What is mattew?

mattew is a command line tool built for bug bounty hunters and security researchers who need to quickly map out a website's attack surface. Point it at a target URL and it crawls the site, then automatically looks for the kinds of technical details attackers and researchers care about. During a scan it collects links, forms, and API routes, including REST and GraphQL endpoints, pulls parameters out of forms and scripts, and searches for accidentally exposed secrets like API keys or tokens. It also checks for common security misconfigurations, such as missing security headers, overly permissive cross origin settings, cookies missing safety flags, and identifies which web application firewall, if any, is protecting the site. Beyond basic scanning, mattew tries to fingerprint the technology behind a site, looking for things like the content management system, frameworks, and analytics tools in use. It has a dedicated deeper scan for WordPress sites, and searches for commonly forgotten items such as exposed admin panels, backup files, open directory listings, and source map files that can leak original code. It can decode JSON web tokens and flag ones that use an insecure algorithm setting, and scans HTML comments for leftover notes that might reveal sensitive information. Every scan produces a numeric security score with a letter grade, and results can be exported as a colored terminal report, JSON for feeding into other tools, Markdown for documentation, or a full HTML report with tables and navigation. Installation is done through Python's package manager after cloning the repository, and running a scan is a single command against a target URL, with options to control crawl depth, page limits, and request delay for more considerate crawling. The tool is released under the MIT license and is explicitly intended only for testing sites you own or have permission to test.