Self-hosted external attack surface management for one organization. Limes keeps an inventory of the domains, hosts, IPs, ranges and ASNs you own, discovers new ones continuously, scans them with a fixed, quiet pipeline, turns what it finds into a risk score, and tells you when something changes.

Active testing only ever runs against assets confirmed as owned; everything else gets passive checks. See the roadmap.

The scan pipeline is fixed on purpose: amass + subfinder → dnsx → naabu → nmap → httpx → katana + gau → vigil → mantis. There is no per-tool plug-and-play; see Scope and safety.

git clone https://github.com/TyrusRC/limes && cd limes
sudo ./install.sh          # -n for non-interactive

install.sh creates .env from .env.example with fresh random secrets and memory limits sized to the host. Review it before continuing, and set PGBOUNCER_TAG to a tested edoburu/pgbouncer tag. Compose refuses to start while it is empty.

Limes is then served over plain HTTP at http://localhost:8082, on this machine only (LIMES_BIND=0.0.0.0 and LIMES_BIND6=:: in .env serve other hosts, and LIMES_HTTP_PORT changes the port; the IPv6 loopback is published too because localhost resolves to it first on many hosts). TLS is optional: make certs, then make up HTTPS=1, and Limes is also at https://<host> (443, LIMES_HTTPS_PORT). Every container runs under the compose project limes (docker compose ps). Create the first admin user with make username.

Settings are environment variables in .env. The ones you are most likely to touch:

Chat channels (Slack, Discord, Telegram, Lark) are set up in the portal under Notification Settings.

Scans query free, keyless sources; none of them contacts your targets. Feeds are downloaded once per publisher cadence, never redistributed, and shown with their credit and date on the Overview:

Shodan InternetDB is free for non-commercial use; commercial use needs a Shodan enterprise license, and its terms are only partly published. Limes throttles itself to one request per second, shares that limit across all workers, and stays inside the daily budgets above. Range and ASN enumeration is therefore off by default: turn it on with LIMES_RANGE_ENUMERATION=true once you have checked the terms for your use. IPv6 prefixes are recorded but not walked address by address.

• Owned only. Active scans, port scans and the light monitor touch only assets you own. Ranges that are private or reserved are refused when you add them and again at every step.
• Safe contact. Before Limes connects to a host it resolves the name once, refuses it if any answer is a private, loopback, link-local or cloud-metadata address, and then connects only to the address it checked, so a name that changes its answer mid-check cannot redirect traffic. Certificates are always verified against the hostname. The checks do not use HTTP(S)_PROXY.
• Fixed toolset. vigil runs by absolute path with a minimal environment and a PATH that holds only approved tools (nuclei). Before every scan it lists what it can see and refuses to run if anything else is visible, because vigil would use any of its supported external tools it finds (including exploitation tools such as sqlmap). To approve another tool, change VIGIL_TOOL_ALLOWLIST and the Dockerfile step together; read the notes in web/limes/integrations/vigil.py first.
• Lookalikes: DNS, RDAP and CT only; HTTP only with LIMES_LOOKALIKE_HTTP, which tells the lookalike's operator someone is watching. A lookalike is never an asset: nothing scans, crawls or monitors it, and "This is ours" only opens the add-asset form for you to confirm. Lookalike names are shown as text, never links.
• Untrusted data. Finding names, hostnames, banners and logs come from the hosts you scan and are escaped everywhere they are shown.

• The first scheduler ticks after an upgrade that links existing owned roots to scan targets scan every previously unlinked root, one per tick and at most two at a time, so expect a burst of scan activity.
• manage.py reclassify_roots converts old hostname rows that are really registrable roots (for example example.co.uk). It is idempotent and logs every change. Run it once after upgrading.
• Scheduled tasks monitor_assets and enumerate_ranges run on the io queue; the scheduler locks live in Redis. So do the new refresh_feeds, generate_lookalikes, lookalike_tick and hibp_sync, poll_ct_api (every 60 s; it only calls Cert Spotter when LIMES_CERTSPOTTER_API_KEY is set) and the drain-events tick (monitor_assets with events_only, every 15 s), which drains the event-driven check queue.
• The first run of each new feed and the first lookalike sweep of each root are silent baselines: they record what exists and send no alerts. IP reputation, exposed AI services, the leak checks, open cloud storage, dangling-DNS takeover, the MTA-STS/TLS-RPT/BIMI checks and dangling name servers are provisional: they appear as issues but do not change any score.
• Tags are now per project. The migration copies each existing global tag into every project that used it, and keeps names that cannot be normalised as tag-<id>. APIs are a new asset kind (api); they are found from OpenAPI/Swagger documents on owned hosts and are never scan targets.
• Removed: the PDF scan report, the local LLM service (make up LLM=1), the LLM toolkit and stored OpenAI/Netlas/Chaos keys, wordlist upload, Swagger docs, the recon notes and the WHOIS and domain-info pages. Their tables are dropped by migrations. Discord alert state is stored as JSON instead of pickle.
• Removed: the old results pages (Subdomains, Endpoints, Vulnerabilities, the per-scan detail page), the Targets and Organizations pages, subscans, scheduled scans from the UI, the interesting-lookup keywords and the country lookup of IP addresses. Start a full scan (port scan, crawl, vigil, mantis) with Full scan on an owned root on the Assets page, or POST /api/action/asset/fullscan/; one scan runs per project at a time. A finding's evidence is in the Issues modal, the top-bar search covers assets and issues, and Scan History lists runs with Stop. The tables for organizations, interesting-lookup keywords, search history, countries and subscans are dropped by migrations. The scan-detail links in old in-app notifications now open Scan History.
• The scan pipeline no longer reads or writes the Subdomain and EndPoint tables, and the migrations drop them. The hosts of a scan are hostname assets (each stamped with the scan that saved it); the URLs a scan probed are listed in endpoints.jsonl in its results folder, which the screenshot, crawl, vigil and nmap stages read. Probe and screenshot results go straight onto the host asset. New and missing hosts are change alerts, so the separate "Subdomain changes" chat message is gone (its toggle in Notification settings now does nothing). A finding's tags, CWE ids and reference links are stored on the finding itself (CVE ids stay linked rows); the migration copies the existing ones, and get_vulnerability and the Issues evidence return the same data as before. The per-scan subdomain and endpoint counts are gone from the scan bar. Links in chat notifications use LIMES_PUBLIC_SCHEME (default http). Per-scan URL files exist only for scans run after this upgrade.
• The DAST tool is installed from TyrusRC/vigil. Rebuild the image (make build) to pick up the vigil binary.
• The certificate watch is off by default. make up REALTIME=1 with LIMES_CT_WATCH=true starts it and downloads about 157 GB/day (inferred, not measured); read docs/realtime.md first.

Built and merged: inventory and discovery, continuous tracking of added assets, the risk score and checks, change alerts, waivers, notes and the fix forecast, a native MCP server (Streamable HTTP and stdio, personal API tokens; see docs/mcp.md), and the portal in light and dark themes. The Overview shows the score by category, exposure, certificates, technologies, remediation, discovery, coverage, top risks and what changed, plus IP reputation and data leakage cards (provisional) and a Brand card. Discovery and reputation are built too: feeds, KEV/EPSS markers, AI-service and leak checks, optional breach data, and the lookalike review queue. Asset tags with per-tag scores and API discovery (provisional checks) are built. Near-real-time monitoring is built too (opt-in certificate watch, event-driven checks, DNS change detection, live Overview); see docs/realtime.md.

Report vulnerabilities privately; see .github/SECURITY.md.

Apache License 2.0. See LICENSE.