Pinned Tweet
Meet 0x41. We build open-source AI tools that turn raw security data into answers you can act on. Two tools so far 🧵
Monomi: give it a domain and it maps subdomains, hosting, open ports, web tech, and security headers. It’s passive by default, and the AI report cites the evidence behind every finding, so you’re never guessing where a claim came from.
Kaidoku: give it CVEs and it ranks them by urgency, flags ones tied to ransomware campaigns (via CISA KEV), and explains real-world impact in plain English, tailored to your stack.
They work together: feed Monomi’s output into Kaidoku and every CVE keeps the host it was found on. Both are MIT licensed on GitHub. 0x41.sh
Monomi v1.9.2 is out.
Most recon tools stop at a list of hostnames. But the person who has to fix things doesn't need a list. They need a report: what's wrong, who owns it, and what to fix first.
This release is about making Monomi usable by someone other than me.
Report exports
--export all saves every scan three ways:
→ HTML: one self-contained page. Opens offline, prints to PDF, safe to email.
→ Findings CSV: one row per finding with host, owner, attack path, severity and source. Drops straight into a ticketing system.
→ Markdown: the full report for docs and repos.
Every report has a summary, "fix this first", the findings, the attack paths, and the evidence behind each one. It's all built by code from what the scan actually found, so it works without an AI key. With --ai, Claude's write-up goes on top, labeled as AI-written, and every claim cites evidence Monomi can check.
Saved a scan with --json? monomi.py report re-exports it without scanning again.
Safe by design: everything from the scanned domain is escaped in the HTML, the page carries a strict Content-Security-Policy (no scripts, nothing loaded from outside), and CSV cells that look like spreadsheet formulas are neutralized. A hostile DNS record can't turn your report into an attack on the reader.
Setup check
monomi.py doctor checks Python, packages, the API key, DNS and every data source in about 10 seconds. Anything wrong comes with a one-line fix.
One-command MCP setup
monomi.py mcp setup adds Monomi to the Claude desktop app. It only touches Monomi's entry, backs up your config first, and works on Windows, WSL, macOS and Linux.
424 tests. Open source, MIT.
github.com/0x41io/monomi
mønømi v1.9.0 is out.
This release had one goal: make Monomi solid enough for someone other than me to run on real targets.
Field tests on bug bounty programs showed where it broke under load. Here's what changed 🧵
---
1. MCP replies built for big scans
The 4 main MCP tools now reply with a summary by default: counts plus the hosts that matter (takeover leads, stale records, dangling CNAMEs, origin IPs).
The full result is saved to a file. Ask for detail="full" when you want it all.
---
2. Hosts passed as files
Instead of copying hundreds of hostnames through the chat, tools hand each other a results file, checked in batches.
Only files inside Monomi's own scans folder are accepted, so an agent can't point a tool at other files on your machine.
---
3. CT sources that don't fall over
Certificate log sources are paced under their free rate limits across every run, so multi-domain sweeps stay clean.
Each source's last good answer is saved per domain. If a source goes down, Monomi uses that copy and labels it with its date.
---
It also tells "failed" apart from "behind".
If one CT log has 0 certs while another finds some, Monomi says that source is behind on indexing, not broken, and holds off on a history baseline so hosts aren't flagged as new by mistake later.
---
4. DNS you can trust
A sweep of 1,130 hosts hit ~90 DNS server failures. Now:
• Google DoH joins Cloudflare as a second resolver
• one retry after a pause
• a clear servfail status instead of a generic error
Vercel IPs now count as shared CDN edge, not the target's servers.
---
5. Tested before tagging
286 tests, plus a full release check on my own lab domain through both the CLI and MCP.
Every planted issue reported. 0 false takeover leads.
Monomi proves what it finds and never invents a finding.
Next: report exports + a doctor command.
øk retweeted
Give two people the same AI. One gets smarter, one gets lazier.
Some use it to avoid learning anything. Some use it to learn everything.
Not hard to call who wins.
øk retweeted
For all my aspiring cybersecurity researchers and cyber thugs out there, here’s your reminder to always follow and do what you love. Don’t let anyone tell you that you can’t do something. You are capable of great things. I wouldn’t be where I am today if I listens to haters. ❤️❤️
Monomi v1.8.1 is out.
Pointed v1.8 at a 2,000+ host target. It built 3 attack paths that didn't hold up.
Fixed:
• newer AWS load balancer names → stale, not takeover leads
• no side doors through private IPs or load balancers
Same scan now: 1 path. The real one.
github.com/0x41io/monomi
