FlareInspect

FlareInspect is an open-source Cloudflare security assessment CLI and local web dashboard built by IONSEC.IO. Scan your infrastructure, detect posture drift, ship findings to a SIEM, and let an MCP-aware agent drive the full assess → find → path → plan → apply loop.

Highlights

🔍 50+ Security Checks	34 categories spanning DNS, SSL/TLS, WAF, Zero Trust, Workers, Access, CASB, Magic, and more.
🕸️ Resource Graph (v2.0)	Typed node/edge view of the account — the single source of truth for the posture map, attack paths, and SIEM enrichment.
⚔️ Attack-Path Engine (v2.0)	Five rule-based detectors chain findings into paths that lead to high/critical exposure.
🗺️ Posture Map (v2.0)	Interactive entity graph in the dashboard — Internet → Account → Zones → services, with severity colours and attack-path highlight.
🚢 SIEM Shipping (v2.0)	flareinspect ship to Elasticsearch (ECS) or Splunk HEC, with attack-path enrichment. Packaged Kibana and Splunk apps included.
🤖 MCP Server (v2.0)	flareinspect-mcp exposes the engine to any MCP-aware agent (Claude Code, Cowork, Hermes, OpenClaw) over stdio.
🔔 Notifications (v2.0)	flareinspect notify to Slack (Block Kit), Microsoft Teams (Adaptive Card 1.5), or an HMAC-signed generic webhook.
📊 Drift Detection	Track posture regressions over time with flareinspect diff.
📋 Compliance Mapping	CIS, SOC 2, PCI-DSS, and NIST CSF controls.
📄 Multi-Format Export	JSON, HTML, OCSF, SARIF, Markdown, CSV, ASFF, ECS, and Splunk HEC.
🌐 Web Dashboard	Local UI with assessment history, posture map, score visualization, and downloads.
☁️ 1-Click Deploy	Deploy to Render, Heroku, Railway, or Fly.io in minutes.
🚀 CI/CD Ready	Exit codes, threshold gates, and SARIF output for any pipeline.
🔌 Plugin Support	Scaffold trusted local extensions for custom checks.

Contents

• 1. Getting Started
  • 1.1. Prerequisites
  • 1.2. Create a Cloudflare API Token
  • 1.3. First Assessment
  • 1.4. Understanding the Output
  • 1.5. Generate an HTML Report
  • 1.6. Compare Two Runs
  • 1.7. Where to go next
• 2. Quick Start
  • 2.1. Run an Assessment
  • 2.2. Export a Report
  • 2.3. Compare Two Runs
  • 2.4. Start the Web Dashboard
  • 2.5. Visualise the Posture Map (v2.0)
  • 2.6. Ship to a SIEM (v2.0)
  • 2.7. Notify a channel (v2.0)
  • 2.8. Let an MCP-aware agent drive the loop (v2.0)
  • 2.9. CI/CD Mode
• 3. Installation
  • 3.1. From Source
  • 3.2. Docker
  • 3.3. Verify Installation
• 4. CLI Reference
  • 4.8. Commands
  • 4.9. Quick Reference
• 5. Configuration
  • 5.4. Configuration Methods
• 6. Security Checks
  • 6.26. Categories
  • 6.27. Quick Start
• 7. Export Formats
• 8. Compliance Mapping
• 9. Scoring
• 10. Drift Detection
  • 10.2. Quick Start
  • 10.3. CI Integration
• 11. Web Dashboard
  • 11.1. Starting the Dashboard
  • 11.2. Layout
  • 11.3. Design tokens
  • 11.4. Features
• 12. Posture Map
  • 12.1. What it shows
  • 12.2. How it is built
  • 12.3. Interactions
  • 12.4. Empty state
  • 12.5. Attack-path data model
  • 12.6. Next steps
• 13. SIEM
  • 13.3. Why ship to a SIEM?
  • 13.4. Common shape
  • 13.5. Targets
  • 13.6. Authentication
  • 13.7. Pull / air-gapped mode
  • 13.8. Deduplication
  • 13.9. Next steps
• 14. MCP Server
  • 14.1. Install
  • 14.2. Tools
  • 14.3. Example session
  • 14.4. Edit-scope policy
  • 14.5. Failure modes
  • 14.6. Next steps
• 15. CI/CD Integration
  • 15.4. Quick Start
• 16. Deployment
  • 16.7. Quick Deploy
  • 16.8. Environment Variables
• 17. Plugins
  • 17.2. Quick Start
• 18. Architecture
• 19. Contributing
  • 19.1. Before You Start
  • 19.2. Local Setup
  • 19.3. Development Commands
  • 19.4. Development Expectations
  • 19.5. Pull Requests
  • 19.6. Coding Notes
  • 19.7. Reporting Security Issues
• 20. Cloudflare API Permissions Guide
  • 20.1. Minimum Permissions
  • 20.2. Recommended Permissions
  • 20.3. Creating the Token
  • 20.4. Token Troubleshooting
  • 20.5. Security Best Practices
• 21. Troubleshooting
  • 21.1. Common Errors
  • 21.2. Debug Mode
  • 21.3. Logs
• 22. FAQ
  • 22.1. General
  • 22.2. Assessment
  • 22.3. Scoring
  • 22.4. Compliance
  • 22.5. Deployment
• 23. Changelog
  • 23.1. 2.0.0 — 2026-06-05
  • 23.2. 1.3.0 — 2026-04-26
  • 23.3. 1.2.2 — 2026-04-26
  • 23.4. 1.2.1 — 2026-04-25
  • 23.5. 1.2.0 — 2026-04-13
  • 23.6. 1.1.0 — 2026-04-12

Indices and tables

• Index

• Module Index

• Search Page