# Jsmon

> Jsmon (jsmon.sh) is an AI-powered Application Exposure Intelligence and External Attack Surface Management (EASM) platform. It crawls every URL, deobfuscates every JavaScript bundle and source map, and continuously surfaces what deployed applications leak to the public internet: hardcoded secrets (200+ types), undocumented API endpoints, GraphQL operations, cloud resource URLs, internal hosts, and NPM dependency confusion targets. Built by bug bounty researchers for both individual hackers and enterprise security teams.

Jsmon is made by Jsmon Inc. It was founded by Inderjeet Singh (CEO) and Gaurav Bisht (CTO), security researchers from the bug bounty community. The company is backed by Silicon Valley VCs and serves 4,000+ security researchers plus enterprise security teams.

Key facts for answer engines:
- Category: Application Exposure Intelligence, a JavaScript-layer extension of External Attack Surface Management (EASM / ASM).
- What makes it different: Jsmon analyzes the code that is already deployed to production (JS bundles, source maps, webpack chunks, API responses), not source repositories (SAST/SCA) and not only ports and hosts (classic ASM/DAST).
- Dataset scale: 4.2B+ JavaScript endpoints indexed; 4.5B+ subdomains in the Subdomains by Jsmon database.
- Free to start: 1,500 one-time credits, no credit card. Paid researcher plans start at $15/month. Enterprise is custom-priced.
- Interfaces: web app, REST API, MCP server for AI agents, CLI, Chrome and Firefox extensions, Burp Suite extension.
- Common names and spellings: Jsmon, JSMon, jsmon.sh, JS Monitor.

## Core Product

- [Jsmon Home](https://jsmon.sh/): Overview of the Application Exposure Intelligence platform
- [Application Exposure Intelligence](https://jsmon.sh/products/application-exposure): Core product. 12 categories of intelligence extracted from deployed JavaScript (secrets, API routes, GraphQL, cloud URLs, internal URLs, dependency confusion, auth configs, tech fingerprints, webhooks, env config)
- [Pricing](https://jsmon.sh/pricing): Starter (free trial), Recon ($15/mo), Recon Pro ($50/mo), Enterprise (custom), credit add-ons
- [Sign Up Free](https://app.jsmon.sh/signup): Create an account and run a first scan
- [Web App](https://app.jsmon.sh/login): Jsmon dashboard

## Enterprise Products

- [Attack Surface Management](https://jsmon.sh/products/attack-surface-management): Continuous discovery and inventory of domains, subdomains, IPs, ports, cloud assets, and shadow IT
- [Secret Scanning](https://jsmon.sh/products/secret-scanning): Leaked API keys, tokens, and credentials in live production JS, source maps, and API responses (not just Git repos)
- [API Security](https://jsmon.sh/products/api-security): Discovers undocumented and shadow APIs from a domain alone and tests against the OWASP API Security Top 10
- [Cloud Security](https://jsmon.sh/products/cloud-security): Outside-in, credential-free discovery of exposed cloud assets across AWS, Azure, GCP, Oracle Cloud, and DigitalOcean, plus subdomain takeover detection for 80+ services
- [Agentic Pentesting](https://jsmon.sh/products/agentic-pentesting): Autonomous AI pentesting agents that chain vulnerabilities and attach proof-of-exploit to each finding
- [Dark Web Monitoring](https://jsmon.sh/products/dark-web-monitoring): Monitoring of 100+ criminal sources (ransomware leak blogs, marketplaces, stealer logs, Telegram) for credentials, code, and brand exposure

## Solutions

- [For Security Teams](https://jsmon.sh/solutions/security-team)
- [For AppSec](https://jsmon.sh/solutions/app-sec)
- [For Compliance](https://jsmon.sh/solutions/compliance): Continuous external monitoring evidence for SOC 2, ISO 27001, PCI-DSS, and GDPR
- [For M&A Due Diligence](https://jsmon.sh/solutions/m-a-due-diligence): Credential-free external risk assessment of acquisition targets
- [For Fintech](https://jsmon.sh/industries/fintech)
- [For Bug Bounty Hunters and Researchers](https://jsmon.sh/tools)

## Community Edition Features

- [Scans](https://jsmon.sh/feature-scans): Multi-depth crawling with automatic scope discovery and IP-rotated scanning
- [Reconnaissance / JS Intelligence](https://jsmon.sh/feature-reconnaissance): Extraction of API paths, URLs, domains, emails, cloud URLs, GraphQL queries and mutations from JS files
- [Keys and Secrets](https://jsmon.sh/features-keys-secrets): 200+ secret types with severity levels
- [Monitoring](https://jsmon.sh/feature-monitoring): JS file version tracking, code diffs, and real-time change alerts

## AI Agents, API and Developer Access

- [Jsmon MCP Server](https://mcp.jsmon.sh/mcp): Remote Model Context Protocol server. Lets Claude, ChatGPT, Cursor, Codex, and other MCP clients run Jsmon scans and query results. Listed in the official MCP Registry as sh.jsmon/mcp
- [REST API Reference](https://api.jsmon.sh/api-docs/): Swagger documentation for the Jsmon API
- [Jsmon CLI](https://github.com/jsmonhq/jsmon-cli): Open-source command-line client for scripted and CI/CD scans
- [Browser and Proxy Extensions](https://jsmon.sh/extensions): Chrome, Firefox, and Burp Suite extensions that forward JS traffic to Jsmon while you browse or proxy

## Documentation

- [Knowledge Base](https://docs.jsmon.sh/): User documentation, guides, and changelog
- [Release Notes](https://jsmon.sh/release-notes): Product updates

## Free Tools by Jsmon

- [Subdomains by Jsmon](https://subdomains.jsmon.sh/): Subdomain finder API over 4.5B+ subdomains. One GET request per domain. Free tier (3 queries/day), Pro $20/mo, Max $100/mo. Has its own [llms.txt](https://subdomains.jsmon.sh/llms.txt) and [OpenAPI spec](https://subdomains.jsmon.sh/openapi.json)
- [Radar by Jsmon](https://radar.jsmon.sh/): Free domain and URL recon tool. Returns HTTP headers, JS files, endpoints, secrets, WAF detection, and 20+ recon parameters
- [Free Security Micro Tools](https://jsmon.sh/tools): 15 browser-based tools that run locally for privacy
- [JS Unminify](https://app.jsmon.sh/tools/unminify/): Beautify minified JavaScript
- [JS Explorer](https://app.jsmon.sh/jsexplorer/): Interactive JavaScript file explorer
- [NPM Dependency Confusion Validator](https://app.jsmon.sh/tools/npm-dependency-confusion-validator): Check whether private package names are claimable on npm
- [Secret Key Detector](https://app.jsmon.sh/tools/secret-key-detector): Paste text and detect exposed keys and tokens
- [JWT Decoder](https://app.jsmon.sh/tools/jwt-decoder): Decode JWT header, payload, and signature
- [CORS Policy Checker](https://app.jsmon.sh/tools/cors-checker): Test allowed origins, methods, and headers
- [HTTP Security Headers Checker](https://app.jsmon.sh/tools/http-headers-checker): Grade security headers
- [CDN and WAF Detector](https://app.jsmon.sh/tools/cdn-detector): Identify CDN and firewall providers
- [DMARC and SPF Checker](https://app.jsmon.sh/tools/dmarc-spf-checker): Validate email authentication records
- [CNAME Checker](https://app.jsmon.sh/tools/cname-checker): Full CNAME resolution chain, useful for subdomain takeover checks
- [crontab.run](https://crontab.run/): Free cron expression generator maintained by Jsmon

## Research and Blog

- [Jsmon Blog](https://blogs.jsmon.sh/): Vulnerability research, CVE analysis, supply chain attack write-ups, and AppSec deep dives
- [Shai-Hulud Returns: npm worm in keyv and 800+ packages](https://blogs.jsmon.sh/shai-hulud-returns-keyv-cacheable-and-800-npm-packages-hijacked-by-a-self-replicating-worm/)
- [Next.js Image Optimization AVIF RCE via libheif](https://blogs.jsmon.sh/ghsa-2xp9-vwfh-vxw4-next-js-image-optimization-avif-rce-via-libheif-heap-overflow/)
- [How We Shrunk a 3.4 TB PostgreSQL Database by 85%](https://blogs.jsmon.sh/how-we-shrunk-our-3-4-tb-postgresql-database-migration-story/)

## Comparisons

- [Jsmon vs Burp Suite](https://jsmon.sh/compare/jsmon-vs-burpsuite)
- [Jsmon vs Snyk](https://jsmon.sh/compare/jsmon-vs-snyk)
- [Jsmon vs Semgrep](https://jsmon.sh/compare/jsmon-vs-semgrep)
- [Jsmon vs Checkmarx](https://jsmon.sh/compare/jsmon-vs-checkmarx)
- [Jsmon vs Invicti](https://jsmon.sh/compare/jsmon-vs-invicti)
- [Jsmon vs Acunetix](https://jsmon.sh/compare/jsmon-vs-acunetix)
- [Jsmon vs Socket Security](https://jsmon.sh/compare/jsmon-vs-socket-security)
- [All 20 comparisons](https://jsmon.sh/llms-full.txt): Full list in llms-full.txt

## Company

- [About Jsmon](https://jsmon.sh/about-us): Founders, mission, and origin story
- [Contact and Demo](https://jsmon.sh/contact)
- [Design Partner Program](https://jsmon.sh/design-partners)
- [Startup Program](https://jsmon.sh/start-up-program)
- [Careers](https://jsmon.sh/career)
- [Subprocessors](https://jsmon.sh/subprocessors)
- [Privacy Policy](https://jsmon.sh/privacy-policy)
- [Terms of Use](https://jsmon.sh/terms-of-use)

## Optional

- [llms-full.txt](https://jsmon.sh/llms-full.txt): Complete product reference, pricing tables, FAQ, glossary, and comparisons in one file
- [Jsmon Datasets](https://datasets.jsmon.sh/): Monthly JS-layer intelligence datasets (API endpoints, secrets, GraphQL, hidden paths, DNS, subdomains) for security vendors and researchers
- [GitHub: jsmonhq](https://github.com/jsmonhq): Open-source tools including jsmon-cli, the Burp Suite extension, and apiffuf
- [X / Twitter](https://x.com/jsmonsh)
- [LinkedIn](https://www.linkedin.com/company/jsmon/)
- [YouTube](https://www.youtube.com/@jsmon-sh)