Skip to content

Free tools for authorized testing

Three small tools for the work around a security test. Each runs in your browser, with no account, and sends nothing you type to a server.

Close view of a circuit board

What each tool is for

The CVSS 3.1 calculator scores a finding from the eight base metrics and gives you the vector string to put in the report. It follows the FIRST specification, including its rounding rule, reads a pasted vector, and keeps the vector in the page address so a score can be linked from a ticket.

The rules of engagement builder turns a form into an authorization document: scope, testing window, permitted and prohibited techniques, data handling, emergency contacts and signature lines. It is a starting template for the two sides to edit and for counsel to review, and it exports as Markdown or prints as a clean page.

The engagement cost estimator answers the budgeting question for AI-assisted testing: at a given number of requests and tokens, what a model costs per request, per day and for the whole engagement. It reads prices per million tokens from the live catalog, so the figures match the pricing page.

Built for permissioned work

Everything here supports testing that someone with the authority to allow it has agreed to in writing. The tools help with the parts of an engagement that are easy to get wrong under time pressure: a consistent severity score, a scope both sides have read, and a cost figure that holds up. When you are ready to put a model behind your own agent, the API docs show the base URL, key and model id to use.

Questions

Do the tools need an account or an API key?

No. Each tool opens ready to use, with no sign-up, no key and no limit on how often you use it.

Is anything I enter sent to a server?

No. The scoring, the document and the cost arithmetic all run in your browser. Nothing you type is sent to a server or stored, so a finding, a client name or a scope list never leaves your machine.

Who are the tools for?

People doing authorized security work: penetration testers, red teams, bug bounty hunters and CTF players. They cover the paperwork around a test, such as scoring a finding, agreeing scope and budgeting, and contain no attack tooling.