A senior pentester that tests, proves, and fixes.
Black box from a URL, grey box with logins, white box across your repositories. interopt refuses to report anything it cannot prove against what it actually saw.
Everything under test, in one list.
Every target in one inventory, scored and owned: a URL, an API and the repository behind them sit in the same list rather than in three different tools.
From the first request to the merged fix.
The run, the findings it proves, the tickets they become and the report at the end all sit in one workspace.
Watch a run live, then replay it.
Every scan walks the same four phases: prerequisites, discover, scan and report. The agent's output streams while it works, and afterwards the same view becomes a replay you can scrub.
- Output tagged by phase and container
- Replay at 1×, 2×, 4× or 8×
- The full log, downloadable per run
Every finding opens on its proof.
Description, risk, observation and remediation, in that order. The observation holds the requests that proved it, and the CVSS score opens into the metric-by-metric vector behind it.
- CVSS 3.1 or 4.0, one scale per workspace
- OWASP WSTG test id on web findings
- Re-test one finding without rescanning the asset
The report title is stored as sent and rendered unescaped when the share link is opened:
Opening the link as a second user sent their session to the callback host.
Findings file themselves in your tracker.
Turn on automatic issues when you set up a scan and every finding it proves becomes a linked ticket. The ticket's state comes back onto the finding, so nothing has to be updated twice.
- Jira, Linear, GitHub, GitLab, Datadog and ServiceNow
- Alerts to Slack, Teams or Discord
- Tickets close when a retest proves the fix
A report built from the runs themselves.
Pick the pentest report or the executive summary, choose the scans, and the findings, evidence, scores and scope fill in. Share it as a private link that expires, carries a password and logs every view.
- A notification when someone opens your shared link
- Scheduled reports that follow recurring runs
What each approach actually gives you.
Each of these does one part of the job well. You need all of it — proof, the logic bugs, the file and line, the fix, and the same again on the next release.
Everything around the agent.
Ephemeral environments
Where there is nothing running to test, the agent builds the target from source and tears it down after. Production stays out of scope unless you put it in.
Self-hosted (coming soon)
Running the whole thing inside your own infrastructure, for when the code cannot leave your network.
Any stack it can reach or read
Testing runs against the app as deployed, so the language is never a prerequisite. Connect source and the agent works the frameworks out from the repo.
Give it what you have. Get proof back.
A URL, a set of logins, or the repository itself. interopt tests what it is given, proves what it finds, and with your code connected, opens the pull request that fixes it.