Docs

A short orientation to how Gawlo works. Deeper reference material is still being written — email us and we will answer directly in the meantime.

1. Create a project

A project is one target: a base URL plus optional auth. Gawlo maps the surface behind that target — HTTP endpoints, LLM endpoints, MCP servers — and everything else hangs off it. Create your first one from the projects page after signing in.

2. Run a scan

A scan runs discovery, then probes what it found: prompt injection, jailbreak and system-prompt-leak checks against LLM endpoints; tool poisoning, shadowing and rug-pull checks against MCP servers; and Nuclei-powered checks against the API and web surface. Scans run in the background — the scan page updates live and you can cancel one that is still queued or running.

3. Read the findings

Every finding carries the exact request and response that triggered it, so you can reproduce it yourself. Severity is assigned per check. Coverage is reported honestly: where a check was configured but not executed, the UI says so rather than implying a clean result.

4. Get a fix

Opening a finding can generate an AI remediation — root cause, impact, and a proposed patch. Remediation is generated on demand and its state is shown as it really is: pending, failed, or completed. A failed generation is never dressed up as a fix.

Questions

Nothing here answers your question? Write to support@gawlo.dev or use the contact page.