SecSuite Brings OSINT, Web Scanning, API Testing, and Local AI Analysis Into One Open-Source Tool

SecSuite is an open-source security toolkit that combines OSINT reconnaissance, web vulnerability scanning, API security testing, reporting, scheduling, SIEM integration, and AI-assisted analysis in one Python-based platform.

The tool is available through the TheSecuredAnalyst security-suite repository. Its README describes SecSuite v0.1.0 as a unified suite with 11 OSINT modules, 6 web scanners, 4 API security tools, REST API access, scheduled scans, and AI-powered analysis through Ollama, Anthropic, and OpenAI.

The project targets security teams, penetration testers, red teams, and developers who want one command-line workflow for reconnaissance, web scanning, API checks, and report generation. It also supports local AI analysis through Ollama, which allows sensitive scan data to stay inside the operator’s environment.

SecSuite v0.1.0 Is an Early Alpha Security Toolkit

SecSuite is currently positioned as an early-stage project. The package metadata in pyproject.toml lists version 0.1.0, requires Python 3.10 or newer, and marks the project with Development Status 3, Alpha.

The tool ships under the AGPL-3.0 license, which matters for teams that plan to modify it or expose it as a service. The same project metadata lists its audience as information technology and places the tool under the security topic.

SecSuite’s main pitch is consolidation. Instead of switching between separate tools for DNS checks, WHOIS lookups, port scans, web scans, API tests, CVE searches, SIEM forwarding, and AI-generated summaries, users can run those jobs from a single CLI or API surface.

Area	What SecSuite covers	Relevant tools or integrations
OSINT	DNS, WHOIS, subdomains, ports, headers, email discovery, tech detection	nmap, Shodan, VirusTotal
Web scanning	Crawling, XSS, SQL injection, directory checks, SSL/TLS checks, template scanning	Nuclei
API testing	OpenAPI parsing, BOLA/IDOR, auth tests, JWT checks, fuzzing	CLI and REST API
AI analysis	Finding correlation, summaries, remediation guidance, security questions	Ollama, Anthropic, OpenAI
Operations	Reports, scheduling, SIEM forwarding, webhook delivery	Splunk, Elasticsearch, Syslog, Slack, Discord, PagerDuty

Local AI Is One of SecSuite’s Main Differentiators

SecSuite supports three AI provider paths. Teams can run local models through Ollama, or they can use cloud-based providers through Anthropic and OpenAI keys.

The local option is important for security testing because reports, scan findings, hostnames, internal service names, API paths, and remediation notes can contain sensitive information. With Ollama, SecSuite can analyze findings without sending that context to an external AI service.

The README also documents AI commands for target analysis, executive summaries, finding correlation, remediation reports, and interactive remediation. The most operationally useful command is secsuite ai remediate, which scans a target and walks the operator through suggested checks, fixes, and verification steps.

API Security Testing Focuses on OpenAPI and OWASP Risks

SecSuite’s API module reads OpenAPI or Swagger specifications and then tests discovered endpoints. The project’s API testing flow includes spec discovery, parsing, full API scans, auth checks, and fuzzing.

This aligns with common API risk areas from the OWASP API Security Top 10, including broken object level authorization, broken authentication, unrestricted resource consumption, security misconfiguration, and unsafe API consumption.

The tool’s API checks are split across endpoint testing, authentication testing, and fuzzing. Endpoint checks cover BOLA and IDOR-style access control problems, injection flaws, mass assignment, and information disclosure. Auth checks cover bypass scenarios, broken authentication, JWT weaknesses, missing expiration claims, and rate-limiting gaps.

• secsuite api scan runs tests against an OpenAPI or Swagger specification.
• secsuite api fuzz sends boundary values, malformed input, and injection payloads.
• secsuite api auth-test focuses on authentication and token-related weaknesses.
• secsuite serve exposes the same workflow through a FastAPI-based REST server.

Web Scanner Covers Common Application Weaknesses

The web scanner module covers crawling, XSS checks, SQL injection tests, directory brute force, SSL/TLS analysis, and Nuclei template scanning. In the README demo, an SSL scan flags SSLv3 support as a high-severity issue because it can expose systems to POODLE-style attacks.

The web module does not replace a full commercial DAST platform, but it gives testers a quick way to run common checks during early reconnaissance or internal assessments. It also helps small teams combine several basic tests in one repeatable workflow.

Because SecSuite can also export results and generate AI-assisted reports, web findings can move from raw scanner output into more readable summaries for engineering or leadership audiences.

SecSuite Also Supports SIEM and Recurring Scans

SecSuite includes SIEM forwarding, webhook delivery, and scheduled scans. The repository describes support for Splunk, Elasticsearch, Syslog, Slack, Discord, and PagerDuty integrations, along with CEF and LEEF-style output for security operations pipelines.

The architecture uses a CLI built with Typer, a REST API built with FastAPI, a shared core layer for target modeling and exporters, and separate scanning modules. The SecSuite repository also lists exports in JSON, CSV, HTML, and Markdown.

For teams that already have CI/CD or security orchestration systems, the REST API can make SecSuite easier to plug into existing workflows. Users can start the API server with secsuite serve, run scans through HTTP endpoints, and fetch results programmatically.

Installation Uses Setup Scripts, but Teams Should Test Carefully

The project includes setup scripts for Linux, macOS, and Windows. The README says the setup process can install Python dependencies, Ollama, and a local AI model, while optional flags can skip AI setup or extra tools such as nmap and SearchSploit.

On Windows, the setup instructions run from PowerShell without administrator privileges, although the README notes that users without winget may need to install some requirements manually. On Linux and macOS, users can run bash setup.sh, choose a different model, skip Ollama, or skip optional extras.

The package configuration shows dependencies including httpx, Rich, Typer, Pydantic, dnspython, BeautifulSoup, python-whois, Shodan, aiohttp, PyYAML, python-nmap, and requests. Optional AI dependencies include OpenAI and Anthropic SDKs.

Who Should Use SecSuite

SecSuite is best suited for authorized security testing, internal assessments, lab environments, and teams that want a modular open-source workflow for early reconnaissance and validation.

Security teams should not treat it as a finished enterprise platform yet. Its alpha status means users should test it in controlled environments, review generated commands before running them, and avoid scanning systems without permission.

The tool is still notable because it brings several useful workflows into one place. It covers discovery, web checks, API testing, AI summaries, remediation guidance, scheduling, and SIEM output, while also supporting local models for privacy-sensitive environments.

API security has become a major testing priority, and SecSuite’s focus on OpenAPI-driven checks gives it practical value for teams building or reviewing modern services. The OWASP API Security list gives useful context for why checks like BOLA, authentication testing, rate limiting, and mass assignment detection matter.

FAQ