> ## Documentation Index
> Fetch the complete documentation index at: https://pentest-tools.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Flowmapper

> How AI browser agents map user flows to discover endpoints a traditional crawler misses

Flowmapper uses an AI browser agent to navigate your target website and uncover endpoints that traditional crawling misses. The agent interacts with the site like a real user: clicking links, filling and submitting forms, and following multi-step flows to build a fuller map of your application's attack surface.

It is integrated into the [Website Scanner](/tools/website-scanner) and runs alongside the standard spider.

## How it works

When Flowmapper is enabled, it runs as a parallel process during the spidering phase of a Website Scanner scan.

<Steps>
  <Step title="Spider starts">
    The Website Scanner begins its standard crawl against the target URL.
  </Step>

  <Step title="The AI agent launches in parallel">
    A planner agent analyzes the current page and breaks it into specific user journeys to explore, such as submitting a form or moving through a checkout flow. Worker browser agents then carry out those tasks in a real browser.
  </Step>

  <Step title="Requests are captured">
    As the agents browse, every HTTP request and response is recorded, including URLs, methods, headers, and status codes.
  </Step>

  <Step title="Endpoints feed back into the scanner">
    Discovered endpoints are filtered for scope and validity, then added to the spider's queue. The scanner tests them for vulnerabilities like any other discovered page.
  </Step>
</Steps>

<Note>
  The agent runs for up to half the scan's maximum time. For a scan with a 60-minute limit, Flowmapper runs for up to 30 minutes.
</Note>

## What it discovers

Flowmapper is effective at finding endpoints that traditional spiders struggle with:

<CardGroup cols={2}>
  <Card title="JavaScript-driven navigation" icon="code">
    Pages and routes rendered entirely by client-side JavaScript frameworks
  </Card>

  <Card title="Interactive workflows" icon="hand-pointer">
    Multi-step flows that require clicking buttons, expanding menus, or filling forms
  </Card>

  <Card title="Dynamic content" icon="arrows-rotate">
    Content loaded via AJAX requests or single-page application routing
  </Card>

  <Card title="Hidden functionality" icon="eye-slash">
    Endpoints reached only by submitting a form or completing a user flow
  </Card>
</CardGroup>

Each discovered endpoint includes its URL and HTTP method, the request headers sent during the interaction, the response status code, and POST data when applicable.

## Enabling Flowmapper

Flowmapper runs automatically when it is turned on in your AI settings. There is no per-scan switch: enable it once under **Account > AI > Flowmapper**, and it then runs during every Website Scanner scan that includes the spider.

<Note>
  Flowmapper is a paid AI feature. The toggle is managed by the organization owner and gated by your plan.
</Note>

### Confirming it ran

When Flowmapper runs during a scan, it adds a test entry to the scan results:

> **Performed Flowmapping**

This confirms the feature ran and contributed to the crawling phase.

## How it complements traditional spidering

The AI agent and the traditional spider run concurrently, each contributing endpoints to the same scanning pipeline.

| Approach               | Strengths                                                                         | Limitations                                                    |
| ---------------------- | --------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| **Traditional spider** | Fast, efficient for static sites, handles large volumes of pages                  | Misses JavaScript-rendered content and interactive flows       |
| **AI browser agent**   | Navigates dynamic content, interacts with UI elements, completes multi-step flows | Slower due to real browser interaction, limited by the timeout |

Together they cover more endpoints than either method alone. Endpoints discovered by the agent go through the same vulnerability testing as traditionally spidered pages.

## When Flowmapper stops early

If the agent hits bot protection or a challenge page (for example Cloudflare Turnstile, Arkose, or a generic CAPTCHA), it stops and the scan continues with the traditional spider. The same is true if the agent times out or fails for another reason: Flowmapper never blocks the rest of the scan.

## AI data handling

The Flowmapper browser agent sends the target site's content to a large language model to decide what to do next. That model is served through OpenRouter (currently Google's Gemini), a third-party AI provider. Only the target website's content is processed, and agent telemetry is disabled.

For the full details on processors, retention, and training, see our [AI Data Policy](/account-billing/security/where-to-find-policies#ai-data-policy).

## Related topics

* [Website Scanner](/tools/website-scanner)
* [ML Classifier](/ai/ml-classifier)
* [AI-enhanced authentication](/ai/authentication)
* [AI Data Policy](/account-billing/security/where-to-find-policies#ai-data-policy)