RedLens

Deep Attack Surface Scanning

Automated analysis across seventeen coordinated modules — security headers, TLS, authentication flows, APIs, CORS, cloud configuration drift, input validation, cryptography, dependency risks, sensitive file exposure, DNS reconnaissance, email authentication (SPF/DKIM/DMARC), admin endpoint discovery, information disclosure, technology fingerprinting, HTTPS enforcement, and row-level security testing — so one run mirrors the breadth a red team would cover manually.

AI-Powered Reasoning Engine

Instead of dumping raw findings, RedLens synthesizes evidence the way an experienced tester would: hypothesizing likely weaknesses, validating them with targeted probes, and explaining why each issue matters in the context of your app.

Validated Exploit Chains

Confirmed vulnerabilities are stitched into realistic escalation stories with safe, detection-oriented validation — showing how an attacker could chain smaller issues into meaningful impact rather than leaving you with disconnected alerts.

Deep Reconnaissance

RedLens inspects what is publicly reachable: JavaScript bundles, authentication patterns, shadow APIs, and environmental clues that traditional scanners often skip — all while keeping workloads on RedLens-controlled infrastructure.

Self-Improving Detection

The platform is built to expand coverage as new attack patterns emerge, rolling forward-looking detection modules without waiting for a monolithic scanner release cycle.

Pentest-Grade Reports & Fixes

Deliverables read like consultant output: severity, CWE references, concrete evidence, affected URLs, and AI-authored remediation snippets you can adapt directly in your editor.

MCP & CLI Integrations

Install the local MCP server with `npx @redlens/mcp-server` for IDE and terminal workflows, or attach remote MCP inside hosted AI chats. Documentation and remote endpoints are published alongside the web app so security checks stay inside the tools engineers already use.

Safe-by-Design Operations

Scans emphasize non-destructive probes, rate limits, logging, and cleanup guarantees so production-adjacent testing stays predictable for operators who cannot afford noisy or invasive tooling.

RedLens pairs broad automated reconnaissance with an AI reasoning layer that behaves more like a pentester than a checklist. It connects validated findings into exploit chains, explains impact in context, and ships remediation snippets — not just isolated alerts.

You add a domain, verify ownership with a meta tag, and RedLens runs recon from its own infrastructure. Roughly two minutes of module collection is followed by AI analysis, chain building, and prioritized remediation guidance — all without installing an agent on your servers.

Each scan exercises seventeen coordinated modules spanning headers, TLS, authentication, APIs, CORS, cloud misconfiguration, sensitive files, dependencies, cryptography, email authentication records, DNS reconnaissance, admin discovery, information disclosure, fingerprinting, HTTPS policy, row-level security testing, and related edge cases surfaced during analysis.

No. RedLens emphasizes detection-only payloads, rate limiting, logging, and cleanup so production systems see the same class of traffic they would from a careful external assessment — not exploit development against live data stores.

Install the published MCP package locally with `npx @redlens/mcp-server` to drive scans from Cursor, Claude Code, JetBrains, Windsurf, Gemini CLI, and other MCP-capable tools. Remote MCP is also available for hosted AI chats; see the RedLens documentation for the latest remote endpoint (for example https://redlens.nurallabs.com/mcp).

RedLens is a web application. Visit https://redlens.langelogic.com to sign up, manage domains, launch scans, and read reports. There are no iOS or Android apps — mobile browsers work for monitoring, but the product is intentionally web-first.

Yes. The public site advertises a free tier that includes the full seventeen-module reconnaissance experience so teams can evaluate coverage before upgrading.

Application security engineers, platform teams, and developers who need continuous external visibility into internet-facing properties — especially when they want AI-assisted narratives, exploit chain validation, and editor-native workflows without standing up their own scanner farm.