FofaMap

Why we included this project

FofaMap is for security teams that want FOFA's asset search to produce something they can trace back to evidence. You can run classic FOFA queries from a plain CLI with no model involved, or hand a natural-language reconnaissance request to an agent that plans several queries and refines its approach based on real hit counts before writing an asset brief that separates high-confidence findings from candidates and noise. The same interface is available over MCP and as a Skill, so AI coding tools can drive it, and there is a REST API for custom integrations. When a scan is needed, FofaMap only proposes a plan; the targets, templates, and severity levels need a one-time human approval before the scan is handed to Nuclei. That approval gate keeps automated scanning under control, and because the deterministic code handles the querying and export while the agent only plans and summarizes, failures show up as real errors instead of being hidden as empty results.