GATEWAY · UNIFIED TOOL ENGINE

One engine.Typed results.

Gateway puts every reconnaissance and security tool the lab uses behind one contract: a task goes in, typed observations and their measured coverage come out. Fregate runs all of its scans through it.

See how a task runs Gateway in Fregate

A Fregate scan run by Gateway agents: 39 of 39 tasks, 768 observations and 28 findings, with a timeline of discovery, resolution, enrichment, HTTP probes, TLS probes and vulnerability checks. — A scan as Gateway ran it for Fregate: each stage is a capability, each bar the tasks the agents ran.

A real screen from a demo workspace. Hostnames and addresses are replaced with documentation values.

10capabilities, from subdomain discovery to active web tests
3modes, passive by default: active to touch a target, intrusive to test it
1pinned release of vulnerability checks, verified by hash on every agent

HOW A TASK RUNS

In through one door, out as facts.

A task names a capability, its targets and a maximum mode. The runner admits the targets, runs the tool behind a monitored network, then validates every fact before it leaves, with the coverage that says what was really checked.

Gateway pipeline: discovery, DNS resolution, port scans, web probes, vulnerability checks and crawling run behind Gateway under scope and rate controls, and come out as typed observations with their coverage. — Conceptual pipeline. Absence counts as proof only when coverage is complete.

IN FREGATE

What the engine hands over.

CATALOG

Every template, classified once.

Agents classify the pinned release of vulnerability checks into a catalog: severity, CVE, CWE, CVSS, EPSS, the profiles that run each template and, when the safe one does not, why. Fregate shows it as it is.

Built once per release, cached with the bundle
Streamed to the control plane on request
The same rules as the scans themselves

CAPABILITIES

What Gateway can run.

Each capability takes canonical targets, does one job and emits one kind of typed fact, whatever engine runs behind it.

Capability	What it does	Takes	Emits	Mode
`discover.subdomains`	Finds the hostnames under a domain, from passive sources	domain	hostname	passive
`enrich.ip`	Says who runs an address: cloud, CDN or network	ip	ip_info	passive
`resolve.dns`	Resolves names to their DNS records	hostname, domain	dns_record	active
`scan.ports`	Finds the open ports of addresses and ranges	ip, cidr	service	active
`identify.services`	Names the service behind each open port	service	service	active
`probe.http`	Reaches web endpoints: status, title, technologies	hostname, url, service	http_endpoint	active
`probe.tls`	Reads certificates and TLS settings	hostname, service	certificate	active
`crawl.web`	Maps a site’s pages, forms, scripts and endpoints	url	web_resource	active
`detect.vulns`	Runs vulnerability checks on sites and services	url	finding	active
`test.web`	Active web tests: injection, XSS, SSRF and more	url	finding	intrusive

Agents that only know their tasks.

In production, Gateway runs as scan agents with no database access. They lease tasks from a control plane over ConnectRPC, send their events back in acknowledged batches, and pick up where they stopped after a disconnect.

COMMAND LINE

The same contract, from a terminal.

Every capability runs locally too. The default mode is passive: nothing touches a target without --mode active.

gateway providers# capabilities and their tools

gateway run discover.subdomains example.com# passive by default

gateway run probe.http --mode active www.example.com# typed http_endpoint facts

gateway run detect.vulns --mode active --params '{"tags":["misconfig"]}' https://www.example.com/# vulnerability checks, safe profile

gateway agent --server https://control.example.com --token …# lease tasks from a control plane

GUARD RAILS

Enforced by the runner, never by the tools.

Admission
Canonical targets and a maximum mode; private and reserved addresses refused; at most 500 targets per task.
Monitored network
Every connection is checked against scope, exclusions and rate as it opens, and cut when the task ends.
Validated output
A fact that does not derive from its target is dropped as out of scope.
Identified traffic
Every HTTP request says who sends it: offensivelab-gateway/1.
Evidence
A finding keeps the request and response it came from, capped, with credentials masked.
Honest coverage
A timeout or a refused connection never counts as a check: coverage stays partial.