diff --git a/.github/workflows/mantis-cli-release.yml b/.github/workflows/mantis-cli-release.yml
index 53699f62..00b689fc 100644
--- a/.github/workflows/mantis-cli-release.yml
+++ b/.github/workflows/mantis-cli-release.yml
@@ -35,7 +35,7 @@ jobs:
           python-version: '3.9'
 
       - name: Install Poetry
-        run: pip install poetry==1.4.2
+        run: pip install poetry==1.8.4
   
       - name: Bump poetry version and add git tag
         uses: ./.github/actions/bump-version-and-git-tag
@@ -50,6 +50,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Set up QEMU (for multi-arch builds)
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Log in to the Container registry
         uses: docker/login-action@v2
         with:
@@ -68,6 +74,7 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: |
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.LATEST_IMAGE_VERSION }}
               ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
diff --git a/Dockerfile b/Dockerfile
index 098737e8..0121416b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,113 +1,40 @@
-FROM golang:1.22 as go-wayback-builder
-RUN git clone https://github.com/Abhinandan-Khurana/go-wayback.git
-WORKDIR go-wayback
-RUN GOOS=linux GOARCH=amd64 go build -o go-wayback v2/main.go
-RUN chmod +x go-wayback
-RUN cp go-wayback /usr/bin/
-
-FROM --platform=linux/amd64 python:3.9-slim
-
-# Install wget
-RUN apt-get update && apt-get install -y wget unzip tar gcc libpcap-dev dnsutils git dnstwist
-
-# Install git
-RUN apt-get update --fix-missing && apt install git -y
+# syntax=docker/dockerfile:1
+#
+# Multi-arch image. Build with buildx to target amd64 + arm64:
+#   docker buildx build --platform linux/amd64,linux/arm64 -t <tag> --push .
+# A plain `docker build` still works and targets the host arch.
+#
+# NOTE: go-wayback and go_virustotal are intentionally NOT installed here (they lack
+# multi-arch prebuilt binaries and need a dedicated source-build; tracked separately).
+# Their modules will be unavailable until re-added.
+
+FROM python:3.9-slim
+
+# System packages: build/runtime deps for the recon tools + installer prerequisites.
+# libpcap-dev -> naabu SYN scan; dnsutils -> dig; git/curl/unzip/tar -> installer.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        wget unzip tar gcc g++ libpcap-dev dnsutils git curl ca-certificates gnupg \
+    && rm -rf /var/lib/apt/lists/*
+
+# yq (mikefarah v4) — required by the tool manifest installer.
+# Detect arch at build time so this works on both amd64 and arm64.
+RUN ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') \
+    && curl -fsSL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_${ARCH}" \
+        -o /usr/bin/yq \
+    && chmod +x /usr/bin/yq
 
 # Setup work directory
 WORKDIR /home/mantis
 
-# Install subfinder 
-RUN echo "Installing subfinder"
-RUN wget https://github.com/projectdiscovery/subfinder/releases/download/v2.6.6/subfinder_2.6.6_linux_amd64.zip
-RUN unzip subfinder_2.6.6_linux_amd64.zip
-RUN mv subfinder /usr/bin
-RUN rm -rf *
-
-# Install Go_Virustotal
-RUN echo "Installing Go_Virustotal"
-RUN wget https://github.com/Abhinandan-Khurana/go_virustotal/releases/download/v1.0.1/go_virustotal-linux-v1.0.1
-RUN mv go_virustotal-linux-v1.0.1 go_virustotal
-RUN chmod +x go_virustotal
-RUN mv go_virustotal /usr/bin/
-
-# Install Go_Wayback
-COPY --from=go-wayback-builder /usr/bin/go-wayback /usr/bin
-
-# Install HTTPX
-RUN echo "Installing HTTPX"
-RUN wget https://github.com/projectdiscovery/httpx/releases/download/v1.6.8/httpx_1.6.8_linux_amd64.zip
-RUN unzip httpx_1.6.8_linux_amd64.zip
-RUN mv httpx /usr/bin
-RUN rm -rf *
-
-# Install Findcdn
-RUN echo "Installing Findcdn"
-RUN pip install git+https://github.com/cisagov/findcdn.git
-
-# Install Ipinfo
-RUN echo "Installing Ipinfo"
-RUN wget https://github.com/ipinfo/cli/releases/download/ipinfo-3.3.1/ipinfo_3.3.1_linux_amd64.tar.gz
-RUN tar -xvf ipinfo_3.3.1_linux_amd64.tar.gz
-RUN mv ipinfo_3.3.1_linux_amd64 ipinfo
-RUN mv ipinfo /usr/bin
-RUN rm -rf *
-
-# Install naabu
-RUN echo "Installing naabu"
-RUN wget https://github.com/projectdiscovery/naabu/releases/download/v2.1.9/naabu_2.1.9_linux_amd64.zip
-RUN unzip naabu_2.1.9_linux_amd64.zip
-RUN mv naabu /usr/bin
-RUN rm -rf *
-
-# Install nuclei
-RUN echo "Installing nuclei"
-RUN wget https://github.com/projectdiscovery/nuclei/releases/download/v3.3.4/nuclei_3.3.4_linux_amd64.zip
-RUN unzip nuclei_3.3.4_linux_amd64.zip
-RUN mv nuclei /usr/bin
-RUN rm -rf *
-
-# Install gitleaks 
-RUN echo "Installing gitleaks"
-RUN wget https://github.com/gitleaks/gitleaks/releases/download/v8.18.1/gitleaks_8.18.1_linux_x64.tar.gz
-RUN tar -xvf gitleaks_8.18.1_linux_x64.tar.gz
-RUN mv gitleaks /usr/bin
-RUN rm -rf *
-
-# Install wafw00f
-RUN pip install wafw00f
-
-#Install gau
-RUN echo "Installing GAU"
-RUN wget https://github.com/lc/gau/releases/download/v2.2.1/gau_2.2.1_linux_amd64.tar.gz
-RUN tar -xvf gau_2.2.1_linux_amd64.tar.gz
-RUN mv gau /usr/bin
-RUN rm -rf *
-
-# Installing Corsy
-RUN echo "Installing Corsy"
-RUN wget https://github.com/s0md3v/Corsy/archive/refs/tags/1.0-rc.zip
-RUN unzip 1.0-rc.zip
-RUN mv Corsy-1.0-rc Corsy
-RUN mv Corsy /usr/bin
-RUN rm -rf *
-
-# Install Poetry
-RUN pip install poetry==1.4.2
-
-# Add Poetry to PATH
-ENV PATH="/root/.local/bin:$PATH"
-
-# Setup Poetry ENV variables
-ENV POETRY_NO_INTERACTION=1 \
-    POETRY_VIRTUALENVS_IN_PROJECT=0 \
-    POETRY_VIRTUALENVS_CREATE=0 \
-    POETRY_CACHE_DIR=/tmp/poetry_cache
-
-# Copy pyproject.toml and poetry.lock
-COPY pyproject.toml poetry.lock* /home/mantis/
+# Install external recon tools from the platform-aware manifest (single source of truth).
+COPY configs/tools.yml /home/mantis/configs/tools.yml
+COPY setup/install_tools.sh /home/mantis/setup/install_tools.sh
+RUN chmod +x /home/mantis/setup/install_tools.sh \
+    && /home/mantis/setup/install_tools.sh docker /home/mantis/configs/tools.yml
 
-# Install dependencies using Poetry
-RUN poetry install --without dev --no-root && rm -rf $POETRY_CACHE_DIR
+# Install Python dependencies
+COPY requirements.txt /home/mantis/
+RUN pip install --no-cache-dir -r /home/mantis/requirements.txt
 
 # Creating Mantis alias
 RUN echo 'export PS1="🦗 Mantis > " && \
diff --git a/configs/tools.yml b/configs/tools.yml
new file mode 100644
index 00000000..f2df4359
--- /dev/null
+++ b/configs/tools.yml
@@ -0,0 +1,147 @@
+# Mantis external-tool manifest — single source of truth for recon tool versions.
+#
+# Consumed by setup/install_tools.sh (used by both the Dockerfile and native-setup.sh).
+# The installer detects the host platform ({linux|darwin}/{amd64|arm64}) and resolves
+# each tool's download using the per-tool os_tokens / arch_tokens maps below, because
+# every project names its release assets differently (amd64 vs x64, linux vs macOS, etc.).
+#
+# Fields per tool:
+#   name          final command name placed in install_dir (must match how mantis invokes it)
+#   method        binary | pip | source
+#   version       tool version (also substituted into url/bin_in_archive templates)
+#   targets        which install paths include this tool: [docker, native] (default both)
+#   archive        binary only: zip | tar.gz | none
+#   url            binary only: download template; {version}/{os}/{arch} are substituted
+#   os_tokens      binary only: map host OS (linux/darwin) -> the token this project uses
+#   arch_tokens    binary only: map host arch (amd64/arm64) -> the token this project uses
+#   bin_in_archive binary only: file name inside the archive (templatable); default = name
+#   sha256         binary only: optional per-platform checksum (see checksums: below). Empty = skip verify.
+#   go_module      binary only: optional `go install` fallback used when no prebuilt asset exists
+#                  and the Go toolchain is available (mainly for unusual arches / native installs)
+#   pip_spec       pip only: pip requirement (package name or VCS URL)
+#   extracted_dir  source only: directory name inside the archive after extraction
+#   dest           source only: absolute destination path
+#   runtime_deps   informational: OS packages the tool needs at runtime (used by `mantis doctor`)
+#
+# Checksums are intentionally left empty for now (filled in later by the upgrade-PR action).
+
+install_dir: /usr/bin
+
+tools:
+  # ---- ProjectDiscovery tools (linux/darwin x amd64/arm64 prebuilt binaries) ----
+  - name: subfinder
+    method: binary
+    version: "2.14.0"
+    archive: zip
+    bin_in_archive: subfinder
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/subfinder/releases/download/v{version}/subfinder_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/subfinder/v2/cmd/subfinder@v{version}"
+    runtime_deps: []
+
+  - name: httpx
+    method: binary
+    version: "1.10.0"
+    archive: zip
+    bin_in_archive: httpx
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/httpx/releases/download/v{version}/httpx_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/httpx/cmd/httpx@v{version}"
+    runtime_deps: []
+
+  - name: naabu
+    method: binary
+    version: "2.6.1"
+    archive: zip
+    bin_in_archive: naabu
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/naabu/releases/download/v{version}/naabu_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/naabu/v2/cmd/naabu@v{version}"
+    runtime_deps: [libpcap]
+
+  - name: nuclei
+    method: binary
+    version: "3.11.0"
+    archive: zip
+    bin_in_archive: nuclei
+    os_tokens: { linux: linux, darwin: macOS }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/projectdiscovery/nuclei/releases/download/v{version}/nuclei_{version}_{os}_{arch}.zip"
+    go_module: "github.com/projectdiscovery/nuclei/v3/cmd/nuclei@v{version}"
+    runtime_deps: []
+
+  # ---- gitleaks: note arch token is x64 (not amd64) ----
+  - name: gitleaks
+    method: binary
+    version: "8.30.1"
+    archive: tar.gz
+    bin_in_archive: gitleaks
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: x64, arm64: arm64 }
+    url: "https://github.com/gitleaks/gitleaks/releases/download/v{version}/gitleaks_{version}_{os}_{arch}.tar.gz"
+    go_module: "github.com/gitleaks/gitleaks/v8@v{version}"
+    runtime_deps: []
+
+  - name: gau
+    method: binary
+    version: "2.2.4"
+    archive: tar.gz
+    bin_in_archive: gau
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/lc/gau/releases/download/v{version}/gau_{version}_{os}_{arch}.tar.gz"
+    go_module: "github.com/lc/gau/v2/cmd/gau@v{version}"
+    runtime_deps: []
+
+  # ---- ipinfo: extracted binary is named ipinfo_{version}_{os}_{arch} ----
+  - name: ipinfo
+    method: binary
+    version: "3.3.2"
+    archive: tar.gz
+    bin_in_archive: "ipinfo_{version}_{os}_{arch}"
+    os_tokens: { linux: linux, darwin: darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/ipinfo/cli/releases/download/ipinfo-{version}/ipinfo_{version}_{os}_{arch}.tar.gz"
+    runtime_deps: []
+
+  # ---- amass: native path only (not currently shipped in the Docker image) ----
+  - name: amass
+    method: binary
+    version: "4.1.0"
+    targets: [native]
+    archive: zip
+    bin_in_archive: amass
+    os_tokens: { linux: Linux, darwin: Darwin }
+    arch_tokens: { amd64: amd64, arm64: arm64 }
+    url: "https://github.com/owasp-amass/amass/releases/download/v{version}/amass_{os}_{arch}.zip"
+    go_module: "github.com/owasp-amass/amass/v4/...@v{version}"
+    runtime_deps: []
+
+  # ---- Python tools (architecture-independent) ----
+  - name: findcdn
+    method: pip
+    pip_spec: "git+https://github.com/cisagov/findcdn.git"
+    runtime_deps: []
+
+  - name: wafw00f
+    method: pip
+    pip_spec: "wafw00f"
+    runtime_deps: []
+
+  - name: dnstwist
+    method: pip
+    pip_spec: "dnstwist[full]"
+    runtime_deps: []
+
+  # ---- Corsy: cloned to a directory; mantis calls python3 /usr/bin/Corsy/corsy.py ----
+  - name: Corsy
+    method: source
+    version: "1.0-rc"
+    archive: zip
+    extracted_dir: "Corsy-{version}"
+    dest: "/usr/bin/Corsy"
+    url: "https://github.com/s0md3v/Corsy/archive/refs/tags/{version}.zip"
+    runtime_deps: []
diff --git a/pyproject.toml b/pyproject.toml
index baa54f33..f41b1648 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -37,7 +37,7 @@ typing_extensions = "4.4.0"
 validators = "0.20.0"
 tldextract = "3.4.0"
 pytz = "2022.6"
-ray = {version = "2.8.0", extras = ["default"]}
+ray = {version = "2.31.0", extras = ["default"]}
 retry = "0.9.2"
 slack-sdk = "3.21.3"
 rocketry = "2.5.1"
diff --git a/requirements.txt b/requirements.txt
index 13c1f53f..97f06413 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,7 +8,7 @@ typing_extensions==4.4.0
 validators==0.20.0
 tldextract==3.4.0
 pytz==2022.6
-ray[default]==2.8.0
+ray[default]==2.31.0
 retry==0.9.2
 slack-sdk==3.21.3
 rocketry==2.5.1
diff --git a/setup/docker/docker-compose.yml b/setup/docker/docker-compose.yml
index 465c6171..5005b4e2 100644
--- a/setup/docker/docker-compose.yml
+++ b/setup/docker/docker-compose.yml
@@ -2,10 +2,10 @@ services:
   mantis:
     # When testing local changes, uncomment the following commented lines and comment out "image"
     # This will build the mantis container locally instead of pulling from GHRC
-    #build:
-    #  dockerfile: Dockerfile
-    #  context: ../../
-    image: ghcr.io/phonepe/mantis:latest
+    build:
+      dockerfile: Dockerfile
+      context: ../../
+    #image: ghcr.io/phonepe/mantis:latest
     container_name: mantis
     restart: on-failure
     command: sleep infinity
@@ -29,6 +29,7 @@ services:
     environment:
       MONGO_INITDB_ROOT_DATABASE: mantis
     volumes:
+      - mongodb_data:/data/db
       - ./configs/mongo-config.js:/docker-entrypoint-initdb.d/mongo-init.sh:ro
   appsmith:
     image: index.docker.io/appsmith/appsmith-ce
@@ -55,6 +56,10 @@ services:
         ipv4_address: 10.10.0.5
     extra_hosts:
       - "mantis.db:10.10.0.3"
+volumes:
+  mongodb_data:
+    name: mantis-mongodb-data
+
 networks:
   network:
     name: mantis-network
diff --git a/setup/install_tools.sh b/setup/install_tools.sh
new file mode 100644
index 00000000..aa6c6244
--- /dev/null
+++ b/setup/install_tools.sh
@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+#
+# Platform-aware installer for Mantis' external recon tools.
+#
+# Reads configs/tools.yml, detects the host platform ({linux|darwin}/{amd64|arm64}),
+# and installs each tool using a fallback ladder:
+#     prebuilt binary  ->  `go install`  ->  (python tools via pip / source clone)
+#
+# Usage:
+#     install_tools.sh [target] [manifest_path]
+#         target         docker | native   (default: native) — selects which tools to install
+#         manifest_path  path to tools.yml  (default: <repo>/configs/tools.yml)
+#
+# Requires: yq (mikefarah v4), curl, unzip, tar, git, python3/pip.
+
+set -euo pipefail
+
+TARGET="${1:-native}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
+MANIFEST="${2:-${SCRIPT_DIR}/../configs/tools.yml}"
+
+log()  { echo -e "[+] $*"; }
+warn() { echo -e "[!] $*" >&2; }
+die()  { echo -e "[x] $*" >&2; exit 1; }
+
+# --- prerequisites ----------------------------------------------------------
+command -v yq   >/dev/null 2>&1 || die "yq is required (https://github.com/mikefarah/yq). Install it and re-run."
+command -v curl >/dev/null 2>&1 || die "curl is required."
+[ -f "$MANIFEST" ] || die "manifest not found: $MANIFEST"
+
+# --- platform detection -----------------------------------------------------
+case "$(uname -s)" in
+  Linux)  OS=linux  ;;
+  Darwin) OS=darwin ;;
+  *)      OS=linux  ; warn "unknown OS '$(uname -s)', assuming linux" ;;
+esac
+case "$(uname -m)" in
+  x86_64|amd64)   ARCH=amd64 ;;
+  aarch64|arm64)  ARCH=arm64 ;;
+  *)              ARCH="$(uname -m)"; warn "unknown arch '$(uname -m)'" ;;
+esac
+log "Platform: ${OS}/${ARCH} | target: ${TARGET}"
+
+# --- privilege + helpers ----------------------------------------------------
+if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1; then SUDO="sudo"; else SUDO=""; fi
+# Allow callers (e.g. native-setup.sh on Ubuntu) to pin the interpreter, e.g. MANTIS_PIP="python3.9 -m pip".
+PIP="${MANTIS_PIP:-python3 -m pip}"
+
+INSTALL_DIR="$(yq '.install_dir // "/usr/bin"' "$MANIFEST")"
+$SUDO mkdir -p "$INSTALL_DIR"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Read a manifest field for tool index $1, key $2, with optional default $3.
+field() {
+  local i="$1" key="$2" def="${3:-}"
+  yq ".tools[$i].${key} // \"${def}\"" "$MANIFEST"
+}
+# Substitute {version}/{os}/{arch} placeholders.
+subst() {
+  local s="$1"
+  s="${s//\{version\}/$VERSION}"; s="${s//\{os\}/$OS_TOK}"; s="${s//\{arch\}/$ARCH_TOK}"
+  echo "$s"
+}
+
+FAILED=()
+
+install_binary() {
+  local i="$1" name="$2"
+  OS_TOK="$(yq ".tools[$i].os_tokens.${OS} // \"${OS}\"" "$MANIFEST")"
+  ARCH_TOK="$(yq ".tools[$i].arch_tokens.${ARCH} // \"${ARCH}\"" "$MANIFEST")"
+  local archive url bin_in sha
+  archive="$(field "$i" archive none)"
+  url="$(subst "$(field "$i" url)")"
+  bin_in="$(subst "$(field "$i" bin_in_archive "$name")")"
+  sha="$(field "$i" sha256 "")"
+
+  local ex="$WORK/$name"; rm -rf "$ex"; mkdir -p "$ex"
+  local dl="$WORK/${name}.dl"
+
+  if ! curl -fsSL "$url" -o "$dl" 2>/dev/null; then
+    warn "$name: no prebuilt asset at $url — trying go install fallback"
+    install_go_fallback "$i" "$name" && return 0
+    FAILED+=("$name"); return 1
+  fi
+
+  # optional checksum verification (skipped when sha is empty)
+  if [ -n "$sha" ] && [ "$sha" != "null" ]; then
+    local got; got="$(sha256sum "$dl" 2>/dev/null | awk '{print $1}' || shasum -a 256 "$dl" | awk '{print $1}')"
+    [ "$got" = "$sha" ] || { warn "$name: sha256 mismatch (want $sha got $got)"; FAILED+=("$name"); return 1; }
+  fi
+
+  case "$archive" in
+    zip)    unzip -o -q "$dl" -d "$ex" ;;
+    tar.gz) tar -xzf "$dl" -C "$ex" ;;
+    none)   cp "$dl" "$ex/$(basename "$bin_in")" ;;
+    *)      warn "$name: unknown archive type '$archive'"; FAILED+=("$name"); return 1 ;;
+  esac
+
+  local found
+  found="$(find "$ex" -type f -name "$(basename "$bin_in")" | head -n1)"
+  [ -n "$found" ] || { warn "$name: binary '$bin_in' not found in archive"; FAILED+=("$name"); return 1; }
+
+  chmod +x "$found"
+  $SUDO mv "$found" "${INSTALL_DIR}/${name}"
+  log "installed ${name} -> ${INSTALL_DIR}/${name}"
+}
+
+install_go_fallback() {
+  local i="$1" name="$2" mod
+  mod="$(subst "$(field "$i" go_module "")")"
+  [ -n "$mod" ] || return 1
+  command -v go >/dev/null 2>&1 || { warn "$name: Go toolchain not available for fallback"; return 1; }
+  log "$name: go install $mod"
+  GOBIN="$WORK/gobin" go install "$mod" || return 1
+  $SUDO mv "$WORK/gobin/$name" "${INSTALL_DIR}/${name}"
+  log "installed ${name} (go) -> ${INSTALL_DIR}/${name}"
+}
+
+install_pip() {
+  local i="$1" name="$2" spec
+  spec="$(field "$i" pip_spec "$name")"
+  log "$name: pip install $spec"
+  $PIP install --no-cache-dir "$spec" || { FAILED+=("$name"); return 1; }
+  log "installed ${name} (pip)"
+}
+
+install_source() {
+  local i="$1" name="$2"
+  VERSION="$(field "$i" version "")"
+  OS_TOK="$OS"; ARCH_TOK="$ARCH"
+  local url archive dest exdir
+  url="$(subst "$(field "$i" url)")"
+  archive="$(field "$i" archive zip)"
+  dest="$(field "$i" dest "${INSTALL_DIR}/${name}")"
+  exdir="$(subst "$(field "$i" extracted_dir "$name")")"
+
+  local ex="$WORK/$name"; rm -rf "$ex"; mkdir -p "$ex"
+  local dl="$WORK/${name}.dl"
+  curl -fsSL "$url" -o "$dl" || { warn "$name: download failed $url"; FAILED+=("$name"); return 1; }
+  case "$archive" in
+    zip)    unzip -o -q "$dl" -d "$ex" ;;
+    tar.gz) tar -xzf "$dl" -C "$ex" ;;
+    *)      warn "$name: unsupported source archive '$archive'"; FAILED+=("$name"); return 1 ;;
+  esac
+  [ -d "$ex/$exdir" ] || { warn "$name: '$exdir' not found after extraction"; FAILED+=("$name"); return 1; }
+  $SUDO rm -rf "$dest"
+  $SUDO mv "$ex/$exdir" "$dest"
+  log "installed ${name} (source) -> ${dest}"
+}
+
+# --- main loop --------------------------------------------------------------
+COUNT="$(yq '.tools | length' "$MANIFEST")"
+for i in $(seq 0 $((COUNT - 1))); do
+  name="$(field "$i" name)"
+  method="$(field "$i" method binary)"
+  targets="$(yq ".tools[$i].targets // [\"docker\",\"native\"] | join(\",\")" "$MANIFEST")"
+  case ",${targets}," in
+    *",${TARGET},"*) ;;
+    *) log "skip ${name} (not in target '${TARGET}')"; continue ;;
+  esac
+
+  VERSION="$(field "$i" version "")"
+  case "$method" in
+    binary) install_binary "$i" "$name" || true ;;
+    pip)    install_pip    "$i" "$name" || true ;;
+    source) install_source "$i" "$name" || true ;;
+    *)      warn "${name}: unknown method '${method}'" ;;
+  esac
+done
+
+if [ "${#FAILED[@]}" -gt 0 ]; then
+  warn "Completed with failures: ${FAILED[*]}"
+  exit 1
+fi
+log "All tools installed successfully into ${INSTALL_DIR}"
diff --git a/setup/native-setup.sh b/setup/native-setup.sh
index 682c40f7..3d098590 100644
--- a/setup/native-setup.sh
+++ b/setup/native-setup.sh
@@ -55,73 +55,22 @@ sudo apt-get install -y wget unzip -qq tar gcc libpcap-dev dnsutils git python3.
 echo "export PATH='$HOME/.local/bin:$PATH'" | tee -a ~/.bashrc
 source ~/.bashrc
 
-# Install amass
-echo -e "[+]${Green} Installing AMass${NC}"
-wget -q -O amass.zip https://github.com/owasp-amass/amass/releases/download/v4.1.0/amass_Linux_amd64.zip
-unzip -qq -d amass -j amass.zip
-sudo mv amass/amass /usr/bin
-
-## Install subfinder
-echo -e "[+]${Green} Installing Subfinder${NC}"
-wget -q -O subfinder.zip https://github.com/projectdiscovery/subfinder/releases/download/v2.6.3/subfinder_2.6.3_linux_amd64.zip
-unzip -qq -d subfinder -j subfinder.zip
-sudo mv subfinder/subfinder /usr/bin/
-
-## Install httpx
-echo -e "[+]${Green} Installing httpx${NC}"
-wget -q -O httpx.zip https://github.com/projectdiscovery/httpx/releases/download/v1.3.7/httpx_1.3.7_linux_amd64.zip
-unzip -qq -d httpx -j httpx.zip
-sudo mv httpx/httpx /usr/bin/
-
-## Install naabu
-echo -e "[+]${Green} Installing naabu${NC}"
-wget -q -O naabu.zip https://github.com/projectdiscovery/naabu/releases/download/v2.1.9/naabu_2.1.9_linux_amd64.zip
-unzip -qq -d naabu -j naabu.zip
-sudo mv naabu/naabu /usr/bin/
-
-# Install nuclei
-echo -e "[+]${Green} Installing Nuclei${NC}"
-wget -q -O nuclei.zip https://github.com/projectdiscovery/nuclei/releases/download/v3.0.4/nuclei_3.0.4_linux_amd64.zip
-unzip -qq -d nuclei -j nuclei.zip
-sudo mv nuclei/nuclei /usr/bin/
-
-# Install gitleaks
-echo -e "[+]${Green} Installing gitleaks${NC}"
-wget -q -O gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.18.1/gitleaks_8.18.1_linux_x64.tar.gz
-tar -xf gitleaks.tar.gz
-sudo mv gitleaks /usr/bin/
-
-# Install Findcdn
-echo -e "[+]${Green} Installing findcdn ${NC}"
-
-pip install "dnspython<=2.0.0" ipwhois
-python3.9 -m pip install "git+https://github.com/cisagov/findcdn.git"
-
-echo -e "[+]${Green} Installing dnstwist ${NC}"
-python3.9 -m pip install dnstwist[full]
-
-# Install IPinfo
-echo -e "[+]${Green} Installing IPinfo ${NC}"
-curl -sLO https://github.com/ipinfo/cli/releases/download/ipinfo-3.2.0/ipinfo_3.2.0.deb
-sudo dpkg -i ipinfo_3.2.0.deb
-
-# Install wafw00f
-
-echo -e "[+]${Green} Installing wafw00f ${NC}"
-python3.9 -m pip install wafw00f --quiet
-
-#Install gau
-echo -e "[+]${Green} Installing gau${NC}"
-wget -O gau.tar.gz https://github.com/lc/gau/releases/download/v2.2.1/gau_2.2.1_linux_amd64.tar.gz
-tar -xvf gau.tar.gz
-sudo mv gau /usr/bin
-
-# Installing Corsy
-echo -e "[+]${Green} Installing Corsy${NC}"
-wget https://github.com/s0md3v/Corsy/archive/refs/tags/1.0-rc.zip
-unzip -qq 1.0-rc.zip
-mv Corsy-1.0-rc Corsy
-sudo mv Corsy /usr/bin
+# Install yq (required by the platform-aware tool installer)
+if ! command -v yq >/dev/null 2>&1; then
+  echo -e "[+]${Green} Installing yq${NC}"
+  case "$(uname -m)" in x86_64|amd64) YQ_ARCH=amd64;; aarch64|arm64) YQ_ARCH=arm64;; *) YQ_ARCH=amd64;; esac
+  sudo wget -q -O /usr/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_${YQ_ARCH}"
+  sudo chmod +x /usr/bin/yq
+fi
+
+# findcdn native compatibility shim (kept for the Ubuntu/python3.9 path)
+python3.9 -m pip install "dnspython<=2.0.0" ipwhois
+
+# Install all external recon tools from the platform-aware manifest (configs/tools.yml).
+# Single source of truth for versions; resolves the correct binary per OS/arch.
+echo -e "[+]${Green} Installing recon tools via manifest${NC}"
+SCRIPT_DIR="$( cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 ; pwd -P )"
+MANTIS_PIP="python3.9 -m pip" bash "${SCRIPT_DIR}/install_tools.sh" native "${SCRIPT_DIR}/../configs/tools.yml"
 
 # Install Python dependencies