Every host, credential, and finding from your pentest, in one place.
During an engagement you run dozens of tools. Their output scatters across terminals, files, and windows. Correlating it, recalling findings, and feeding one tool's output into the next all depends on discipline and memory.
Alpha captures everything your tools produce, parses it into structured data, and puts it all on a shared server where the whole team can search it, see it on a graph, and pull it back into the next command.
- Silent capture - Prefix any command with
al run. It runs exactly as you typed it. No injected flags, no extra files on disk, no footprint changes. - 30+ tool parsers - nmap, netexec, nuclei, gobuster, ffuf, impacket, hydra, hashcat, and more. Raw output is always stored, even for tools without a parser.
- Entity graph - Hosts, services, credentials, identities, findings, and shares, all linked and deduplicated. Interactive graph with attack path visualization.
- Team server - Multi-operator with role-based access (admin / operator / read-only) and optional MFA.
- Credential management - Collected creds are masked by default. Reveal is audited. Pipe them directly into tools:
al loot --reveal --format user:pass. - Reports - Build a report from your findings, export to Markdown or PDF, or push to SysReptor.
- Offline spool - If the server is unreachable, runs queue locally and sync when it comes back.
- Full-text search - Search across all raw output, even for tools Alpha doesn't parse.
Operator box(es) Self-hosted server
┌──────────────────────┐ HTTPS/JSON ┌─────────────────────────────────────┐
│ al collector (Go) │ │ Fastify API (Node/TS) │
│ • PTY run primitive │ ────────────▶ │ • ingestion • auth/tokens │
│ • shell auto-capture│ │ • parser pipeline │
│ • local spool │ │ • query API • realtime (SSE) │
│ • al query (pull) │ ◀──────────── │ Postgres + object store │
└──────────────────────┘ └──────────────┬──────────────────────┘
React + Vite SPA (web UI)
Requirements: Docker and Docker Compose.
git clone https://github.com/shoamshilo/alpha-security.git
cd alpha-security/deploy
cp .env.example .env
# Edit .env: set POSTGRES_PASSWORD, ALPHA_JWT_SECRET, ALPHA_TOTP_ENCRYPTION_KEY
docker compose -f docker-compose.prod.yml up -dCreate the first admin:
docker compose -f docker-compose.prod.yml exec server \
node dist/main.js cli create-admin \
--email admin@yourfirm.com --password YourPasswordOpen http://localhost in your browser. See the full deployment guide for TLS, backups, and configuration.
Requirements: Node 20+, pnpm, Go 1.22+, Docker (for Postgres).
pnpm install
cd deploy && cp .env.example .env && docker compose up -d # Postgres
pnpm --filter @alpha/server dev # API server
pnpm --filter @alpha/web dev # Web UI (localhost:5173)
cd collector && go build -o al ./cmd/al # Collector binaryDownload the prebuilt binary from the latest release, or build from source:
cd collector && make buildEnroll and start capturing:
./al enroll --server http://your-alpha-server --token <token>
./al run nmap -sV 10.0.0.1
./al query host --format ips | netexec smb -
./al loot --reveal --format user:pass| Path | What | Stack |
|---|---|---|
contracts/ |
Wire + entity schema (single source of truth) | JSON Schema / TS |
collector/ |
The al CLI that captures tool output and ships it |
Go |
server/ |
Ingestion + parsing + query API + realtime | Node, Fastify |
web/ |
Self-hosted web UI | React, Vite |
deploy/ |
Docker Compose, migrations, env templates | - |
docs/book/ |
Documentation (synced to GitBook) | Markdown |
Full documentation at docs.alpha-security.app.
Alpha is source-available under the Business Source License 1.1. Free for non-commercial use. The license converts to Apache 2.0 on July 18, 2029. See the LICENSE file for details.
See CONTRIBUTING.md for setup and how to submit a PR.
To report a vulnerability, see SECURITY.md.