Get Started

Cacheability

Parse Cache-Control/Expires/Pragma/Vary and RFC 9111 status/method defaults to determine if a response is cacheable.

Live cache state

Detect HIT/MISS/STALE/EXPIRED/BYPASS via known CDN headers, with a timing/Age heuristic fallback.

CDN fingerprinting

Identify the fronting CDN/reverse proxy via CNAME chain resolution and Server/Via header matching.

Cache key & Vary

Probe what actually varies the cache key — declared Vary headers vs. undeclared/unkeyed inputs.

Security testing

Opt-in cache poisoning and cache deception probes for live, authorized targets.

Quick start

# Install
go install github.com/cerberauth/cache-detective@latest

# Analyze a single URL
cache-detective scan --url https://example.com/

# JSON output for CI
cache-detective scan --url https://example.com/ --output-format json --output report.json

# Cache poisoning / cache deception probing (opt-in, non-destructive by default)
cache-detective scan --url https://example.com/ --aggressive

Explore the docs

Installation Install via go install, Homebrew, or Docker.

CLI reference All commands, flags, and exit codes.

Checks What each check looks for and why it matters.

Guides Crawling a site, CI drift detection, and more.

GitHub Actions Run cache-detective in CI.

Docker Run cache-detective from a container — no local Go toolchain required.