Attack Surface Dashboard
Overview
Attack Surface Dashboard is a self-hosted, AI-augmented vulnerability management platform built for penetration testers and security teams. It ingests output from a broad range of scanners, normalises it into a finding model, and then layers AI analysis, deduplication, and reporting on top — all behind a multi-tenant web UI with role-based access.
Designed to replace the spreadsheet-driven post-engagement workflow with something that feels like a proper SOC-grade product, just lighter and runnable on a single host.
What it does
Scan ingestion (13 parsers)
Nmap · Burp Suite · OWASP ZAP · Nessus · Nuclei · Shodan · and more — drop in any supported export and the parser stack normalises it into the unified Finding model with deduplication and severity mapping.
Live scanning (38 integrations + MCP)
Run scans directly from the UI against 38 built-in scanner integrations, plus arbitrary external tooling via the MCP (Model Context Protocol) server interface — letting Claude/LLM-driven agents call shell tools as first-class actions.
AI engine
- 10 specialist agents for triage, exploitability assessment, and remediation suggestions
- Automatic priority scoring based on severity, asset value, and exploitability
- Ghost Scan — an autonomous chat terminal that runs an LLM decision loop with 66 chat tools to perform recon, enumeration, and follow-up scans without human intervention
Workflow management
- 8-stage finding lifecycle (
new → triaged → confirmed → in-remediation → … → closed) - Assignment, due dates, overdue tracking, MTTR metrics, bulk operations
- Evidence attachments, tags, comments, manual finding creation
- Audit log for every user action (IP, timestamp, action) with a terminal-style admin view
Reporting
One-click multi-format export: PDF · DOCX · HTML · XLSX · CSV with embedded severity charts via ReportLab.
Multi-tenant + auth
- Client isolation with role-based access; a single user can belong to multiple clients
- Account lockout, configurable password complexity, API-key auth for CI/CD pipelines
- Per-user email notifications via SMTP
Dashboard views
| Page | Purpose | |
|---|---|---|
| 1 | Dashboard | Overview stats, severity distribution, top vulns |
| 2 | Attack Surface | D3.js mind-map of targets, ports, technologies |
| 3 | Clients | Client organisation CRUD (admin) |
| 4 | Scans | Upload and manage scan files |
| 5 | Vuln Scanner | Live scanning with 38 integrations + MCP |
| 6 | Findings | Filter, assign, manage findings with overdue badges |
| 7 | Analysis | Run AI analysis and clustering |
| 8 | AI Agents | Multi-agent pipeline monitor with real-time progress |
| 9 | Ghost Scan | Full-page AI chat terminal — autonomous scanning |
| 10 | Reports | Generate / download PDF · DOCX · HTML · XLSX · CSV |
| 11 | Users | User management with lockout status (admin) |
| 12 | Live Ops | Real-time scan monitoring (WebSocket) |
| 13 | Audit Logs | Hacker-themed terminal-style audit trail (admin) |
| 14 | Settings | 8 tabs — API Keys · Scanner · AI · MCP · Tools · Security · Webhooks · Email |
Stack
| Layer | Tech |
|---|---|
| Backend | FastAPI (Python 3.10+) |
| ORM | SQLAlchemy + Alembic migrations |
| Database | SQLite (single-binary deployment) |
| Realtime | WebSockets |
| Reports | ReportLab |
| Frontend | Server-rendered HTML/CSS/JS, D3.js for graph viz |
| AI | Multi-agent LLM pipeline + MCP for tool calls |
| Deploy | Docker / docker compose up -d |
Quickstart
git clone https://github.com/antonytuff/attack-surface-dashboard.git
cd attack-surface-dashboard
# Option A — native
pip install -r requirements.txt
python run.py
# Option B — docker
cp .env.example .env
docker compose up -d
# verify
curl http://localhost:8000/health
Default login: admin / admin123. Then point any supported scanner at the target and import the result file from Scans → Upload.
Why it exists
Existing vulnerability-management tools are either enterprise-priced (Tenable, Rapid7) or shallow CSV viewers. This project compresses what a small pentest team actually needs — parse → analyse → assign → report — into a single Docker container, with an AI layer that turns raw scanner output into prioritised findings instead of a 4-figure-line CSV. Useful for:
- Internal red teams that want a persistent finding store across engagements
- Boutique pentest shops needing automated client deliverables
- Researchers experimenting with agentic offensive AI workflows