Hey everyone,
I’ve been working on a project for a while that I think solves a real problem many of us face: the fragmentation of our security workflows. We jump between Bash for glue, Python for scripting, separate tools for recon, web testing, and exploitation, and then manually stitch together reports.
I wanted something that unified all of that. So I built Spectator — a purpose-built scripting language for cybersecurity work.
What it is:
Spectator is a compiled language with built-in security modules, a native GUI framework, and a package manager — all in a single standalone binary. No dependencies, no pip install chains, no environment setup.
Here’s a quick recon example:
target = "``scanme.nmap.org``"
ips = resolve(target)
Trace("IPs: " --> join(ips, ", "))
do --> PortScan(target, 1, 1024)
do --> SSLInfo(target)
And here’s how you’d build a simple GUI pentest tool:
#Import Spec.GUI
open.window({"title": "Ghost Recon", "bg": "#070b14", "accent": "#00d4aa"})
GUI.input("target", "Enter target...")
GUI.button("Scan", "run", {"color": "#00d4aa"})
GUI.output("out", {"height": 400})
GUI.on("run", func() {
t = GUI.get("target")
ips = resolve(t)
each ip : ips { GUI.print("out", " IP: " --> ip) }
})
end()
Key features:
-
Built-in security modules — Recon, OSINT, Web, Exploitation, Fuzzing, Payloads, Crypto, Encoding, Hashing (177 built-in functions total)
-
Native GUI framework — Build real desktop security tools without Electron or web frameworks
-
Full HTTP engine — Sessions, fuzzing, multi-request, extraction
-
Mission Engine — Structured pentest pipeline with HTML report generation
-
Space package manager — SHA-256 verified library installs (supply-chain attacks blocked by default)
-
Cross-compilation — Build standalone binaries for Windows, Linux, macOS, FreeBSD, ARM
-
Single binary — No runtime, no dependencies, fully self-contained
Platform support:
CLI/TUI works on Windows, Linux, and macOS. GUI support is currently Windows-focused (WebView2), with Linux/macOS support via WebKitGTK/WKWebView available but less mature.
What I’m looking for:
I know this is an ambitious project. I’m not here to claim it replaces Python or Bash for everything — it doesn’t. But I think it fills a gap for security professionals who want a faster, more unified way to script their workflows.
I’d genuinely love your feedback:
-
Does this solve a problem you actually have?
-
What’s missing that would make it useful for your workflow?
-
Any concerns about the approach?
Links:
-
GitHub: GitHub - CzaxStudio/Spectator: A programming language made for cybersecurity · GitHub
-
Docs: GitHub - CzaxStudio/SpectatorDocs: Spectator programming language official documentation · GitHub
-
Website: https://spectatorcyber.pages.dev
If you try it out, let me know what you think. I’m actively developing this and every piece of feedback helps.
Thanks for reading.
1 Important point to note:
I have been building this tool for two years. I would appreciate it if you starred the repo. There might be some issues with this programming language, but I will work hard to fix them.