CAPEsandbox vs Scanii

CAPE (Config And Payload Extraction) is an open-source malware sandbox, forked from Cuckoo, that detonates submitted files and URLs to extract IOCs, dropped payloads, and decrypted configuration data through a REST API. Its docs point to a free public community instance at capesandbox.com; a live POST and OPTIONS preflight against its real apiv2/api-token-auth endpoint both returned no Access-Control-Allow-Origin header, resolving cors to no, and confirmed the instance issues a DRF token from a username/password exchange rather than a bare API key. Self-hosting the open-source project or registering on the community instance is free.

Scanii is a REST API that scans uploaded files, images, and text for malware, unsafe imagery, and inappropriate language across more than 100 image formats and 20+ languages, returning findings, checksums, and content metadata as JSON. A live GET and OPTIONS preflight against api.scanii.com/v2.2/files both returned Access-Control-Allow-Origin: *, and the GET's 401 carried a WWW-Authenticate: Basic realm="Scanii API" header, correcting the stored auth from API Key to Basic Auth (the API key is used as the Basic-auth username, its secret as the password) over HTTPS. New accounts start with free trial credits before moving to metered Starter/Plus/Enterprise plans billed per file scanned.