Live terminal scanning
Run a one-command scan from the terminal and see findings stream back as they are discovered, instead of waiting for a separate report step.
qsa.sh
qsa.sh runs an external security scan of your public IP with terminal-streamed results and no local installation, helping you inspect exposed ports and vulnerability signals.
Overview
qsa.sh is a terminal-based external security scan service that checks the public IP address your request comes from. It is designed for people who want a quick outside-in view of their own host without installing scanners or assembling a toolchain first.
The service combines naabu, nmap with the vulners script, and nuclei to identify open ports, service versions, TLS posture, and matching vulnerability checks. The free tier streams results live in about 30 seconds, while paid tiers extend the scan to all ports and return fuller reports asynchronously.
Core features
Port coverage tiers
The free scan checks the top 1,000 TCP ports, while paid tiers expand to all 65,535 TCP ports for broader external exposure coverage.
Service and CVE detection
qsa.sh fingerprints services with nmap and vulners so open ports are paired with detected service versions and known-CVE mapping.
Vulnerability checks by depth
Nuclei checks cover curated exposure, login, takeover, TLS, and CVE templates, with the Deep tier using the full template set plus custom checks.
Authorization gate
The service only scans the IP your request comes from, shows that address before scanning, and includes a 15-second chance to cancel with Ctrl-C.
Common use cases
Quick self-assessment
Check what ports and services are exposed on your own public IP and get a quick severity snapshot without setting up local tools.
Broader remediation checks
Use the Full tier when you are fixing an issue and want broader port coverage with repeated verification on the same host.
Deeper review of a public host
Use the Deep tier when you want a fuller vulnerability pass, including the complete nuclei template set and a report you can review later.
Cloud and hosting exposure checks
Run the scan from a server, cloud instance, or datacenter host to inspect its outside-in exposure from the internet.
Interactive terminal review
Use the live terminal output when you want immediate feedback on open ports, service versions, TLS posture, and CVE matches.
Pros and Cons
Pros
- Uses open-source tools that are named publicly, so the scan workflow is transparent.
- The free scan requires no account and nothing to install.
- Live output makes it easy to see open ports and findings as they are discovered.
- Paid tiers broaden coverage from common ports to all TCP ports and deeper nuclei checks.
- The service includes an explicit pre-scan countdown, giving users a chance to cancel before any packets are sent.
Cons
- The service refuses scans from known CGNAT, mobile-carrier, IPv6, proxy, VPN, and Tor/relay sources, which limits use from shared or anonymized connections.
- Paid scans are still constrained to the connecting IP, so the service is not a general-purpose remote scanner for arbitrary targets.
- Some results are ephemeral; free output is streamed only, and paid results are stored briefly in Redis for delivery or email rather than kept permanently.
FAQ
Does qsa.sh let me scan another host?
qsa.sh scans only the public IP address that your connection arrives from. There is no target field, and continuing past the pre-scan countdown is treated as your authorization to scan that IP.
How are results delivered?
Free scans stream live to your terminal. Full scans return asynchronously, while Deep scans email a report and a self-expiring results link.
What are the scan limits?
Free scans are limited to one scan per 24 hours per IP. Full scans are limited to one per hour per key, and Deep scans are one-time credits with no per-IP cooldown.
Can I use qsa.sh from a shared, mobile, or VPN connection?
The service refuses known CGNAT and mobile-carrier connections, IPv6 origins, and connections flagged as proxy, VPN, or Tor/relay. Those restrictions apply to paid tokens too.
What tools does qsa.sh run?
It uses naabu for port discovery, nmap with the vulners script for service and CVE mapping, and nuclei with the public nuclei templates for vulnerability checks.
Quick Facts
- Category
- Developer Tool
- Primary use
- External security scanning of your own IP
- Delivery
- Terminal stream, async result, or emailed report depending on tier
- Core tools
- naabu, nmap with vulners, nuclei
- Source domain
- qsa.sh
- Paid plans
- Available for Full and Deep scans
qsa.sh Alternatives
ByteAsk
ByteAsk is a terminal-first AI coding agent for C and C++ that edits repos and verifies changes with compilers, debuggers, sanitizers, and tests.
Manta AI
Manta AI is an autonomous web app testing tool that maps app behavior, catches regressions, and generates tests from a URL, no scripts or selectors needed.
CreateOS Sandbox
CreateOS Sandbox is an isolated compute environment for running code and agent workloads in Firecracker micro-VMs with private networking and SDK, CLI, or MCP control.
hob
hob is an independent workspace for coding agents, with local control over sessions, terminals, history, routing, and follow-up work.
ClawTick
ClawTick is an AI agent automation platform for scheduling jobs from the CLI, dashboard, or REST API. Built for developers and teams using LangChain, CrewAI, webhooks, or custom workflows with monitoring, alerts, and logs.
Redline
Redline is a budgeting tool for Claude Code that paces sessions by time, tokens, cost, or plan percentage, helping them end with a usable result.