owl234/ARL-Next

What it solves

ARL-Next is a modernized reconstruction of the original Asset Reconnaissance Lighthouse (ARL), designed to eliminate critical stability issues such as task freezes, memory leaks, and outdated dependencies. It provides a high-performance, closed-loop platform for asset reconnaissance and vulnerability monitoring, specifically optimized for large-scale target scanning and enterprise-level asset discovery.

How it works

The platform uses a decoupled microservices architecture to ensure stability and throughput:

• AI Integration: Implements the Model Context Protocol (MCP) to allow AI Agents (like Claude or Cursor) to manage asset discovery and analysis using natural language.
• Task Distribution: Separates tasks into lightweight (DNS/ports), heavy (Nuclei/PoC), and threat intelligence queues via RabbitMQ to prevent system bottlenecks.
• OSINT Microservice: A dedicated asynchronous service for enterprise ICP filings and equity penetration (Tianyancha) to avoid blocking the main task queue.
• Data Layer: Utilizes MongoDB 7.0 with bulk_write operations and joint unique indexes to handle hundreds of thousands of assets without redundancy.
• Self-Healing: Includes an Autoheal probe that monitors and restarts deadlocked containers in real-time.

Who it’s for

It is designed for security analysts, SRC (Security Response Center) researchers, and enterprise security teams who need to automate the mapping of an organization's attack surface from the group level down to specific vulnerabilities.

Highlights

• AI-Native Scheduling: Native MCP support allows AI agents to trigger scans and export asset dashboards via natural language.
• Enterprise Asset Penetration: Automates the chain from Group Company $\rightarrow$ Subsidiaries $\rightarrow$ Domains $\rightarrow$ IPs $\rightarrow$ Ports $\rightarrow$ Components $\rightarrow$ Vulnerabilities.
• Threat Intelligence Radar: Built-in monitoring for GitHub CVEs and sensitive code/credential leaks.
• High-Performance Engine: Decoupled screenshotting (Puppeteer) and OSINT services to eliminate task freezes and memory leaks.
• Rapid Deployment: Optimized for domestic Chinese networks with pre-built images on Aliyun, enabling setup in under 2 minutes.