Nuclei is a fast, customizable vulnerability scanner written in Go that uses a simple YAML-based domain-specific language to enable security professionals to create and share vulnerability detection templates. The tool is designed to find vulnerabilities across applications, APIs, networks, DNS, and cloud configurations by leveraging templates contributed by thousands of security researchers globally. The YAML-based approach allows users to define custom vulnerability detection scenarios that mimic real-world conditions, which the project claims leads to zero false positives by simulating actual attack steps rather than relying on simple pattern matching.
The scanner supports multiple protocols including TCP, DNS, HTTP, SSL, WHOIS, JavaScript, and Code, enabling comprehensive security testing across diverse infrastructure types. Nuclei can perform single target scans, bulk scanning of multiple targets from files, and network-wide scanning for issues like open ports and misconfigured services. The tool integrates into CI/CD pipelines for continuous vulnerability detection and regression testing, and supports integration with platforms like Jira, Splunk, GitHub, Elastic, and GitLab for streamlined vulnerability management and reporting.
The project maintains a separate nuclei-templates repository containing the community-contributed detection templates that power the scanner. The README indicates support for multiple languages including English, Chinese, Korean, Indonesian, Spanish, Japanese, Portuguese, and Turkish, reflecting the tool's global user base. The project offers both open-source and commercial editions, with Pro and Enterprise versions providing cloud-hosted scanning at scale, integrations with cloud services like AWS, GCP, and Azure, and additional features such as real-time scanning and SAML SSO.
Nuclei emphasizes ultra-fast parallel scan processing and request clustering to handle large-scale vulnerability assessments efficiently. The project includes a free cloud tier with generous monthly limits for storing findings, writing templates, accessing the latest template library, and discovering targets. The repository is actively maintained with breaking changes expected between releases, and the project explicitly notes that running Nuclei as a service may pose security risks and recommends using it primarily as a standalone CLI tool with appropriate security measures.
