Tblue

Tblue is a free, open-source CLI security scanner built for website owners and developers who want to understand what their site exposes — without needing a security background. It runs entirely on your machine, requires no account or API key, and never uploads findings. The project is maintained by Taylan Nuhoğlu and published on PyPI under the MIT license.

What It Is

Tblue is a blue-team-only web security scanner: it reads what your site sends back and reports what an attacker would learn from it, without modifying anything or brute-forcing credentials. The 582 default passive modules run in parallel using a ThreadPoolExecutor (default 50 workers), issuing only GET and HEAD requests. A further 32 opt-in modules are split into a "probe" tier (12 side-effect-free checks like GraphQL introspection and CORS reflection) and an "active" tier (20 intrusive checks including authentication attempts and injection payloads, intended only for systems you own).

Scanner Coverage

The 614 total modules span a wide range of web security categories:

• TLS and Transport — certificate validity, cipher weakness, HSTS, compression oracle
• HTTP Headers — CSP with dangerous-value detection, CORS, Permissions-Policy, X-Frame-Options, 30+ checks
• Cookies — HttpOnly, Secure, SameSite, cookie prefixes, partitioned cookies
• Authentication — JWT algorithm confusion, session fixation, MFA detection, WebAuthn
• Authorization — IDOR, broken object-level auth, mass assignment, path traversal
• OAuth and Identity — PKCE, redirect URI validation, SAML signature wrapping, OIDC nonce
• Injection — SSTI, XXE, LDAP injection, CRLF injection, command injection patterns
• Supply Chain — SRI validation, dependency confusion signals, polyfill hijacking
• Cloud — public S3 buckets, K8s API exposure, Docker daemon, CI/CD secret leakage
• Compliance — PCI-DSS, HIPAA, SOC 2, ISO 27001, NIST CSF mapped to root security controls
• Browser APIs — 78 checks covering WebUSB, WebBluetooth, WebXR, Payment Request, Geolocation

Full scanner reference with CWE mappings and remediation guidance is in SCANNERS.md.

Output Formats and CI Integration

Tblue produces terminal output with colored PASS/WARN/FAIL results and a letter grade (A+ to F) plus a numeric score (0–100). Additional output formats include HTML reports with fix instructions, JSON for dashboards and pipelines, SARIF for GitHub Code Scanning and VS Code, and SIEM exports for ArcSight CEF, Elastic SIEM, Splunk SPL, Sigma detection rules, and Microsoft Sentinel KQL.

A GitHub Actions integration (taylannuhogluofficial-png/Tblue@v2) lets teams gate pull requests on findings: --fail-on high returns exit code 1 on any high-severity finding, while --fail-below N blocks score regression. SARIF output can be uploaded to GitHub's Security tab for inline PR annotations.

MCP Integration

Tblue ships a built-in MCP server, making it usable as a native tool for AI assistants like Claude. Once connected via claude mcp add or Claude Desktop config, the AI gains three tools: scan (run any modules against a URL with auth support), list_modules (search available scanners by keyword or category), and explain_module (get plain-language explanations of what a scanner checks and how to fix findings). Scan categories include authentication, cors, csp, tls, oauth, ssrf, secrets, graphql, supply_chain, and more.

Update: Version 2.0.1

The current release is 2.0.1, available on PyPI. Version 2.0.0 fixed a credential-scoping bug where --cookie/--header/--bearer/--auth values were attached to a shared HTTP session that also reached third-party lookup services. Version 2.0.1 further fixed a redirect-scoping issue where those values and the cookie jar could follow a redirect off the target host. The README explicitly warns users who ran authenticated scans on 1.0.0, 1.0.1, or 2.0.0 to rotate their credentials. The project is actively maintained with a test suite of 6,741 tests, five of which are property-based tests enforcing the README's core safety claims.