Wavely puts a shared Nuclei POC library behind a desktop GUI

What the Wavely client actually manages

Wavely is positioned as a local POC management and vulnerability validation platform for security researchers, built around Nuclei. The feature list is long but each item names a concrete object. Templates can be created, edited and deleted, imported by Template ID with de-duplication, and original templates can be added, so a team can mix community templates with its own work. Batch scanning runs multiple POCs against multiple targets with manual stop available. Reports export to xlsx and docx, and results can be exported from the scan progress view. A built-in toolbox adds IP subnet lookup, encoding and decoding, and ICMP host liveness probing, which is the kind of small utility that otherwise needs a separate tool open on the side.

Request capture and replay inside the same window

Two features separate Wavely from a plain template manager. The first is a packet capture tool that covers HTTP, HTTPS and WS traffic, and that can also capture through a front proxy, so traffic to a target that only speaks through an intercepting proxy can still be inspected. The second is request replay, a debugging path where a captured request can be sent again. Both sit next to the scanner, and the scan result view records every HTTP request and response a single POC produced, which is what makes a finding auditable rather than a bare status code. The editor side is also more than a text box: it offers theme switching, font adjustment, YAML syntax checking and automatic parsing of a raw request, so a template that fails to parse is caught before it reaches a scan run.

A shared POC server and the role model around it

Teams do not scan alone, and Wavely addresses that with a separate server program, downloaded from the project's releases, which hosts a shared POC library. Clients connect to that library, and the interface marks a connected shared library in the top corner. Around it sit the details that decide whether a shared library is usable: the left panel classifies by tag and by author so people can filter down to what they own or what they care about, and advanced search supports excluding fields as well as including them. The collaboration model also has roles and a review path for submitted POCs, so a template someone else wrote does not silently enter the shared library. This is the part of the project with the most organizational weight, and it is the part a team should evaluate first, because the value of a shared library depends on who maintains it.

Activation is a gate, not a formality

The client will not be used before it is activated. An activation code is obtained from the project's wiki, and the code is consumed on first use to generate a license. Activation writes a license file locally, and the README treats that file as the machine's own activation key and asks you to keep it safe. Its location differs by platform: on macOS and Linux it is at ~/.wavely/license, and on Windows it sits next to Wavely.exe. Someone who has already bought Wavely can import an existing license file instead. The practical consequence for an evaluation is that you cannot trial the tool by downloading it, and a team that wants the shared server as well has two activation surfaces to think about, one for the client and one for the service.

Installing on macOS and Windows, and the unsigned app problem

Installation is a file operation rather than a package manager step. On macOS you drag Wavely.app into the Applications folder, then remove the quarantine attribute so the system will run it:

sudo xattr -d com.apple.quarantine /Applications/Wavely.app

On Windows you download the latest archive, extract it and run Wavely-windows-installer.exe. Upgrades follow the same pattern: overwrite Wavely.app on macOS, or replace Wavely.exe on Windows. The macOS step is not optional in practice, because the app is not signed with an Apple developer certificate, and an unsigned app triggers messages such as the app being damaged and unopenable, or an unverifiable developer, or a prohibited symbol on the icon. The README offers the quarantine removal above as the recommended fix and a permissions repair as the second option:

chmod 755 /Applications/Wavely.app/Contents/MacOS/Wavely

A command window that flashes briefly on Windows at startup is described as normal and harmless.

Advanced configuration and how the scan behaves

The settings that matter during a run are exposed rather than hidden. A custom DNSLog target can be set, scan rate can be controlled, and several proxy options and request timeout settings are available. Search and filtering support combined keywords, group filters, advanced search and reloading POCs from the library. Scan tasks accept quick parameter settings and a global request header, and API testing supports endpoints as well as targets that carry a path. User configuration is persisted automatically, so a second launch does not need the same setup repeated. None of this is documented as tunable per severity or per template, and the README does not describe a scheduling mechanism, so recurring runs appear to be something you drive yourself rather than something the tool schedules.

What the disclaimer rules out

The disclaimer is specific and worth reading literally. The tool is for legitimate, authorised enterprise security work, and anyone wanting to see how it behaves is told to stand up a test environment of their own. The collected POCs are described as theoretical judgements of vulnerabilities that contain no exploitation process, and the tool does not launch real attacks or exploitation against targets. Scanning unauthorised targets is prohibited, and legal responsibility sits with the user. That boundary narrows the tool in a way that matters for a purchasing decision: this is a management and validation front end over vulnerability judgement, not an exploitation engine, and the disclaimer says so directly.

What the repository gives you, and what it does not

The repository top level holds LICENSE, README.md, READMEMERE.md, README_en.md, image.png and an imgs/ directory. There is no source code in the tree, no build files and no test suite, and the project is described as a binary distribution with a separate server program in the releases. The licence recorded for the repository is GPL-3.0, which is a strong licence to read, and it sits in tension with a client that only runs after an activation code is redeemed and a server program delivered as a download. That tension is a legal question rather than a technical one, and the README does not resolve it, so any team adopting Wavely should have its own review look at the licence file and the binary it covers before deployment. On maintenance, the last push was on 2026-04-24 and the newest release is v3.3.3 from the same day, with v3.3.2 on 2026-04-09 and v3.3.1 on 2026-03-17, so recent work is on the 3.3 line and the README documents 3.3.2 and 3.3.3 screenshots.

Editorial conclusion

Wavely fits a security team that already runs Nuclei, already has a library of templates worth sharing, and wants a desktop surface for editing, filtering and reviewing results instead of command lines and a file tree. It does not fit an engineer who needs to read the code, since the repository contains only documentation and images, and it does not fit anyone who has to justify running an activation-gated binary. Verify three things before you commit a team to it: that your legal review accepts a client that only runs after an activation code is redeemed, that the licence file in the repository actually covers the binary you download from the releases page, and that the POC library you point at the shared server contains the vulnerability judgement you expect, because the disclaimer states the collected POCs are theoretical assessments of vulnerabilities and contain no exploitation steps.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. perlh/Wavely on GitHub
4. README
5. Releases