A checklist can't refute itself.

Subfinder → Naabu → HTTPX → web discovery → Nmap, orchestrated end to end. Maps the attack surface (subdomains, open ports, live web, service versions) into one structured profile.

Live origins are only the front door. A discovery stage crawls the app including its JavaScript, mines archived URLs, reads any published OpenAPI spec, and probes for undocumented query parameters. That parameterised surface is where server-side weaknesses actually live.

The assessment pass has to separate exposure it observed from misconfiguration it inferred, cap its own confidence on anything read off a banner or an open port alone, and keep unproven conditions out of finding titles. Most false positives are a language problem; the engine is not allowed to write the sentence.

Every scan is projected into a persistent graph: hosts, services, web endpoints and the edges between them. The agent reasons over this graph instead of treating each finding in isolation, and the attack-path pass reads the findings together with that graph rather than each finding on its own.

A separate reasoning pass combines individually-low findings into multi-step attack paths. Chaining is reasoning about candidate routes, not proof, and "no genuine chain here" is a valid and common answer.

After each pass the agent decides whether one more focused scan wave is worth it. Observe, orient, decide, act, under a hard step budget, with every decision audited. It is built to stop itself.

Seven of the thirteen probe classes run on their own against the findings that matter: known-CVE versions, exposures, misconfiguration, subdomain takeover, TLS, anonymous FTP and open DNS resolvers. A match badges the finding CONFIRMED; a probe that disproves it badges REFUTED, and that stays on the record too.

Six further classes touch the application actively: default credentials, XSS, SQL injection, open mail relay, open redirect and CORS. These are never dispatched automatically. The agent proposes them, an operator approves each one, and approval mints a single-use token bound to that exact target and class.

Mark a finding a true positive, a false positive, or needs-review. Your verdict supersedes the agent's, drops the finding out of the exported report, and the agent's original row stays on the record for audit.

Export any assessment as a downloadable PDF: prioritized findings with their evidence, impact and remediation, written up in plain prose. The deliverable you can hand to a client or drop into a ticket, generated on demand. Not a compliance sign-off.

A grounded chatbot on every assessment. Ask which findings are confirmed, or walk through the highest-impact path, and Thoth answers from the scan’s own data, citing it, read-only, and never inventing a finding or launching a new scan.

A deeper prover for logic flaws a template cannot reach: SSRF, IDOR and BOLA, BFLA, and authentication bypass. Integrated and operator-gated. It has not yet returned a verdict on a production target, so nothing on this site is badged CONFIRMED by it. Named here because it is real, not because it has earned a claim.

Scope-bound, approval-gated, audited proof of impact that chains a confirmed weakness through to a demonstrated outcome. This is the roadmap: more capability, one at a time, never an unsupervised attacker.