General crawlers hand you HTML. valxcan-crawler hands you the attack surface others miss — JS-runtime endpoints, hidden routes, wasm strings — then verifies vulnerabilities instead of guessing, and emits LLM-ready markdown for the AI asking the harder questions.
// scope: self-contained, single binary · zero-dep HTTP + CDP browser · authorized testing only
Every row below is a run artifact — vulnerable lab + an identical secure twin, so every single result is a true positive or a true negative. There is no self-reported number on this page.
Firecrawl-class extraction is the floor. The point of valxcan-crawler is what a scraper structurally cannot do.
Captures the JS-runtime surface a plain HTTP crawl is blind to — via a zero‑dep CDP browser — plus wasm strings, route-grammar synthesis and wordlist-free verification. Finds routes dictionaries never will.
Statistical timing (Welch t, jitter-proof), self-hosted OAST with token correlation and stale-drop, two-account IDOR/BFLA, content-oracle LFI, offline JWT. A finding only counts when the evidence confirms it.
De-boilerplated markdown with absolute links — firecrawl-style extraction — plus findings as structured JSON. Built to feed an AI-VAPT layer, not just a report.
# discover the API surface npx vcrawl crawl https://target/ --browser # extract any page to LLM-ready markdown npx vcrawl extract https://target/ --site --out docs/ # full battery → graded markdown report npx vcrawl vapt https://target/ --token … --admin … → writes vapt-report.md
No scanner daemon, no heavy runtime download, no saas key. Install once, point it at your authorized target, and the report + the markdown bundle are yours to run an agent on.
What your agent needs: a mapped attack surface, the clean content around it, and findings that are provable — all in one tool.
The attack surface a general crawler misses.
Clean page content + links your model can follow.
Timing, OAST, two-account access — each with evidence.