Catalog comparison
ThorfinnZAP (Zed Attack Proxy)
Side-by-side facts from the TestGuild Tool Matcher catalog. Empty cells mean the catalog does not list that attribute — not that the product lacks it.
Open-source automated DAST framework for Android apps from PhonePe. Drop in an APK (or target a package on a connected device/emulator): Thorfinn decompiles with JADX/APKTool, traces Android-specific taint flows (intents, deep links, WebViews, Content Providers) with Tai-e plus Semgrep, TruffleHog, and Manifest checks, then uses LLMs (OpenAI, Anthropic, Gemini, or GitHub Copilot CLI) to triage findings, generate adb PoCs, and validate exploitability on-device. HTML/JSON reports include source-to-sink paths and runtime evidence. Apache-2.0.
The world's most widely used web app scanner. Free and open source DAST tool by Checkmarx. A community based GitHub Top 1000 project that anyone can contribute to.
At a glance
Primary testing surface
Thorfinn
Security
ZAP (Zed Attack Proxy)
Security
Primary capability
Thorfinn
Security
ZAP (Zed Attack Proxy)
Security
License and pricing
Thorfinn
free
ZAP (Zed Attack Proxy)
free · open source
Free trial
Thorfinn
No
ZAP (Zed Attack Proxy)
No
Complexity
Thorfinn
advanced
ZAP (Zed Attack Proxy)
intermediate
Team fit
Thorfinn
enterprise, large, medium, small
ZAP (Zed Attack Proxy)
enterprise, large, medium, small
Test authoring languages
Thorfinn
Java, Kotlin, Python
ZAP (Zed Attack Proxy)
Java, JavaScript, Python, REST API
Supported platforms
Thorfinn
android, apk, cli, emulators, linux, macos, real devices
ZAP (Zed Attack Proxy)
CLI, Docker, Linux, macOS, Web, Windows
MCP server
Thorfinn
No
ZAP (Zed Attack Proxy)
No
Key features (catalog)
Thorfinn
Automated Android DAST from APK / installed package, Detects intent redirection, WebView issues, Content Provider path traversal, and more, Diff and re-run modes to skip prior findings and save LLM tokens, HTML and JSON reports with taint paths, payloads, and runtime evidence, Integrates Tai-e, Semgrep, TruffleHog, and PermissionChecker, LLM triage and PoC generation (OpenAI, Anthropic, Gemini, GitHub Copilot CLI), Manifest auditing for exported components, permissions, and insecure flags, On-device/emulator PoC execution via adb with interactive or auto-approve modes, Open-source Apache-2.0 (PhonePe), Source-to-sink taint tracing across intents, extras, deep links, and components
ZAP (Zed Attack Proxy)
Active scanning capabilities, API security testing, Authentication support, Automated security scanning, CI/CD integration, Community-driven development, Comprehensive reporting, Cross-platform support (Windows, Mac, Linux), Docker container support, Dynamic Application Security Testing (DAST) +9 more
Limitations (catalog)
Thorfinn
Android-only — not a web, iOS, or general network DAST scanner, Authorized testing only — not for unauthorized app assessment, Large APKs may need heap/time limits; whole-program analysis can be heavy, LLM-generated adb commands should be reviewed; auto-approve is unsafe on untrusted targets, Requires Java 17, Maven, ADB, connected device/emulator, and LLM API access for full triage/PoC flow
ZAP (Zed Attack Proxy)
Limited enterprise support options, Limited to web application testing, May generate false positives requiring manual review, No built-in SAST capabilities, No mobile app security testing, Requires manual configuration for complex applications, Requires security expertise to use effectively, Steep learning curve for advanced features
| Attribute | Thorfinn | ZAP (Zed Attack Proxy) |
|---|---|---|
| Primary testing surface | Security | Security |
| Primary capability | Security | Security |
| License and pricing | free | free · open source |
| Free trial | No | No |
| Complexity | advanced | intermediate |
| Team fit | enterprise, large, medium, small | enterprise, large, medium, small |
| Test authoring languages | Java, Kotlin, Python | Java, JavaScript, Python, REST API |
| Supported platforms | android, apk, cli, emulators, linux, macos, real devices | CLI, Docker, Linux, macOS, Web, Windows |
| MCP server | No | No |
| Key features (catalog) | Automated Android DAST from APK / installed package, Detects intent redirection, WebView issues, Content Provider path traversal, and more, Diff and re-run modes to skip prior findings and save LLM tokens, HTML and JSON reports with taint paths, payloads, and runtime evidence, Integrates Tai-e, Semgrep, TruffleHog, and PermissionChecker, LLM triage and PoC generation (OpenAI, Anthropic, Gemini, GitHub Copilot CLI), Manifest auditing for exported components, permissions, and insecure flags, On-device/emulator PoC execution via adb with interactive or auto-approve modes, Open-source Apache-2.0 (PhonePe), Source-to-sink taint tracing across intents, extras, deep links, and components | Active scanning capabilities, API security testing, Authentication support, Automated security scanning, CI/CD integration, Community-driven development, Comprehensive reporting, Cross-platform support (Windows, Mac, Linux), Docker container support, Dynamic Application Security Testing (DAST) +9 more |
| Limitations (catalog) | Android-only — not a web, iOS, or general network DAST scanner, Authorized testing only — not for unauthorized app assessment, Large APKs may need heap/time limits; whole-program analysis can be heavy, LLM-generated adb commands should be reviewed; auto-approve is unsafe on untrusted targets, Requires Java 17, Maven, ADB, connected device/emulator, and LLM API access for full triage/PoC flow | Limited enterprise support options, Limited to web application testing, May generate false positives requiring manual review, No built-in SAST capabilities, No mobile app security testing, Requires manual configuration for complex applications, Requires security expertise to use effectively, Steep learning curve for advanced features |
How the trade-offs apply to your team
Guidance below is inferred only from catalog differences. It is not a winner pick.
Consider Thorfinn if…
- you need coverage for android, apk, emulators, real devices
- your team writes tests in Kotlin
- you care about Automated Android DAST from APK / installed package and Detects intent redirection, WebView issues, Content Provider path traversal, and more
Consider ZAP (Zed Attack Proxy) if…
- you need coverage for Docker, Web, Windows
- your team writes tests in JavaScript, REST API
- open source matters for your team
- you care about Active scanning capabilities and API security testing
Questions to verify before choosing
- Confirm current pricing and packaging on the Thorfinn and ZAP (Zed Attack Proxy) websites.
- Trial both tools against a real slice of your application, not a demo site.
- Verify the exact browser, device, or OS matrix you must support.