Crossfyre Toolchain

256 stars
Apache-2.0
Active this week
Last commit today

Last verified Oct 28, 2026

Run authorized security testing from one CLI: five scan engines for subdomain enumeration, port scanning, content discovery, and vulnerability scanning.

Visit website GitHub256

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Crossfyre Toolchain is for#

Bug Bounty Hunters Running External Recon

voyage maps an organization's DNS namespace from passive sources and wordlists; doorward then scans discovered hosts for open ports and service banners; ambulo fuzzes paths to surface hidden endpoints. The full external footprint of a target is visible without switching tools between stages.

Skip if:

Your scope is a single web application with a known URL and no subdomain work. ambulo and plessor alone cover most of that workflow; the additional engines add setup overhead without adding relevant findings.

Penetration Testers on Authorized Engagements

plessor runs nuclei-compatible templates with confirm-before-report behavior, cutting the false-positive cleanup pass before a finding goes into the report. toolmark fingerprints services first so plessor's templates target what is actually running, which improves the hit rate on active checks.

Skip if:

Your engagement requires a GUI-first workflow with a Repeater, Comparer, and annotated session files you share with a team. Burp Suite Pro's collaboration and session-annotation features are more mature for that workflow.

Red Teams Coordinating Multiple Hosts

The optional Crossfyre platform layer turns any host into a recon node with crossfyre node init, with pacing tuned per target and a shared dashboard. Multi-host scans run distributed without custom orchestration scripts; the same five engines run on each node under the control plane.

Skip if:

Your work always runs on a single machine with a local scope. The platform layer is entirely optional; the five engines work without it. Fleet management and team dashboards add no value for single-node use.

Security Developers Building Automated Test Pipelines

Every engine writes newline-delimited JSON when piped or redirected and exits non-zero on error. plessor and toolmark finish a single target in seconds, so they fit inline in a CI-adjacent script checking that a web service does not expose known vulnerabilities or outdated software versions.

Skip if:

Your testing target requires authenticated session replay with macro recording and session-handling rules. Burp Suite Pro's macro and session-handling features are better suited for authenticated web application testing than a CLI pipeline.

the problem

The problem it solves#

Running a full recon-to-exploitation workflow in a security engagement means coordinating five or more separate tools with no shared state. Subdomain tools write to their own output format, port scanners produce separate reports, content discovery runs independently, and vulnerability scanners operate in their own workflow. The result is a pipeline held together by shell scripts or manual copy-paste between stages, with no consistent output format and no way to resume a scan interrupted mid-run.

The cost compounds the problem. Burp Suite Pro starts at $449/year per seat and covers web application scanning but not network recon or subdomain discovery. Tenable Nessus starts around $4,000/year and targets continuous asset management rather than point-in-time penetration testing. Most practitioners end up paying for one commercial tool and assembling free tools for the rest, accepting fragmentation as the price of covering all recon stages.

how Crossfyre Toolchain solves it

How it solves it#

Five Integrated Scan Engines

voyage enumerates subdomains from passive DNS sources and wordlists; doorward scans host ranges and ports with service detection; ambulo fuzzes paths, parameters, and virtual hosts; toolmark fingerprints software versions and flags CVE leads by version; plessor runs active vulnerability checks using nuclei-compatible templates and an injection engine, confirming each finding before it reports it.

Checksum-Verified Package Manager

The CLI installs, updates, and removes scan engines via crossfyre extension install, verifying every binary's SHA-256 against a signed release manifest before installation. No unsigned binary runs. crossfyre update all refreshes both the CLI and every installed engine from the same manifest.

Resumable Scans via Local Postgres State

voyage, doorward, and ambulo save findings to a local Postgres container as they run. A scan stopped mid-run resumes from its last checkpoint on restart. Long subdomain enumerations and large network sweeps do not need to restart from scratch after an interruption.

Newline-Delimited JSON Output for Scripting

Every engine writes newline-delimited JSON when its output is piped or redirected, one event per line, exiting non-zero on errors. Output feeds directly into jq, grep, or a custom reporting script with no format conversion between stages. toolmark and plessor finish a single target in seconds and print JSON by default.

Nuclei-Compatible Templates in plessor

plessor runs active vulnerability checks using nuclei-compatible templates alongside a native injection engine for injection and authorization classes. Each finding is confirmed before it reaches output, reducing the false-positive cleanup pass before a finding goes into a client report.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Apache 2.0 with No Per-Seat LicensingThe CLI and all five engines are Apache 2.0 licensed and free to run on your own infrastructure. Unlike Burp Suite Pro at $449+/year per user or Tenable Nessus starting around $4,000/year, there is no annual renewal and no limit on the number of machines that run the toolchain.
Full Recon Cycle Without Tool SwitchingThe five engines cover every stage from subdomain discovery through vulnerability confirmation, all managed by a single package manager. Findings persist in a shared local database, so doorward's port scan results feed into toolmark's fingerprinting and plessor's vulnerability checks without manual export or format conversion.
Confirmation Before Reporting in plessorplessor confirms each vulnerability finding before it reports it, using both nuclei-compatible templates and a native injection engine. Active confirmation reduces false positives from template-only runs, cutting the cleanup pass before a finding reaches the report.
Wordlist Isolation Protects Daemon AccessEngine daemons restrict wordlist reads to a fixed set of directories (for example, /usr/share/seclists on Linux) and refuse requests naming arbitrary file paths. The CFX_WORDLIST_ROOTS variable extends the allowed set. This limits the blast radius of an exposed daemon listener on a non-loopback address.

Trade-offs

-Docker Required for Scan StateAll five scan engines persist state to a local Postgres container managed by the CLI. Docker must be installed and running before any node initializes. Minimal environments without Docker cannot run stateful features such as resumable scans; the CLI's doctor command diagnoses whether Docker and the database container are reachable.
-Open Build Lacks First-Party FeaturesA source build or binary from the Releases page is the open build. The installer delivers the first-party build, which adds authorization checks, per-node egress isolation, tuned adaptive pacing, and a browser-fingerprint transport. These features are not in the open build and are not configurable from source.
-macOS Source Build Requires Specific PythonBuilding cfx-script from source on macOS requires Python 3.10 or later. The Xcode command line tools ship Python 3.9, so PYO3_PYTHON must point to a separate 3.10+ install. Binary installs from the installer or Releases page have no such requirement; this caveat only affects contributors building from source.

versus alternatives

Crossfyre Toolchain vs alternatives#

Crossfyre Toolchain vs Burp Suite Pro

Burp Suite Pro is the dominant commercial tool for web application security testing, used by professional penetration testers worldwide. The overlap with Crossfyre is most direct in content discovery (ambulo covers path fuzzing similar to Burp's scanner) and vulnerability confirmation (plessor's active checks run analogously to Burp's active scan). Burp Suite Pro costs from $449/year per user and has no self-hosted open source path.

Feature	Crossfyre Toolchain	Burp Suite Pro
License	Apache-2.0	Proprietary
Self-hosting	Yes	No
Subdomain enumeration	Yes (voyage)	No
Network port scanning	Yes (doorward)	No
Content discovery	Yes (ambulo)	Yes (scanner)
Vulnerability scanning	Yes (plessor)	Yes
Pricing	Free	$449+/year/user

Crossfyre Toolchain covers the full recon cycle that Burp Suite Pro does not, including subdomain enumeration and network scanning. It is the better choice for bug bounty hunters and red teams who need a complete CLI-driven recon pipeline without per-seat licensing. Burp Suite Pro remains stronger for interactive HTTP manipulation, GUI-based session annotation, and teams who need a mature Repeater and Comparer in a collaborative workflow. Crossfyre's Workbench desktop proxy provides a Repeater, Decoder, and Comparer, but it is newer and requires a paid plan for scope and findings features.

Crossfyre Toolchain vs Nessus

Tenable Nessus is the benchmark for enterprise vulnerability scanning, starting around $4,000/year. Nessus targets continuous vulnerability management across network assets; plessor targets active exploit confirmation on a defined scope during a penetration test. The workflows differ: Nessus is a continuous monitoring tool while Crossfyre is a point-in-time testing toolchain.

Crossfyre is the better choice for authorized testing engagements on a defined scope where the goal is confirming exploitable findings before they go into a report. Nessus is the better choice for ongoing vulnerability management across a full network estate, compliance reporting, and environments where GUI-based remediation tracking and asset inventory matter.

install · quick start

Quick start#

bash

Install on Linux or macOS with the setup script; Docker is required before running any scan engine.
```bash
curl -fsSL https://get.crossfyre.io/install.sh | sudo bash
```

tech stack · detected from GitHub

What it's built on#

Languages: KotlinPythonRust

frequently asked

FAQ#

Does Crossfyre Toolchain require an account to use?

No. The five scan engines run fully offline without a Crossfyre account. The optional platform layer (crossfyre login and crossfyre node init) adds distributed node management and team dashboards, but running the engines locally with no login is the default mode. The engines and local commands run without a session.

Is Crossfyre Toolchain free for commercial use?

Yes. The CLI and all five scan engines are Apache 2.0 licensed, which allows commercial use, modification, and redistribution. The optional Crossfyre platform service (distributed nodes, scheduled scans, team dashboard) is a separate service with its own terms; the toolchain itself imposes no commercial restriction.

What is the difference between Crossfyre Toolchain and Burp Suite Pro?

Burp Suite Pro is a GUI-focused web application security tool with an intercepting proxy, Repeater, and active scanner. Crossfyre Toolchain is a terminal-first pipeline covering subdomain enumeration, network scanning, and vulnerability confirmation. Burp Suite Pro does not include subdomain or port scanning. Crossfyre's Workbench desktop proxy provides a Repeater, Decoder, and Comparer, but scope and findings require a paid plan; Burp's GUI tooling is more mature for interactive session work.

Does Crossfyre Toolchain require Docker?

Yes, for stateful scan features. The scan engines persist findings to a local Postgres container that the CLI manages via Docker. Docker must be installed before running crossfyre node init. The engines can start as standalone daemons using crossfyre db up for the container, but Docker itself remains a prerequisite. The crossfyre doctor command diagnoses whether Docker and the database container are reachable.

What platforms and architectures does Crossfyre Toolchain support?

The engines run on Linux (x86-64 and ARM64), macOS (Intel and Apple Silicon), and Windows (x86-64). Prebuilt binaries with SHA-256 checksums are available on the Crossfyre install page and the GitHub Releases page. The installer checks the release manifest's signature before installing any binary. An apt repository is also available for Debian, Ubuntu, and Kali Linux.

also worth a look

Similar open-source tools#

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

390,785 GitHub stars
Licence MIT

Oya Browser

Alternative toBrowserbase

Records portal tasks once; replays with no model and no bot detection

355 GitHub stars
Licence Sustainable Use License 1.0

FlClash

Alternative toShadowrocket

Ad-free Clash Meta proxy client for Android and desktop, GPL-3.0.

58,816 GitHub stars
Licence GPL-3.0

Promptfoo

Alternative toBraintrust

Automated LLM evals, red teaming, and AI vulnerability scanning.

26,422 GitHub stars
Licence MIT

Unkey

Alternative toKong Konnect

Unified API keys, gateways, and observability for developers.

5,476 GitHub stars
Licence FSL-1.1-ALv2

WebCheck-OSINT

Alternative toShodan

44-check OSINT scanner for DNS, SSL, ports, CVEs, and TLS audits

346 GitHub stars
Licence MIT

by category

Open source tools in these categories#

141

12,826 GitHub stars
Licence AGPL-3.0
#Email

Omnara

Alternative toClaude Managed Agents

Open-source agent deployment API. Self-host or use Omnara Cloud.

3,296 GitHub stars
Licence Apache-2.0
#AI Agents

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

5,914 GitHub stars
Licence Apache-2.0
#AI Agents

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Crossfyre Toolchain vs Burp Suite Pro

Feature	Crossfyre Toolchain	Burp Suite Pro
License	Apache-2.0	Proprietary
Self-hosting	Yes	No
Subdomain enumeration	Yes (voyage)	No
Network port scanning	Yes (doorward)	No
Content discovery	Yes (ambulo)	Yes (scanner)
Vulnerability scanning	Yes (plessor)	Yes
Pricing	Free	$449+/year/user

Who Crossfyre Toolchain is for#

Bug Bounty Hunters Running External Recon

Skip if:

Penetration Testers on Authorized Engagements

Skip if:

Red Teams Coordinating Multiple Hosts

Skip if:

Security Developers Building Automated Test Pipelines

Skip if:

The problem it solves#

How it solves it#

Five Integrated Scan Engines

Checksum-Verified Package Manager

Resumable Scans via Local Postgres State

Newline-Delimited JSON Output for Scripting

Nuclei-Compatible Templates in plessor

Strengths and trade-offs#

Strengths

Trade-offs

Crossfyre Toolchain vs alternatives#

Crossfyre Toolchain vs Burp Suite Pro

Crossfyre Toolchain vs Nessus

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

Find open source alternatives to paid software

Who Crossfyre Toolchain is for#

Bug Bounty Hunters Running External Recon

Skip if:

Penetration Testers on Authorized Engagements

Skip if:

Red Teams Coordinating Multiple Hosts

Skip if:

Security Developers Building Automated Test Pipelines

Skip if:

The problem it solves#

How it solves it#

Five Integrated Scan Engines

Checksum-Verified Package Manager

Resumable Scans via Local Postgres State

Newline-Delimited JSON Output for Scripting

Nuclei-Compatible Templates in plessor

Strengths and trade-offs#

Strengths

Trade-offs

Crossfyre Toolchain vs alternatives#

Crossfyre Toolchain vs Burp Suite Pro

Crossfyre Toolchain vs Nessus

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

Find open source alternatives to paid software