stealthmark-scanner is a zero-dependency, non-destructive Open-Source CLI that audits any public domain against the 100-Point Perimeter & Agentic Readiness Rubric (75 pts Edge Hardening + 25 pts Recon & AI Agent Discovery).
All checks run 100% locally on your machine or CI/CD runner with built-in SSRF and DNS-rebinding protection — zero telemetry, zero remote server load, and zero API keys required.
uvx --from git+https://github.com/stealthmark-io/stealthmark-scanner stealthmark-scanner gateway.stealthmark.io
# Or via pipx:
pipx run --spec git+https://github.com/stealthmark-io/stealthmark-scanner stealthmark-scanner gateway.stealthmark.iogit clone https://github.com/stealthmark-io/stealthmark-scanner.git
cd stealthmark-scanner
python3 stealthmark_scanner.py gateway.stealthmark.io# Output structured JSON report
python3 stealthmark_scanner.py gateway.stealthmark.io --json
# CI/CD Quality Gate: fail the build if score is below threshold (exit code 1 on fail, 0 on pass)
python3 stealthmark_scanner.py gateway.stealthmark.io --fail-under 85 --json| Category | Check | Max Points | What it Verifies |
|---|---|---|---|
| Edge (75) | HTTPS & HSTS | 15 | TLS reachability + Strict-Transport-Security max-age verification |
| Edge (75) | Content-Security-Policy | 15 | Active CSP without unsafe-eval |
| Edge (75) | Anti-Clickjacking | 10 | X-Frame-Options (DENY/SAMEORIGIN/ALLOW-FROM) or CSP frame-ancestors |
| Edge (75) | MIME Nosniff | 10 | X-Content-Type-Options: nosniff |
| Edge (75) | Referrer-Policy | 10 | Origin referrer isolation (penalizes unsafe-url) |
| Edge (75) | Banner Suppression | 15 | Zero version leakage in Server / X-Powered-By |
| Recon (25) | Dotfile & Git Exposure | 15 | Ensures /.env and /.git/HEAD are blocked (SSRF-hardened, SPA catch-all safe) |
| Recon (25) | Agentic SEO & A2A Manifests | 10 | Presence of /llms.txt, /.well-known/agent.json, /openapi.json |
When your AI coding/security agent needs formal SMT/Z3 mathematical proofs (ERC-4626 vault rounding, Polymarket Dutch-book arbitrage, ZK circuit constraints, or differential consensus equivalence), connect directly via AgentCash / x402 v2:
npx agentcash try https://gateway.stealthmark.io
npx @agentcash/discovery https://gateway.stealthmark.io -vReleased under the MIT License. Built for defensive security engineering, DevSecOps CI/CD gates, and autonomous agent safety research.
Responsible Use Notice: This tool is designed strictly for authorized defensive security audits, perimeter validation, and automated CI/CD posture checking of infrastructure you own or have explicit authorization to evaluate.