# Tblue

> Passive blue-team security scanner with 582 read-only modules and 32 opt-in probes that runs locally with no accounts or telemetry required.

Tblue is a free, open-source CLI security scanner built for website owners and developers who want to understand what their site exposes — without needing a security background. It runs entirely on your machine, requires no account or API key, and never uploads findings. The project is maintained by Taylan Nuhoğlu and published on PyPI under the MIT license.

## What It Is

Tblue is a blue-team-only web security scanner: it reads what your site sends back and reports what an attacker would learn from it, without modifying anything or brute-forcing credentials. The 582 default passive modules run in parallel using a `ThreadPoolExecutor` (default 50 workers), issuing only GET and HEAD requests. A further 32 opt-in modules are split into a "probe" tier (12 side-effect-free checks like GraphQL introspection and CORS reflection) and an "active" tier (20 intrusive checks including authentication attempts and injection payloads, intended only for systems you own).

## Scanner Coverage

The 614 total modules span a wide range of web security categories:

- **TLS and Transport** — certificate validity, cipher weakness, HSTS, compression oracle
- **HTTP Headers** — CSP with dangerous-value detection, CORS, Permissions-Policy, X-Frame-Options, 30+ checks
- **Cookies** — HttpOnly, Secure, SameSite, cookie prefixes, partitioned cookies
- **Authentication** — JWT algorithm confusion, session fixation, MFA detection, WebAuthn
- **Authorization** — IDOR, broken object-level auth, mass assignment, path traversal
- **OAuth and Identity** — PKCE, redirect URI validation, SAML signature wrapping, OIDC nonce
- **Injection** — SSTI, XXE, LDAP injection, CRLF injection, command injection patterns
- **Supply Chain** — SRI validation, dependency confusion signals, polyfill hijacking
- **Cloud** — public S3 buckets, K8s API exposure, Docker daemon, CI/CD secret leakage
- **Compliance** — PCI-DSS, HIPAA, SOC 2, ISO 27001, NIST CSF mapped to root security controls
- **Browser APIs** — 78 checks covering WebUSB, WebBluetooth, WebXR, Payment Request, Geolocation

Full scanner reference with CWE mappings and remediation guidance is in `SCANNERS.md`.

## Output Formats and CI Integration

Tblue produces terminal output with colored PASS/WARN/FAIL results and a letter grade (A+ to F) plus a numeric score (0–100). Additional output formats include HTML reports with fix instructions, JSON for dashboards and pipelines, SARIF for GitHub Code Scanning and VS Code, and SIEM exports for ArcSight CEF, Elastic SIEM, Splunk SPL, Sigma detection rules, and Microsoft Sentinel KQL.

A GitHub Actions integration (`taylannuhogluofficial-png/Tblue@v2`) lets teams gate pull requests on findings: `--fail-on high` returns exit code 1 on any high-severity finding, while `--fail-below N` blocks score regression. SARIF output can be uploaded to GitHub's Security tab for inline PR annotations.

## MCP Integration

Tblue ships a built-in MCP server, making it usable as a native tool for AI assistants like Claude. Once connected via `claude mcp add` or Claude Desktop config, the AI gains three tools: `scan` (run any modules against a URL with auth support), `list_modules` (search available scanners by keyword or category), and `explain_module` (get plain-language explanations of what a scanner checks and how to fix findings). Scan categories include `authentication`, `cors`, `csp`, `tls`, `oauth`, `ssrf`, `secrets`, `graphql`, `supply_chain`, and more.

## Update: Version 2.0.1

The current release is **2.0.1**, available on PyPI. Version 2.0.0 fixed a credential-scoping bug where `--cookie`/`--header`/`--bearer`/`--auth` values were attached to a shared HTTP session that also reached third-party lookup services. Version 2.0.1 further fixed a redirect-scoping issue where those values and the cookie jar could follow a redirect off the target host. The README explicitly warns users who ran authenticated scans on 1.0.0, 1.0.1, or 2.0.0 to rotate their credentials. The project is actively maintained with a test suite of 6,741 tests, five of which are property-based tests enforcing the README's core safety claims.

## Features
- 582 passive read-only security scanners
- 32 opt-in probe and active modules
- Parallel scanning with ThreadPoolExecutor (50 workers)
- HTML, JSON, SARIF, CEF, Elastic, Splunk, Sigma, Sentinel output formats
- GitHub Actions integration with severity and score gates
- Built-in MCP server for AI assistant integration
- Browser-powered scanning via Playwright for SPA and DOM XSS
- Authenticated scans via cookie, bearer token, or basic auth
- Continuous monitoring mode with configurable intervals
- Local scan history with diff against previous run
- Compliance modules for PCI-DSS, HIPAA, SOC 2, ISO 27001, NIST CSF
- No accounts, no telemetry, no credential uploads
- Docker support
- MITRE ATT&CK technique mappings
- CWE mappings and remediation guidance per finding

## Integrations
GitHub Actions, GitHub Code Scanning (SARIF), Claude (MCP), Claude Desktop (MCP), ArcSight (CEF), QRadar (LEEF), Elastic SIEM, Splunk, Microsoft Sentinel, VS Code Problems panel, Playwright, crt.sh, OSV, NVD, Docker

## Platforms
MACOS, WEB, API, VSC_EXTENSION, CLI

## Pricing
Open Source

## Version
2.0.1

## Links
- Website: https://github.com/taylannuhogluofficial-png/Tblue
- Documentation: https://github.com/taylannuhogluofficial-png/Tblue/blob/main/SCANNERS.md
- Repository: https://github.com/taylannuhogluofficial-png/Tblue
- EveryDev.ai: https://www.everydev.ai/tools/tblue