Bug-bounty hunters, independent researchers, and pentest and red teams who run distributed reconnaissance, from a solo operator on one box to a boutique shop coordinating a fleet. Larger security labs standardizing large-scale recon programs fit too.

It's a different class of tool. Crossfyre runs open-source Rust engines (you can audit them) purpose-built for distributed execution, then adds what a DIY toolkit can't: authenticated scanning and API authorization testing (BOLA/BFLA/BOPLA), a confirm-before-report vuln engine, hosted zero-setup deployment, a crash-safe control plane where scans survive node failures and resume instead of restarting, a live shared dashboard, proxy and tunnel routing, and Valkyrie, an AI copilot that triages raw output into prioritized findings and proposes the next scan for you to approve. Those projects are scripts you assemble and maintain yourself. Crossfyre is an engineered operations platform. For side-by-side comparisons against Axiom, Burp, StackHawk, 42Crunch and more, see /vs.

Yes, and it's the wedge. Authorization testing runs as a mode inside a scan: it replays each endpoint as every identity (admin, user A, user B, anonymous) and diffs the responses to catch broken object-level (BOLA) and function-level (BFLA) authorization, mass-assignment (BOPLA), and excessive data exposure, each with a confirm-before-report step. Almost no self-serve scanner does this. It's a Pro-tier capability, enforced server-side.

Yes. Crossfyre supports static tokens, form logins, non-interactive OAuth (client-credentials, password), and interactive OAuth authorization-code and SSO/MFA driven by a headless auth broker that logs in and returns only a resolved token. Your raw secrets are encrypted at rest and never transit the message bus. Authenticated scanning is a Pro-tier capability.

Yes, on Android, and without a rooted phone or a PC in the loop. The Crossfyre Tracer app pairs to your workspace by QR and captures the device's own traffic on-device, scoped to the apps you choose. For certificate-pinned apps, where normal on-device capture sees nothing, you tap patch: the phone uploads that app's split APKs, our patch service returns a re-signed build that trusts your session certificate, and it reinstalls. Captured requests land in the same Requests table, intercept gate, and node-backed Repeater as web traffic. For apps you own or are authorized to test.

Start free, no credit card. Paid plans are built for solo operators and small teams, with AI analysis metered as simple credits so heavy usage stays fair. Every price is listed on the pricing page: no sales calls, no quotes. Pro and Reaper include a 7-day free trial.

Nothing is lost. Work is dispatched over a durable, acknowledged work queue, so if a node drops, its in-flight work is automatically redelivered to another node and the scan resumes. Long, multi-hour scans finish even across unstable networks and rate limits.

Your findings are yours. Scan data is isolated per team, encrypted in transit and at rest, and never sold or used to train anything. You can run nodes on your own infrastructure so traffic originates from where you choose. See our security page for specifics.

Captured requests and responses are stored against your workspace so you can search and replay them, and you can wipe a session's captured traffic at any time from the workflow itself. Findings retention follows your plan: 30 days on Free, 90 days on Pro, unlimited on Reaper. App files you upload for patching are processed in a temporary working directory that is deleted when the job finishes, whether it succeeds or fails. We do not keep your APKs, and nothing you capture is used to train anything.

Open-core. The scan engines (voyage, pulse, mach, scout, cortex), the node agent, and the CLI are open source (Apache-2.0) on GitHub, so you can audit exactly what executes on your machines before you run it. Nodes can be self-hosted by anyone: install the node agent on your own VPS, lab, or internal infrastructure and it pulls work from the control plane. The control plane, the adaptive stealth governor, the isolated-egress layer, the authorization oracle, and the credentials broker, plus the Valkyrie AI layer, stay proprietary, developed by Clickswave Labs Private Limited. Self-hosting the full control plane for data-residency or air-gap is planned for enterprise customers.

Yes. Crossfyre is for authorized offensive security work only: engagements you're contracted for, assets you own, or scoped bug-bounty programs. The proxy, VPN-isolation, and mobile patching features exist to model real adversaries during authorized tests and keep traffic in-scope, not to enable unauthorized access.