NucleiSniper
Python pipeline: deep-fingerprint each target, Jev Score ranks every Nuclei template 0 to 4, then Nuclei runs highest relevance first. Prioritization, not filtering.
Overview
NucleiSniper (github.com/MorDavid/NucleiSniper, Python 3.10+) from Mor David is a single-script pipeline that indexes Nuclei YAML to SQLite, deep-fingerprints each target (30 plus signal types including tech fingerprints, TLS, DNS, cookies, favicon mmh3, robots, path probes, and more), prefilters templates, batches about 50 templates per TypeSafe Jev call returning a 0 to 4 Score plus confidence and probability distribution, then runs Nuclei with templates sorted highest relevance first. Prioritization, not filtering: README stresses every template still runs. Flags include --no-scan, --report, --resume, --dry-run, --html-report, and --playwright for SPAs. Requires nuclei on PATH, local nuclei-templates, and TYPESAFE_API_KEY. Mor David also maintains BruteForceAI and related security tooling per the project README author section.
Problem: Vanilla Nuclei runs thousands of templates in directory order, so irrelevant checks finish before high-value templates even start on a mismatched stack.
Built for: Authorized pentesters and bug bounty researchers who want every Nuclei template to still run, but ordered by target-aware Jev relevance scores first.
First indexed on Jev Directory: 2026-10-08
Creator and team
- Name
- Mor David
- Handle
- @MorDavid
How Jev is used
- Role in the product flow
- Batch template relevance Score (0 to 4) against a rich target profile; auto-split batches on token limits
- Primitives
- Score
- State in
- Target profile JSON from HTTP, TLS, DNS, HTML, and path probes (and optional Playwright render); each batch holds roughly fifty template metadata records from the SQLite index.
- Decision out
- Per-template score 0 to 4, confidence 0 to 1, and probability distribution; sorted list drives Nuclei execution order.
- Index nuclei-templates YAML into SQLite (reuse unless --rebuild-index)
- Profile each URL with 30 plus signal types; optional --playwright render
- Prefilter templates that cannot match; README cites ~8.6% of 13,764 templates kept with 100% recall
- Score batches with Jev concurrently (--workers); split oversized batches on token limit
- Sort all templates by score and run Nuclei, or stop after scoring with --no-scan
NucleiSniper spends Jev once per target to reorder a full template library, not to skip authorized coverage. leepokai-jev-guard scores coding-agent tool calls and scans untrusted results for injection. dub-co documents Jev scoring malicious short links at dub.sh scale, not Nuclei YAML metadata. tsale-jevline asks Jev whether DFIR entities belong in an incident timeline. NucleiSniper sits in offensive template prioritization: deep fingerprint in, Score out, Nuclei execution unchanged except sort order. Use only on systems you own or are explicitly allowed to test; the README legal disclaimer is part of the product story. Clone from github.com/MorDavid/NucleiSniper, not the placeholder YourUser URL in the sample install block.
Sourced performance claims
- README About table: vanilla Nuclei runs 13,764+ templates in arbitrary order; NucleiSniper runs every template but highest relevance first.Source: github.com/MorDavid/NucleiSniper README
- README Stage 1: prefilter keeps ~8.6% of 13,764 templates with 100% recall before Jev scoring.Source: github.com/MorDavid/NucleiSniper README Stage 1
- README: batch about 50 templates per Jev API call with score 0 to 4, confidence, and probability distribution; auto-splits on token limit.Source: github.com/MorDavid/NucleiSniper README
- Public GitHub repo MorDavid/NucleiSniper had 21 stars and 7 forks, created 2026-10-08.Source: GitHub API, 2026-10-12
Features and stack
Features
- SQLite template index with incremental reparse
- 30 plus target signal types plus optional Playwright SPA profiling
- Tag prefilter with documented 100% recall before Jev
- Concurrent profiling (--url-workers) and scoring (--workers)
- --resume, --dry-run, --html-report, and scan-from --report workflow
- Fail-safe: stops before Jev if nuclei is missing from PATH
Stack
- Python 3.10+
- ProjectDiscovery Nuclei and nuclei-templates
- TypeSafe Jev (TYPESAFE_API_KEY)
- Optional Playwright Chromium for SPAs
Pricing: Open source script; Jev API usage bills to TYPESAFE_API_KEY. Nuclei and template maintenance are yours.
Links
FAQ
- Does NucleiSniper drop low-scoring templates?
- README features call it prioritisation, not filtering. Every template still runs; order changes so high relevance checks start earlier.
- Is NucleiSniper legal to run on any website?
- README legal disclaimer: for authorised security testing only. Do not scan systems without permission or use findings maliciously.
- What Jev primitive does scoring use?
- Stage 1 README: each batch returns a Score 0 to 4 plus confidence and a probability distribution per template.
- What happens if nuclei is not installed?
- README fail-safe design: if nuclei is not on PATH, the tool stops before calling Jev so you do not spend API credit on unscorable runs.
- How is this different from jev-guard?
- jev-guard gates coding-agent tool calls and scans results. NucleiSniper ranks Nuclei vulnerability templates per target and then runs Nuclei.
Related learn guides
Original Jev guidance that pairs with this product pattern.
- System One model
The model family behind Jev: parallel typed questions, one forward pass, probabilities you can threshold.
- Jev use cases
The patterns builders actually search for: moderation, routing, triage, RAG verify, and agent gates.
- Jev vs LLM classification
When to gate with System One probabilities instead of asking a chat model to label things.
Related products
Hand-picked neighbors with rich profiles or overlapping tags.