastlite:latest --help        # Docker
brew install cognis-digital/tap/dastlite                             # Homebrew tap
curl -fsSL https://raw.githubusercontent.com/cognis-digital/dastlite/main/install.sh | sh

Linux	macOS	Windows	Docker	Cloud
scripts/setup-linux.sh	scripts/setup-macos.sh	scripts/setup-windows.ps1	docker run ghcr.io/cognis-digital/dastlite	DEPLOY.md (AWS/Azure/GCP/k8s)

Related Cognis tools

• apkpeek — One-command static triage of Android APK/AAB binaries: surfaces hardcoded secrets, exported components, dangerous permissions, and insecure manifest flags as a single SARIF report.
• ipasnitch — Static scanner for iOS .ipa bundles that flags ATS exceptions, missing entitlements hardening, embedded URLs/secrets, and weak Info.plist transport settings.
• hookcraft — Generates ready-to-run Frida instrumentation scripts from a YAML intent (e.g. 'bypass SSL pinning', 'dump crypto keys') and verifies they attach to a target process.
• semsift — Lightweight semantic-aware SAST that runs curated taint rules over diffs only, so PRs get fast incremental SAST instead of whole-repo scan fatigue.
• cheatsense — Anti-cheat telemetry analyzer that ingests game session logs and flags statistically anomalous input/aim/movement signatures with explainable per-flag scoring.
• binhunt — Game/desktop binary integrity scanner that fingerprints executables, detects common packers/obfuscators, and diffs against a known-good baseline to catch tampering.

Explore the suite → 🗂️ all 170+ tools · ⭐ awesome-cognis · 🔗 cognis-sources · 🤖 uncensored-fleet · 🧠 engram

Contributing

PRs, new rules, and demo scenarios are welcome under the collaboration-pull model — see CONTRIBUTING.md and SECURITY.md.

⭐ If dastlite saved you time, star it — it genuinely helps others find it.

Interoperability

{} composes with the 300+ tool Cognis suite — JSON in/out and a shared OpenAI-compatible /v1 backbone. See INTEROP.md for the suite map, composition patterns, and reference stacks.

License

Source-available under the Cognis Open Collaboration License (COCL) v1.0 — free for personal, internal-evaluation, research, and educational use; commercial / production use requires a license ([email protected]). See LICENSE.

---