Zero to a real scan in about a minute
JED CO-OP is a hosted service. The Kali tools, the agent and the storage all run on our infrastructure — your browser is the control surface. There is nothing to download, install, licence or patch on your side.
Create an account
Sign up at /auth and confirm your email. The Free plan starts at 2 concurrent scans and 7 scans a day — no card. You can also skip this entirely and use the anonymous sandbox.
Pick a target you are authorised to test
Enter a domain, host or URL you own or have written permission to assess. The platform rejects its own infrastructure and private ranges, but authorisation is your responsibility.
Run a tool
Open /tools, choose a tool, set its real flags in the form and press start. Output streams back live over SSE — pause, resume and stop are all wired to the actual process.
Read it, then export it
Findings land in tables and charts, the AI writes the analysis, and every run exports to JSON or CSV. Reports come out as Markdown, JSON or PDF.
What you need
- A modern browser. Chrome, Edge, Firefox or Safari — nothing else to install.
- A target with authorisation. See responsible use.
- An account for persistence. History, workspaces, AI chat and saved evidence need a sign-in; the public sandbox does not.
Where things live in the interface
- Top bar — workspaces. Open several pages side by side, switch instantly, reload one without disturbing the others.
- Sidebar — Dashboard, Kali Armory, Autonomous, Pentest Console, J3D Eye, Chat and your account settings.
- /tools — the armory index: search, install status, free vs premium, and a link into every tool page.
- /ai-premium — plans, live limits and billing.
- The autonomous page — talk or type an intent ("scan example.com with nmap and nikto") and let the agent plan, execute and report.
dnsrecon or Amass scans a day
with no sign-up at all — the fastest way to confirm the engine is real before you register.
Next: what the platform does · the full tool list · terms of service
Security tooling that actually runs
JED CO-OP is an independent, engineering-led security outfit. We build the JED CO-OP Security Platform — an autonomous security operations console that we build and operate as a hosted service, so a team can use the whole tool chain without standing up and maintaining its own Kali box.
We started from a simple frustration: the market is full of products that describe what they
would do. A language model will happily explain how to run nmap; it will not run it, stream
the output, parse it into hosts and open ports, and write the finding up. JED closes that gap. The
platform executes real tools against real targets, under real guardrails, and turns the results into
something a human can act on.
What we believe
- Show, don't tell. Every capability can be demonstrated live before you pay for anything — the sandbox on the home page runs a genuine scan, not a recording.
- Your data stays yours. Scan output, evidence and findings are stored against your account alone, isolated per user, and exportable or deletable by you at any time.
- Agency with guardrails. Autonomy is only worth having if it is bounded — by scope, by time, by concurrency and by explicit authorisation.
- No theatre. If a feature cannot work, we do not ship a placeholder for it.
From a one-line intent to a written report
The platform covers the whole path of a technical security engagement: reconnaissance, enumeration, exploitation, forensics, evidence handling and reporting.
Reconnaissance & OSINT
DNS and subdomain enumeration, port and service discovery, attack-surface mapping across certificate transparency and open intelligence sources.
Vulnerability assessment
Web application scanning, template-driven detection, content discovery, fuzzing and parameter-level testing — with severity-triaged findings.
Forensics & evidence
Disk-image and folder evidence handling, deleted-file recovery, file carving, timeline reconstruction and hash-verified chain of custody.
Pentest management
Engagements, assets, findings, CVSS scoring, evidence upload, team collaboration and exportable reports mapped to OWASP/PTES/NIST.
Autonomous operations
An agent that decomposes a request into tool tasks, executes them, monitors progress and consolidates the result into an operation report.
Voice control
Hands-free operation: speech-to-text, agent reasoning and text-to-speech reply, plus peer-to-peer WebRTC calls between operators.
Who it is for
- Penetration testers and red teams who want one console for the tool chain.
- Small security teams replacing a folder of shell scripts and a spreadsheet of findings with a shared, reportable workflow.
- SOC and DFIR analysts who need defensible evidence handling without enterprise pricing.
- Students and CTF players learning on a real tool chain rather than a simulation.
- Engineers and analysts who want one hosted console instead of building and maintaining a Kali box, a script folder and a spreadsheet.
How the system is built
This is the architecture of the service you sign in to. It is a deliberately small, single-deployment application: one Flask application served by Gunicorn behind nginx, with SQLite and the filesystem as its only stores. There is no message broker, no separate worker fleet and no external database — you operate none of it; we do, and the stack below is what runs behind your sign-in.
/static directly, enforces upload limits and reverse-proxies everything else.server.py hosts the core app and page routes; each tool ships as its
own module (*_enhanced.py) registered at boot; core/ holds
cross-cutting services — auth, premium gate, scan limits, email, validation, sandbox guards.os.replace) and a file lock,
so concurrent workers cannot corrupt state.Design decisions worth knowing
| Concern | How it is handled |
|---|---|
| Multi-tenancy | Every route resolves the caller first and then checks ownership of the resource by id. Scan registries, uploads and outputs are per-user directories; a request for another user's artefact is rejected, not filtered. |
| Concurrency | A file-backed slot registry enforces per-plan concurrent-scan limits across workers and across restarts, with a heartbeat TTL so a crashed scan cannot hold a slot forever. |
| Long-running tools | Scans are launched asynchronously and tracked by id; the HTTP request returns immediately and the browser subscribes to the event stream. |
| Zero-downtime deploys | A restart controller performs a Gunicorn USR2
hand-off: the new generation boots, serves and is verified stable before the old one is stopped.
If verification fails, the old generation keeps serving. |
| Failure isolation | A circuit breaker bounds agent runs by turns, tokens and wall-clock time; stalled provider connections fail fast instead of pinning a thread. |
36 integrated tools, one interface
Each tool is wrapped in its own backend module with a consistent contract: typed inputs, command validation, a live event stream, parsed results, export, and a history registry that survives restarts. Nothing is a mock-up — if a tool is listed as enabled it runs the real binary on the server.
Network & port scanning
DNS & subdomain recon
Web application testing
Injection & exploitation
Credentials & passwords
OSINT & attack surface
Forensics & post-exploitation
Live visual intelligence
What every tool wrapper guarantees
- Real execution. A tool marked enabled is installed on the host and invoked for real.
- Live output. Console output streams as it is produced, with structured events for findings, records and progress alongside the raw lines.
- Structured results. Parsed into tables you can sort, inspect and export (JSON/CSV), not a wall of text.
- History. Runs are registered on disk, so they survive restarts and can be reviewed or re-exported later.
- Safety. Targets are validated, and every network tool refuses to scan the platform's own host or any address that resolves to it (see Security model).
- Bounded work. Wall-clock limits, concurrency slots and output caps keep any single scan from monopolising the server.
An agent that executes, not advises
The agent is a tool-using loop, not a chat window. Given an intent — "map the external attack surface of this domain and report the notable findings" — it does the following:
- Plans. The request is decomposed into an ordered task list over the tool registry.
- Selects. Only the tools relevant to the task are placed in context, which keeps prompts inside provider token budgets and reduces cost.
- Executes. Tasks run through the same backend APIs the UI uses, so an agent scan is identical to a manual one — same validation, same limits, same audit trail.
- Monitors. Progress is polled and reported while tools run; long scans stream into an in-app console.
- Consolidates. Results are parsed and summarised into a written operation report with the tools used, the findings and recommended next steps.
Guardrails
- Per-user and global session caps, with a pool that supersedes a running plan when a new one starts.
- A circuit breaker on turns, tokens and wall-clock time.
- Destructive or irreversible actions are staged and require explicit confirmation.
- Every action is written to an activity log tied to the account that requested it.
Voice pipeline
The agent can be driven by voice. Speech is transcribed server-side, passed to the agent for reasoning, and the reply is synthesised back to audio. Calls between operators use WebRTC with the media flowing peer-to-peer and end-to-end encrypted via DTLS-SRTP — the server relays only the signalling, never the media. In-call controls include mute, camera toggle, screen share and a screenshot capture that can be attached to a conversation.
How we protect the platform and its data
A security product is judged by its own security. These are the controls in place across the platform.
| Area | Control |
|---|---|
| Passwords | Stored as salted PBKDF2-HMAC-SHA256 hashes (100,000 iterations). Plaintext passwords are never written to disk or logs. |
| Sessions | Signed JSON Web Tokens plus a server-side session record, carried as cookies/tokens and validated on every request. |
| Two-factor auth | Optional per-user email 2FA, verifiable and revocable by an administrator. |
| Authorisation | Roles (user/administrator) plus per-tool entitlements. Every privileged endpoint checks the role server-side — the UI is never the gate. |
| Tenant isolation | Per-user filesystem namespaces and ownership checks on every artefact route (scans, uploads, evidence, exports, chats). |
| SSRF & self-scan | Network tools validate targets and refuse loopback, private, link-local and cloud-metadata ranges, the platform's own hosts, and any hostname that resolves to them. |
| Path safety | File-serving routes resolve real paths and confirm they stay inside the intended directory; uploads are size-capped and type-checked. |
| Uploads | Files are served as attachments unless they are a known-safe media type, with sandboxing headers, so a malicious upload cannot execute on-origin. |
| Forensics | Evidence handling is read-only by default, with write-blocker checks and hash-verified chain of custody for anything you recover. |
| Rate limiting | Per-plan request and scan limits, plus tight limits on authentication and password-reset endpoints. |
| Secrets | API keys and SMTP credentials are never returned by read endpoints; admin secrets are write-only from the UI's perspective. |
| Auditability | Authentication events, tool runs, scans and administrative actions are recorded with the acting account and timestamp. |
Where your information lives
Your data is stored on the host we operate: SQLite databases and directories on the service's filesystem, keyed to your account. You can export it in standard formats or delete it from the account pages, and deletion removes the stored artefacts as described in the Privacy Policy.
| Category | What it contains | Typical retention |
|---|---|---|
| Account | Username, email, password hash, 2FA state, role, plan | While active, then removed with the account |
| Scan data | Targets you entered, raw tool output, parsed findings, exports | Until you delete them; sandbox scans 7 days |
| AI context | Prompts, responses, conversation history used for continuity | Until you delete the conversation |
| Uploads | Files, evidence and case attachments you add | Until you delete them |
| Billing | Plan, status, invoice references — never card data | As required for tax/accounting |
| Technical logs | Errors, activity/audit trail, rate-limit counters | Short-lived, rotated |
| Sandbox visitors | Anonymous session id and IP, used only for scan quotas | Days, then purged |
Full detail — including legal bases, third-party processors, cookies and your rights — is in the Privacy Policy.
How the hosted service is run
JED CO-OP is delivered as a hosted service — there is no supported self-hosted distribution at this time. The platform is one service: the application (Gunicorn + Flask), a reverse proxy, TLS at the edge, and the Kali tools we install and maintain. This section documents the operational properties that produce the behaviour you see in the interface.
Operational properties
- Atomic state. Configuration and registries are written with atomic replaces, so an interrupted write cannot leave the app half-configured.
- Graceful restarts. The restart controller boots the new generation and verifies it is stable before retiring the old one, so configuration and code changes do not drop requests.
- Backups. Because state is SQLite plus directories, a consistent backup is a copy of those paths — nothing exotic is required.
- Tool prerequisites. Each tool module reports whether its binary is present, so the UI shows an honest "not installed" state instead of failing at run time.
- Cleanup. Background jobs purge expired sandbox usage, orphaned scans and stale evidence so disk usage stays bounded.
Authorised testing only
By using the platform you agree to:
- Obtain and keep written authorisation that defines scope, timing and permitted techniques before running anything against a target.
- Respect the boundaries of that authorisation — no scope creep, no testing of third-party systems linked from a target, no denial-of-service techniques unless explicitly agreed in writing.
- Handle anything you find with care: minimise access, do not exfiltrate data you do not need, and report findings to the owner.
- Comply with the law and with any applicable rules of engagement, embargo or disclosure timeline.
- Accept that you are responsible for your own actions. We provide tooling; you provide the authorisation and the judgement.
The platform enforces what it can technically — target validation, self-scan protection, sandbox limits and audit logging — but authorisation is a human responsibility that no software can fully police. The full, legally reviewed wording lives in the Terms of Service, which you accept when you create an account.
Frequently asked
Is the sandbox on the home page a demo or a real scan?
Real. It executes an actual dnsrecon or Amass subdomain-enumeration pass on our server
against the domain you enter, streams the output live, and analyses the results. It is rate-limited
to two scans per visitor and five per network per day so it cannot be abused.
Do I need to install the Kali tools myself?
No. The enabled tools are already installed, versioned and maintained on our side. Each tool page reports the version it is running, and a tool that is unavailable shows an honest status instead of failing at run time.
Where does the AI run? Do you train on my data?
Reasoning is performed by third-party AI providers reached over HTTPS. We do not train models on your content, and only the context required for the request is sent to the provider. Scan output, evidence and conversations stay on our server, scoped to your account, and are covered by the retention rules in the Privacy Policy.
Can I export my work?
Yes. Scan results, findings and extracted data export to JSON and CSV (and PDF for reports), and case evidence is downloadable. You are never locked in.
How many scans can I run at once?
Concurrent scans depend on your plan — 2 on Free, 4 on Student, 6 on Pro and 15 on Teams — and the limit is enforced globally, not just in the browser.
Is there an API?
Every capability in the interface is backed by an HTTP API, and scans run asynchronously by id. Teams plans include full API access with rate limits.
What happens to my data if I delete my account?
Your account record, conversations and stored scan artefacts are removed. Billing records are retained where tax or accounting law requires it. See the Privacy Policy for detail.
Talk to us
Questions about the architecture, a security report from your own testing, a question about the service or a commercial enquiry — reach out. We read everything and generally reply within one business day.
Security disclosure
Found a vulnerability in the platform? Email us with steps to reproduce before disclosing publicly — we will acknowledge and credit responsible reports.