A modern web‑application security platform — proxy, scanner, repeater, fuzzer, and a built‑in AI that can drive the entire toolkit. And the one thing Burp can’t: multiple user profiles in one project, each in its own isolated sandbox — until you merge them into groups.
Charon runs multiple user profiles in a single project, and each one is a fully isolated sandbox — its own history, sitemap, scope, Repeater and logs, kept separate from the others. When you want a combined view, merge profiles into a group (or several groups) — that’s also how you replay traffic across accounts to surface broken access control (IDOR/BOLA). Burp is single‑user. Free for 2 profiles; a license unlocks up to 10 profiles and 5 groups.
Charon bundles the full engagement workflow — and keeps the pro features free.
380+ checks across injection, auth, access‑control, deserialization, request smuggling, GraphQL, SSRF and more — with a false‑positive verifier so findings are real.
Drives a real headless browser to catch DOM‑based XSS that only fires client‑side — the class response‑only scanners miss.
Run a local model (LM Studio / BionicGPT — free, private, on‑device) or plug in Claude / ChatGPT. Toggle anytime.
Built‑in MCP server: your AI can read traffic, launch scans, send requests, and triage findings — an autonomous co‑tester.
Multiple user profiles in one project, each an isolated sandbox (own history, scope, logs) until you merge them into groups. Replay across a group to catch IDOR/BOLA. Free for 2 profiles; up to 10 & 5 groups licensed.
Intercepting proxy, a Repeater with full request/response colouring, and a batch fuzzer that stores every request in the project file.
Built‑in HTTP + DNS out‑of‑band collaborator, and language‑agnostic script extensions — no JVM, no BApps.
APK/IPA static analysis (MASVS), plus HTML / executive / SARIF reports and CI gating out of the box.
Launch it and it updates itself — no reinstalls. New builds ship straight to your machine.
The capabilities Burp gates behind Pro/Enterprise — or simply lacks — are built in.
| Capability | Charon | Burp |
|---|---|---|
| Active scanner | ✓ 380+ checks, free | Pro only |
| Runtime DOM‑XSS | ✓ browser‑driven | Limited |
| Local‑AI assistant | ✓ LM Studio / BionicGPT | ✗ |
| AI drives the tool (MCP) | ✓ built‑in | ✗ |
| Out‑of‑band (DNS + HTTP) | ✓ free, self‑hosted | Collaborator (Pro/hosted) |
| Extensions | ✓ any language | Java/Jython |
| Sandboxed profiles in one project | ✓ isolated per profile · merge into groups | ✗ single user |
| JWT / IDOR / SBOM / CI gate | ✓ built in | Mixed / Enterprise |
| Auto‑updates | ✓ on launch | Manual |
Charon is in private release. Request a license key and we’ll send you one.
No. Charon runs entirely on your machine; projects are stored locally. If you use a local AI model (LM Studio/BionicGPT) nothing leaves your device. Paid AI providers only receive what you explicitly send, with secrets redacted.
Charon checks for a new build when it launches and updates itself — no reinstalling. You download once.
Windows (x64) and macOS (Apple Silicon) today. Linux is on the roadmap.
Yes — that’s a core feature. Point Charon at a local LM Studio or BionicGPT server, or use Claude/ChatGPT with an API key. The AI can also drive Charon via MCP.
Charon is for authorized security testing only — systems you own or have explicit permission to test. Scope controls keep active traffic on your authorized targets.