About Klyrek

Map first. Test smarter.

Klyrek exists to eliminate the repetitive reconnaissance work of a web application security assessment, so testers spend their time on business logic, authentication, and the vulnerabilities that need a human to find, not on manually collecting information a machine can gather faster and more consistently.

Modular

Every capability ships as its own package. Install only what a job needs.

Developer-first

Typed public APIs and clean CLI commands, not black boxes.

Extensible

A plugin is a Python class with one method, ship it privately or contribute it back.

Production-ready

269 tests across 14 packages, mypy-clean, verified against real authorized targets.

Actively maintained

Regular releases and direct support, not a side project left to rot.

Ethical

Built exclusively to support authorized security assessments.

The approach

One map, built once, trusted everywhere.

Klyrek turns a target into a structured, queryable model of its attack surface, then gets out of the way so you can start testing.

Before Klyrek

Three tools, three formats, one afternoon lost to reconciling them.

workflow.sh

# three separate tools, three separate outputs
crawler --target target.example.com > urls.txt
jsfinder --target target.example.com > endpoints.json
headercheck target.example.com >> notes.md
# now reconcile all three by hand

With Klyrek

One command, one model, ready to query or export.

recon.py

from klyrek_cli.pipeline import run_scan
from klyrek_report.json_export import render_json

result = run_scan("https://target.example.com")

print(len(result.endpoints), "assets discovered")
open("report.json", "w").write(render_json(result))

Why this exists

An automated tool that respects the boundary you draw.

Every module checks scope before it acts. AuthorizationScope only allows requests to hosts you've explicitly declared, including every redirect hop, not just the URL you typed.

A scan can't wander onto infrastructure you didn't authorize, even by accident. This isn't a setting you can forget to turn on, it's enforced at the HTTP client level, inside every package that makes a request.

That includes the redirect chain. If an authorized host redirects to infrastructure you didn't declare, the request is refused before it ever reaches that host, not logged after the fact.

terminal

$ klyrek crawl https://target.example.com

target.example.com redirects to
cdn-mirror.example ...

ScopeViolationError: 'cdn-mirror.example'
is not an authorized target. Add it
to the scan's AuthorizationScope
before targeting it.

Built for scale

Trusted to run unattended.

Klyrek is designed to sit inside a CI job or an internal recon pipeline just as comfortably as a laptop terminal.

Respectful pacing

Per-host rate limiting applies to every request, including redirect hops, so a scan never outpaces what you configured.

Modularity

Run the full pipeline or a single package. Nothing is bundled that you didn't ask to install.

Tested, not just typed

269 tests across 14 packages, mypy-clean, and verified against real authorized targets, not just unit-tested in isolation.

Scope enforcement

Every request, including every redirect hop, is checked against the scope you declared. Out-of-scope hosts are refused, not just logged.