The scanner is open source. The service is the convenience.

Run it yourself

With Node.js 22 or newer:

npx perimetry yourdomain.com
npx perimetry yourdomain.com --html report.html
npx perimetry --file domains.txt --diff --fail-on high

The command-line tool keeps its own history in a local SQLite file and prints what changed since the last run. A GitHub Action runs it on a schedule and opens an issue when a new high or critical finding appears. An MCP server lets you ask Claude to audit a domain and explain the findings.

Why we chose the AGPL

The AGPL lets anyone use, study, modify and redistribute the scanner, including commercially, as long as modified versions offered as a service publish their source too. It keeps the checks auditable by the people they are run against, which we think a security tool owes its users, and it keeps improvements flowing back. The list of subdomain-takeover fingerprints is published separately under the MIT licence so that other tools can reuse it without conditions.

What the hosted service adds

• Scheduled audits from our servers, so nothing runs on yours.
• Ownership proof, so alerts only go to the people who own the domain.
• Two years of history, change tracking and a score graph per domain.
• Alerts by e-mail, Slack, Discord, ntfy or webhook, routed per client.
• Client workspaces and reports with your logo, for agencies.
• A support address answered by the people who write the checks.

If the command-line tool is enough for you, use it; it will stay complete. Perimetry Cloud exists for the people who would rather not run anything.

Contributing

Issues and pull requests are welcome on GitHub. A new check needs a test against the fake network used by the test suite, a line in the changelog, and an entry in the finding reference of the README. Vulnerabilities in the scanner itself go to security@perimetry.cloud, not to the public tracker.