Documentation

Everything to install fya, scan your app, and wire it into CI.

fya needs Python 3.9 or newer. The core install pulls only requests and rich.

pip install fya
pip install "fya[apk]"       # Android APK manifest analysis
pip install "fya[browser]"   # headless-browser crawler for SPAs

From a clone, with the test tooling:

git clone https://github.com/ayam04/fya
cd fya
pip install -e ".[dev]"

Point fya at a local server or an APK. Localhost needs no authorization flag.

fya scan http://127.0.0.1:8000
fya scan ./app-release.apk

fya scan http://127.0.0.1:8000 -o report.html   # shareable report
fya scan http://127.0.0.1:8000 --fail-on high    # exit non-zero in CI
fya tools                                         # list detectable external tools

New in v0.6.0: 33 more checks (91 total) and per-check selection. See the changelog for the full history.

Try it against the bundled deliberately-vulnerable app in the repo:

python examples/vulnerable_app.py            # starts on http://127.0.0.1:5001
fya scan http://127.0.0.1:5001 --mode full -o report.html

Prefer to stay in Claude? fya ships as a skill that makes Claude run the same non-destructive scan itself, with no package to install. It confirms you own the target, runs the checks, and reports in the chat.

Install it by copying one folder into your Claude skills directory:

git clone https://github.com/ayam04/fya
cp -r fya/skills/fya ~/.claude/skills/fya

On Windows the destination is %USERPROFILE%\.claude\skills\fya. Then just ask Claude:

scan http://localhost:3000 for vulnerabilities
check ./app-release.apk for security issues

Claude confirms the target and authorization, picks a mode and profile, runs the OWASP-mapped checks, and applies the same false-positive discipline as the CLI. It is fully agentic: it drives the probes with its own tools, so it works even where the package is not installed.

fya detects the target automatically. A path ending in .apk (or any zip containing an AndroidManifest) is analyzed statically. A local directory is treated as source and analyzed white-box. Anything else is a web target; a bare host defaults to http for localhost and private addresses and https otherwise.

fya scan http://127.0.0.1:8000    # web target
fya scan ./app-release.apk        # android package
fya scan ./my-service             # source directory, white-box

A mode selects which family of checks runs. Pick one with --mode, refine with --only and --skip (each accepts a category or a single check id), or choose from a menu with --interactive. List them with fya modes.

A profile sets how hard fya probes, independent of the mode. Request pacing adapts automatically and slows down on errors, timeouts, and slow responses. fya never floods a target or runs denial-of-service payloads.

Scan behind a login, and keep the scan inside a boundary with scope and budget controls.

# authenticated
fya scan https://staging.example.com --i-am-authorized \
  -H "Authorization: Bearer $TOKEN"
fya scan http://127.0.0.1:8000 --cookie "session=abc123"

# scope and budget
fya scan http://127.0.0.1:8000 --include '/app' --exclude '/logout'
fya scan http://127.0.0.1:8000 --max-requests 500

# render JS and single-page apps (needs the [browser] extra)
fya scan http://127.0.0.1:8000 --spa

Record the findings you have accepted, then fail the build only on new ones.

fya scan http://127.0.0.1:8000 --write-baseline .fya-baseline.json
fya scan http://127.0.0.1:8000 --baseline .fya-baseline.json --fail-on high

Format is inferred from the -o extension, or set it with --format. Use --fail-on to return a non-zero exit code.

91 checks across 19 areas, each mapped to the OWASP Top 10 or MASVS and a CWE. Every check runs only at or above its minimum profile.

If any of these are on your PATH, fya runs them and folds their results into one normalized report. If not, it falls back to built-in checks. Check what is detected with fya tools.

The image bundles nmap, so external-tool handoff works out of the box.

docker build -t fya .
docker run --rm --network host fya scan http://127.0.0.1:8000

fya performs active security testing. Only scan systems you own or are explicitly authorized in writing to test. Scanning a non-local target requires --i-am-authorized. Scans are non-destructive by default, with no flooding and no denial-of-service payloads. You are responsible for how you use this tool.

fya is dual-licensed. It is free for noncommercial and personal use under the PolyForm Noncommercial License 1.0.0, which covers hobby projects, research, education, personal study, and nonprofit or government use.

Commercial use requires a paid license. That means using fya in, or for, a for-profit company's products, services, or internal operations. To obtain one, contact ayamullahkhan04@gmail.com. Versions before 0.5.0 were released under the MIT License and remain available under those terms.