Security testing, reconnaissance, OSINT, and offensive security — unified in one remotely accessible platform.
Instead of installing, configuring, and maintaining dozens of separate security tools and their dependencies locally, you access the capabilities through Nyxeara. Your device is the interface. Nyxeara is the remote cybersecurity environment.
$ nyx target add example.com $ nyx recon example.com $ nyx scan example.com $ nyx findings list
You do not build a cybersecurity workstation before doing security work. Your device is the interface. Nyxeara is the security environment.
Application security, reconnaissance, OSINT, offensive security, security intelligence, and automation live in one environment on one evidence model.
Findings enter as CANDIDATE and reach VALIDATED only after independent verification playbooks produce tamper-evident evidence with lineage.
The same platform is reachable from a browser, a terminal, a REST API, and structured agent access through MCP.
One platform for modern security operations.
Nyxeara brings multiple security workflows into one environment. Application security, reconnaissance, OSINT, offensive security, security intelligence, and automation share the same data, the same evidence model, and the same orchestration.
- DAST
- Web application testing
- API testing
- Crawling
- Vulnerability detection
- Active testing
- Verification
- OAST
- Evidence
- Asset discovery
- DNS intelligence
- Subdomain discovery
- Service discovery
- Technology identification
- Endpoint discovery
- Attack-surface mapping
- Username intelligence
- Domain intelligence
- Email intelligence
- Organization research
- Repository intelligence
- Documents and public sources
- Infrastructure intelligence
- Reconnaissance workflows
- Enumeration
- Web security testing
- Security tooling
- Attack-surface analysis
- Verification workflows
- Chained investigations
- Findings
- Evidence
- Assets
- Relationships
- Investigation state
- Verification state
- Reports
- CLI
- API
- MCP
- Webhooks
- Workflows
- Programmatic execution
Stop assembling the security environment before doing the security work.
The traditional workflow requires installing and maintaining the full toolchain before a single test runs. Nyxeara inverts that.
- 01Operating system
- 02Security tools
- 03Dependencies
- 04Configurations
- 05Wordlists
- 06Browsers
- 07Individual scanners
- 08Separate outputs
- 09Manual correlation
- 10Verification
- 11Reporting
- 01Target
- 02Nyxeara
- 03Security capabilities
- 04Orchestration
- 05Verification
- 06Evidence
- 07Findings
Your device is the interface. Nyxeara is the security environment.
One platform. Multiple interfaces.
Browser, CLI, API, and MCP are interfaces to the same underlying platform — the same investigations, findings, evidence, and operations. Not four separate products.
Full Nyxeara security workspace from a browser.
consoleinvestigationsfindingsevidence
Remote security operations from a terminal with Internet access.
nyx target add example.comnyx recon example.comnyx scan example.comnyx findings list
Programmatic access for applications, automation, and infrastructure.
GET /api/investigationsPOST /api/investigationsPOST /api/investigations/[id]/dast-scan
Structured access for compatible AI agents.
capabilities.listinvestigation.createfinding.verifyevidence.get
Give agents access to the security environment.
AI agents can interact with Nyxeara through MCP without having to locally install and configure a large cybersecurity toolchain. The agent interacts with high-level security capabilities rather than having to understand every underlying tool.
Illustrative example of the agent-native flow.
An agent describes a security objective. Nyxeara selects the appropriate capabilities and orchestrates the work.
Workspaces keep target, scope, findings, evidence, artifacts, and operation history in one context an agent can resume.
Operations declare impact and authorization. Scope is enforced server-side, never trusted from the client.
From discovery to verified finding.
Nyxeara is designed around evidence and verification rather than simply dumping raw scanner output. Candidates are independently verified before they become findings.
Evidence over guesses.
A tool's output is a candidate hypothesis. Independent deterministic playbooks verify it, and the recorded evidence with SHA-256 integrity and lineage is what makes it a finding.
Everything connected.
Nyxeara does not treat security results as isolated text. Assets, endpoints, technologies, observations, findings, evidence, and investigations form a connected model.
Domain
└─ Subdomain
├─ IP
│ ├─ Service
│ └─ Application
│ ├─ Endpoint
│ ├─ Parameter
│ └─ Finding
│ └─ EvidenceAssets, endpoints, technologies, observations, findings, and evidence are connected by typed relationships with provenance — so an agent can reason over the environment, not just individual tool results.
Verified against the running platform.
Figures below are read from the live deployment's databases — not marketing estimates. Tools and capability slugs are the real registered identifiers.
registered tool rows in tool_platform.db
controlled capability taxonomy
tool_capability_links rows
registered DAST checks + engine producers
states, with deterministic transitions
deterministic playbooks
One environment for people and agents.
Nyxeara is built for security researchers, developers, security teams, and AI agents.
Reconnaissance, testing, investigation, verification, and reporting from one environment.
Integrate security operations into development and automation workflows via CLI, API, and MCP.
Centralize security operations, findings, evidence, and workflows in one platform.
Access structured cybersecurity capabilities through MCP without installing a local toolchain.
Start free. Pay when it earns its place in your stack.
Honest tiers. Compute metered so you pay for what you actually run. Founding customers get a price lock.
Pro normally $79/mo. Founding price locked at $9/mo.
Free
For exploring Nyxeara.
- Basic DAST engine
- Core vulnerability checks
- Limited security tooling
- Basic reconnaissance
- Basic investigations (2)
- + 2 more
Pro
popularFor professional security research.
- Full DAST engine — 60+ check families
- Full security tool ecosystem (61 registered tools)
- Advanced reconnaissance & discovery
- Investigations + knowledge graph
- Evidence & provenance tracking
- + 8 more
Business
popularFor security teams.
- Everything in Pro
- Team workspaces (5 members)
- RBAC + collaboration
- Shared investigations & assets
- Asset management (1,000 assets)
- + 9 more
Professional
For advanced security operations.
- Everything in Business
- High-volume DAST (2,000 scans/mo)
- Large asset inventories (10,000)
- Advanced Sentinel — active defense
- Deception + honeytokens
- + 10 more
Enterprise
For organizations operating security at scale.
- Everything in Professional
- Custom capacity — scans, workers, storage
- SSO / SAML / SCIM
- Advanced RBAC + organization policies
- Custom integrations & private extensions
- + 7 more
Payment via Gumroad (card) and NOWPayments (crypto).
Full comparison table →What people ask about dynamic application security testing.
Straight answers to the questions that come up most — about DAST, web application security, and what Nyxeara actually does.
Nyxeara is a remotely accessible cybersecurity platform that unifies application security testing, reconnaissance, OSINT, offensive security, security intelligence, evidence, automation, CLI access, API access, and MCP access in one environment.
No. Instead of installing, configuring, and maintaining dozens of separate security tools and their dependencies locally, you access the capabilities through Nyxeara. Your device is the interface. Nyxeara is the remote cybersecurity environment.
From a browser, a terminal (CLI), a REST API, or through structured agent access via MCP. All four are interfaces to the same underlying platform and data.
No. DAST is an important capability, but Nyxeara also covers reconnaissance, OSINT, offensive security, security intelligence, evidence, and automation in one environment.
Findings start as CANDIDATE, move to TESTING, then to VALIDATED only after independent deterministic playbooks confirm with evidence. INCONCLUSIVE_FP and OUT_OF_SCOPE are explicit states. Evidence carries SHA-256 integrity and full lineage.
Yes. AI agents can interact with Nyxeara through MCP, working with high-level security capabilities and stateful workspaces rather than installing a local toolchain.
Start using Nyxeara.
Access the unified cybersecurity platform through the interface that fits your workflow.