# Nuclei

> Nuclei CLI parameter reference and usage patterns - YAML-template vulnerability scanning, target input modes, template filters, output formats, rate limits, ProjectDiscovery dashboard upload, and common scan commands.

- **Type:** Skill
- **Install:** `agentstack add skill-mingyiseclab-mingyi-atlas-nuclei`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [MingyiSecLab](https://agentstack.voostack.com/s/mingyiseclab)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [MingyiSecLab](https://github.com/MingyiSecLab)
- **Source:** https://github.com/MingyiSecLab/Mingyi-Atlas/tree/main/src/skills/shared/tool-params/nuclei

## Install

```sh
agentstack add skill-mingyiseclab-mingyi-atlas-nuclei
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# nuclei

Nuclei is a modern, high-performance vulnerability scanner that uses simple YAML-based templates. It helps design custom vulnerability detection scenarios that mimic real-world conditions, reducing false positives by verifying vulnerabilities with realistic steps.

Use this reference when constructing or reviewing `nuclei` commands. The flags below are expanded from `nuclei -h`.

## Capabilities

- Simple YAML format for creating and customizing vulnerability templates.
- Community-contributed templates for trending vulnerabilities.
- Real-world verification flows to reduce false positives.
- Ultra-fast parallel scan processing and request clustering.
- CI/CD integration for vulnerability detection and regression testing.
- Multiple protocol support, including TCP, DNS, HTTP, SSL, WHOIS, JavaScript, Code, and more.
- Integrations with Jira, Splunk, GitHub, Elastic, GitLab, ProjectDiscovery Cloud, APIs, and webhooks.

## Table of Contents

- Get Started
- Installation
- Command Line Flags
- Common Command Combinations
- Single Target Scan
- Scanning Multiple Targets
- Network Scan
- Scanning With a Custom Template
- Connect Nuclei to ProjectDiscovery
- Nuclei Templates and Community
- Template Use Cases

## Get Started

Install Nuclei locally for CLI scanning, or use the ProjectDiscovery cloud tier to store and visualize findings, manage templates, access the latest nuclei templates, and discover/store targets.

Important notes:

- Nuclei is in active development. Review release changelogs before updating because breaking changes can occur.
- Nuclei is primarily built as a standalone CLI tool. Running it as a service can introduce security risks and should be done with additional controls.
- Pro and Enterprise editions are available for teams that need large-scale scans, cloud integrations, Jira/Slack/Linear/API/webhook workflows, executive and compliance reporting, SAML SSO, SOC 2 compliance, regional hosting, and shared workspaces.

## Installation

Nuclei requires Go `>= 1.24.2` for source installation:

```bash
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
```

Installation docs: 

## Usage

```bash
nuclei [flags]
./nuclei [flags]
```

## Common Command Combinations

Quick, findings-only scan:

```bash
nuclei -u https://example.com -silent
```

High-signal scan for serious findings:

```bash
nuclei -u https://example.com -severity high,critical -silent
```

Scan a target list and write JSONL output:

```bash
nuclei -l urls.txt -jsonl -o nuclei_findings.jsonl
```

Scan only selected tags:

```bash
nuclei -u https://example.com -tags cve,exposure,misconfig
```

Exclude noisy severities or tags:

```bash
nuclei -l urls.txt -es info,low -etags intrusive,dos
```

Run specific template paths:

```bash
nuclei -u https://example.com -t http/cves/ -t ssl/
```

Run a specific template ID or wildcard:

```bash
nuclei -u https://example.com -id cves/2021/CVE-2021-44228
nuclei -u https://example.com -id '*jenkins*'
```

Use authenticated headers:

```bash
nuclei -u https://example.com -H 'Authorization: Bearer ' -H 'Cookie: session='
```

Use variables consumed by templates:

```bash
nuclei -u https://example.com -V username=admin -V password=''
```

Throttle scans for fragile or shared environments:

```bash
nuclei -l urls.txt -rl 20 -c 10 -bs 10 -timeout 15 -retries 2
```

Route traffic through a proxy:

```bash
nuclei -u https://example.com -proxy http://127.0.0.1:8080
```

Store evidence and redact sensitive keys:

```bash
nuclei -u https://example.com -jsonl -o findings.jsonl -sresp -srd nuclei_evidence -rd token,authorization,cookie
```

Export reports:

```bash
nuclei -l urls.txt -me nuclei_report/
nuclei -l urls.txt -se nuclei.sarif
nuclei -l urls.txt -je nuclei.json
```

Upload findings to ProjectDiscovery Cloud dashboard:

```bash
nuclei -l urls.txt -dashboard
```

Update engine and templates:

```bash
nuclei -update
nuclei -update-templates
```

Validate custom templates before running:

```bash
nuclei -validate -t /path/to/templates/
```

Use DAST fuzzing templates with a scoped target:

```bash
nuclei -u https://example.com -dast -fuzz-scope '^https://example\.com/' -fa low
```

## Target

| Flag | Description |
| --- | --- |
| `-u`, `-target string[]` | Target URLs/hosts to scan. |
| `-l`, `-list string` | Path to file containing target URLs/hosts to scan, one per line. |
| `-eh`, `-exclude-hosts string[]` | Hosts to exclude from the input list: IP, CIDR, hostname. |
| `-resume string` | Resume scan from and save to the specified file. Clustering is disabled. |
| `-sa`, `-scan-all-ips` | Scan all IPs associated with a DNS record. |
| `-iv`, `-ip-version string[]` | IP version to scan for hostname: `4`, `6`. Default: `4`. |

## Target Format

| Flag | Description |
| --- | --- |
| `-im`, `-input-mode string` | Input file mode: `list`, `burp`, `jsonl`, `yaml`, `openapi`, `swagger`. Default: `list`. |
| `-ro`, `-required-only` | Use only required fields in input format when generating requests. |
| `-sfv`, `-skip-format-validation` | Skip format validation, such as missing vars, when parsing input file. |

## Templates

| Flag | Description |
| --- | --- |
| `-nt`, `-new-templates` | Run only new templates added in the latest `nuclei-templates` release. |
| `-ntv`, `-new-templates-version string[]` | Run new templates added in a specific version. |
| `-as`, `-automatic-scan` | Automatic web scan using Wappalyzer technology detection to tags mapping. |
| `-t`, `-templates string[]` | Template file or directory to run. Supports comma-separated values and file input. |
| `-turl`, `-template-url string[]` | Template URL or list containing template URLs to run. Supports comma-separated values and file input. |
| `-ai`, `-prompt string` | Generate and run a template using an AI prompt. |
| `-w`, `-workflows string[]` | Workflow file or directory to run. Supports comma-separated values and file input. |
| `-wurl`, `-workflow-url string[]` | Workflow URL or list containing workflow URLs to run. Supports comma-separated values and file input. |
| `-validate` | Validate the passed templates. |
| `-nss`, `-no-strict-syntax` | Disable strict syntax check on templates. |
| `-td`, `-template-display` | Display template content. |
| `-tl` | List all templates matching current filters. |
| `-tgl` | List all available tags. |
| `-sign` | Sign templates with private key from `NUCLEI_SIGNATURE_PRIVATE_KEY`. |
| `-code` | Enable loading code protocol-based templates. |
| `-dut`, `-disable-unsigned-templates` | Disable running unsigned templates or templates with mismatched signature. |
| `-esc`, `-enable-self-contained` | Enable loading self-contained templates. |
| `-egm`, `-enable-global-matchers` | Enable loading global matchers templates. |
| `-file` | Enable loading file templates. |

## Filtering

| Flag | Description |
| --- | --- |
| `-a`, `-author string[]` | Run templates by author. Supports comma-separated values and file input. |
| `-tags string[]` | Run templates by tags. Supports comma-separated values and file input. |
| `-etags`, `-exclude-tags string[]` | Exclude templates by tags. Supports comma-separated values and file input. |
| `-itags`, `-include-tags string[]` | Execute tags even if they are excluded by default or configuration. |
| `-id`, `-template-id string[]` | Run templates by template IDs. Supports comma-separated values, file input, and wildcards. |
| `-eid`, `-exclude-id string[]` | Exclude templates by template IDs. Supports comma-separated values and file input. |
| `-it`, `-include-templates string[]` | Template file or directory to execute even if excluded by default or configuration. |
| `-et`, `-exclude-templates string[]` | Template file or directory to exclude. Supports comma-separated values and file input. |
| `-em`, `-exclude-matchers string[]` | Template matchers to exclude in results. |
| `-s`, `-severity value[]` | Run templates by severity: `info`, `low`, `medium`, `high`, `critical`, `unknown`. |
| `-es`, `-exclude-severity value[]` | Exclude templates by severity: `info`, `low`, `medium`, `high`, `critical`, `unknown`. |
| `-pt`, `-type value[]` | Run templates by protocol type: `dns`, `file`, `http`, `headless`, `tcp`, `workflow`, `ssl`, `websocket`, `whois`, `code`, `javascript`. |
| `-ept`, `-exclude-type value[]` | Exclude templates by protocol type: `dns`, `file`, `http`, `headless`, `tcp`, `workflow`, `ssl`, `websocket`, `whois`, `code`, `javascript`. |
| `-tc`, `-template-condition string[]` | Run templates by expression condition. |

## Output

| Flag | Description |
| --- | --- |
| `-o`, `-output string` | Output file to write found issues/vulnerabilities. |
| `-sresp`, `-store-resp` | Store all requests/responses passed through nuclei to output directory. |
| `-srd`, `-store-resp-dir string` | Store all requests/responses to a custom directory. Default: `output`. |
| `-silent` | Display findings only. |
| `-nc`, `-no-color` | Disable ANSI color output. |
| `-j`, `-jsonl` | Write output in JSON Lines format. |
| `-irr`, `-include-rr -omit-raw` | Include request/response pairs in JSON, JSONL, and Markdown outputs for findings only. Deprecated; use `-omit-raw`. Default: `true`. |
| `-or`, `-omit-raw` | Omit request/response pairs in JSON, JSONL, and Markdown outputs for findings only. |
| `-ot`, `-omit-template` | Omit encoded template in JSON and JSONL output. |
| `-nm`, `-no-meta` | Disable printing result metadata in CLI output. |
| `-ts`, `-timestamp` | Enable printing timestamp in CLI output. |
| `-rdb`, `-report-db string` | Nuclei reporting database. Always use this to persist report data. |
| `-ms`, `-matcher-status` | Display match failure status. |
| `-me`, `-markdown-export string` | Directory to export results in Markdown format. |
| `-se`, `-sarif-export string` | File to export results in SARIF format. |
| `-je`, `-json-export string` | File to export results in JSON format. |
| `-jle`, `-jsonl-export string` | File to export results in JSON Lines format. |
| `-rd`, `-redact string[]` | Redact keys from query parameters, request headers, and body. |

## Configurations

| Flag | Description |
| --- | --- |
| `-config string` | Path to nuclei configuration file. |
| `-tp`, `-profile string` | Template profile config file to run. |
| `-tpl`, `-profile-list` | List community template profiles. |
| `-fr`, `-follow-redirects` | Enable following redirects for HTTP templates. |
| `-fhr`, `-follow-host-redirects` | Follow redirects on the same host. |
| `-mr`, `-max-redirects int` | Maximum redirects to follow for HTTP templates. Default: `10`. |
| `-dr`, `-disable-redirects` | Disable redirects for HTTP templates. |
| `-rc`, `-report-config string` | Nuclei reporting module configuration file. |
| `-H`, `-header string[]` | Custom header/cookie for all HTTP requests in `header:value` format. Supports CLI and file input. |
| `-V`, `-var value` | Custom vars in `key=value` format. |
| `-r`, `-resolvers string` | File containing resolver list for nuclei. |
| `-sr`, `-system-resolvers` | Use system DNS resolving as error fallback. |
| `-dc`, `-disable-clustering` | Disable request clustering. |
| `-passive` | Enable passive HTTP response processing mode. |
| `-fh2`, `-force-http2` | Force HTTP/2 connection on requests. |
| `-ev`, `-env-vars` | Enable environment variables in templates. |
| `-cc`, `-client-cert string` | PEM client certificate file for authenticating against scanned hosts. |
| `-ck`, `-client-key string` | PEM client key file for authenticating against scanned hosts. |
| `-ca`, `-client-ca string` | PEM client certificate authority file for authenticating against scanned hosts. |
| `-sml`, `-show-match-line` | Show match lines for file templates. Works with extractors only. |
| `-ztls` | Use ztls library with autofallback to standard one for TLS 1.3. Deprecated; autofallback to ztls is enabled by default. |
| `-sni string` | TLS SNI hostname to use. Default: input domain name. |
| `-dka`, `-dialer-keep-alive value` | Keep-alive duration for network requests. |
| `-lfa`, `-allow-local-file-access` | Allow file payload access anywhere on the system. |
| `-lna`, `-restrict-local-network-access` | Block connections to local/private networks. |
| `-i`, `-interface string` | Network interface to use for network scan. |
| `-at`, `-attack-type string` | Payload combination type: `batteringram`, `pitchfork`, `clusterbomb`. |
| `-sip`, `-source-ip string` | Source IP address to use for network scan. |
| `-rsr`, `-response-size-read int` | Maximum response size to read, in bytes. |
| `-rss`, `-response-size-save int` | Maximum response size to save, in bytes. Default: `1048576`. |
| `-reset` | Remove all nuclei configuration and data files, including `nuclei-templates`. |
| `-tlsi`, `-tls-impersonate` | Enable experimental ClientHello/JA3 TLS randomization. |
| `-hae`, `-http-api-endpoint string` | Experimental HTTP API endpoint. |

## Interactsh

| Flag | Description |
| --- | --- |
| `-iserver`, `-interactsh-server string` | Interactsh server URL for self-hosted instance. Default: `oast.pro,oast.live,oast.site,oast.online,oast.fun,oast.me`. |
| `-itoken`, `-interactsh-token string` | Authentication token for self-hosted Interactsh server. |
| `-interactions-cache-size int` | Number of requests to keep in the interactions cache. Default: `5000`. |
| `-interactions-eviction int` | Seconds to wait before evicting requests from cache. Default: `60`. |
| `-interactions-poll-duration int` | Seconds to wait before each interaction poll request. Default: `5`. |
| `-interactions-cooldown-period int` | Extra time for interaction polling before exiting. Default: `5`. |
| `-ni`, `-no-interactsh` | Disable Interactsh server for OAST testing and exclude OAST-based templates. |

## Fuzzing

| Flag | Description |
| --- | --- |
| `-ft`, `-fuzzing-type string` | Override fuzzing type set in template: `replace`, `prefix`, `postfix`, `infix`. |
| `-fm`, `-fuzzing-mode string` | Override fuzzing mode set in template: `multiple`, `single`. |
| `-fuzz` | Enable loading fuzzing templates. Deprecated; use `-dast`. |
| `-dast` | Enable/run DAST fuzz templates. |
| `-dts`, `-dast-server` | Enable DAST server mode for live fuzzing. |
| `-dtr`, `-dast-report` | Write DAST scan report to file. |
| `-dtst`, `-dast-server-token string` | DAST server token. Optional. |
| `-dtsa`, `-dast-server-address string` | DAST server address. Default: `localhost:9055`. |
| `-dfp`, `-display-fuzz-points` | Display fuzz points in output for debugging. |
| `-fuzz-param-frequency int` | Frequency of uninteresting parameters before skipping. Default: `10`. |
| `-fa`, `-fuzz-aggression string` | Fuzzing aggression level controlling payload count: `low`, `medium`, `high`. Default: `low`. |
| `-cs`, `-fuzz-scope string[]` | In-scope URL regex followed by the fuzzer. |
| `-cos`, `-fuzz-out-scope string[]` | Out-of-scope URL regex excluded by the fuzzer. |

## Uncover

| Flag | Description |
| --- | --- |
| `-uc`, `-uncover` | Enable uncover engine. |
| `-uq`, `-uncover-query string[]` | Uncover search query. |
| `-ue`, `-uncover-engine string[]` | Uncover search engine: `shodan`, `censys`, `fofa`, `shodan-idb`, `quake`, `hunter`, `zoomeye`, `netlas`, `criminalip`, `publicwww`, `hunterhow`, `google`. Default: `shodan`. |
| `-uf`, `-uncover-field string` | Fields to return: `ip`, `port`, `host`. Default: `ip:port`. |
| `-ul`, `-uncover-limit int` | Number of uncover results to return. Default: `100`. |
| `-ur`, `-uncover-ratelimit int` | Override rate limit of engines with unknown rate limit. Default: `60 req/min`. |

## Rate Limit

| Flag | Description |
| --- | --- |
| `-rl`, `-rate-limit int` | Maximum requests per second. Default: `150`. |
| `-rld`, `-rate-limit-duration value` | Rate-limit duration window. Default: `1s`. |
| `-rlm`, `-rate-limit-minute int` | Maximum requests per minute. Deprecated. |
| `-bs`, `-bulk-size int` | Maximum hosts analyzed in parall

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [MingyiSecLab](https://github.com/MingyiSecLab)
- **Source:** [MingyiSecLab/Mingyi-Atlas](https://github.com/MingyiSecLab/Mingyi-Atlas)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mingyiseclab-mingyi-atlas-nuclei
- Seller: https://agentstack.voostack.com/s/mingyiseclab
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.