From ecc2a9ae0312a4d8326d8be776224f51032a5602 Mon Sep 17 00:00:00 2001 From: CyberSecurityUP Date: Sun, 23 Aug 2026 15:47:59 -0300 Subject: [PATCH] docs: refresh README for v4.0.0 - correct stale counts, expand web console section - Agent library table was stale (196/12/78/17 = 303 total, missing the infra/chains/ai categories entirely). Corrected to the real counts (245/78/30/34/23/13/12 = 435), matching the "MD Agents-435" badge and neurosploit agents output. - Provider badge said 16; the harness actually ships 18 (litellm and azure were missing from the README's provider table and the API-key export block). Added both. - Web console section was a 3-line stub written before most of the feature was built. Expanded to cover the 5-step wizard, the lead board's bulk select/category toggles, custom-lead-generates-a-real-agent, the live run view's Generative Attack Path Chaining graph and finding/PoC detail, the Auth & Keys menu, and F5 persistence - with links to web/API.md and web/README.md. --- README.md | 53 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 8f4614e..e842dde 100755 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ - +

@@ -216,16 +216,41 @@ No login? Use an **API key** instead β€” see [Authentication](#authentication--r ## πŸ–₯️ Web console (NEW in v4.0.0) -A browser UI for the same harness: a categorized lead board (toggle agents by category, add -custom leads, `Start Exploitation`), a live structured findings view, run history, and a real -REPL β€” all driven by spawning the compiled CLI, never a reimplementation of it. +A browser UI for the same harness β€” every action spawns the real compiled CLI and parses its +output; nothing about the harness logic is reimplemented in the browser. ```bash cd neurosploit-rs && cargo build --release # once node web/server.js # β†’ http://localhost:4173 ``` -Zero npm dependencies. Full API reference: **[web/API.md](web/API.md)**. +Zero npm dependencies (Node built-ins only). + +- **5-step engagement wizard** β€” Asset (mode + target/repo) β†’ Scope & Auth (objective, focus, + out-of-scope) β†’ Leads (the 435-agent board below) β†’ Model & Run (provider/model picker, + API-key vs. subscription toggle, votes/chain-depth/recon) β†’ Review. Every engagement is named + up front, so runs are identifiable in history instead of by raw target string. +- **Lead board** β€” all 435 agents auto-categorized (Business Logic, Broken Access Control, + Injection, LLM Application, Auth & Session, SSRF & Network, Cloud & Infra, …). Toggle a single + lead, a whole category (indeterminate when partially selected), or use **Select all / Clear + all** β€” respects the active search filter. Leave everything off to let the harness's own + recon-driven selection choose. +- **Custom lead β†’ real agent** β€” "+ Custom lead" doesn't just add a text hint: it calls the + `claude` CLI (Opus, your Anthropic subscription) to generate an actual specialist-agent + markdown file into `agents_md/vulns/`, in the same format every built-in agent uses, pinnable + immediately. Falls back to a plain focus-text hint if Claude isn't available. +- **Live run view** β€” phase/progress streamed over SSE from the CLI's own stdout, a findings + table, and **Generative Attack Path Chaining**: a node/edge graph (root = target, one node per + confirmed finding, positioned by kill-chain stage, edges from `chains_from` when the harness + set one) instead of a flat list β€” click any node or row for the full finding detail, including + any PoC script the exploiting agent wrote to `pocs/`. +- **Auth & Keys** (one menu) β€” target auth header + named roles for IDOR/BOLA/BFLA testing + (materializes an ephemeral `creds.yaml` for the run), and per-provider API keys held in the + server process's memory only β€” never written to disk. +- Survives a page refresh: an in-progress run reattaches to the same live stream instead of + resetting to the wizard. + +Full API reference: **[web/API.md](web/API.md)** Β· quick start: **[web/README.md](web/README.md)**. --- @@ -450,6 +475,8 @@ export MOONSHOT_API_KEY=... # moonshot:* (Kimi K3/K2) export OPENROUTER_API_KEY=... # openrouter:* export OPENCODE_API_KEY=... # opencode:* (OpenCode Zen gateway) export NOUS_API_KEY=... # nous:* (Nous Portal β€” Hermes) +export LITELLM_API_KEY=... # litellm:* (your LiteLLM proxy) +export AZURE_OPENAI_API_KEY=... # azure: (also set AZURE_OPENAI_ENDPOINT) # ollama / llamacpp need no key (local) # then run via API (note: NO --subscription) @@ -481,6 +508,8 @@ Or put the keys in a `.env` and source it (`cp .env.example .env`; edit; `set -a | `openrouter:` | `OPENROUTER_API_KEY` | openrouter.ai | | `opencode:` | `OPENCODE_API_KEY` | opencode.ai/zen (OpenCode Zen gateway) | | `nous:` | `NOUS_API_KEY` | inference-api.nousresearch.com (Hermes 4) | +| `litellm:` | `LITELLM_API_KEY` | your LiteLLM proxy (`LITELLM_BASE_URL`, default localhost:4000) | +| `azure:` | `AZURE_OPENAI_API_KEY` | your Azure OpenAI resource (`AZURE_OPENAI_ENDPOINT`) | | `ollama:` | _(none)_ | localhost:11434 | | `llamacpp:` | _(none)_ | localhost:8080 | @@ -538,18 +567,22 @@ Every run writes a self-contained folder `runs/ns--/`: A reinforcement-learning reward store (`data/rl_state_rs.json`) biases agent selection on future runs. -## Agent library β€” `agents_md/` (303) +## Agent library β€” `agents_md/` (435) | Category | Count | Purpose | |----------|-------|---------| -| `vulns/` | 196 | Exploit a specific vulnerability class | -| `recon/` | 12 | Information gathering / attack surface | +| `vulns/` | 245 | Exploit a specific vulnerability class (web/API) | | `code/` | 78 | White-box source-code (SAST) review | -| `meta/` | 17 | Orchestrator, validator, scorers, reporter, RL | +| `ai/` | 30 | AI/LLM red-teaming, jailbreaks, MCP threats | +| `infra/` | 34 | Host/cloud: Linux, Windows, AD, AWS/GCP/Azure | +| `meta/` | 23 | Orchestrator, validator, scorers, reporter, RL | +| `chains/` | 13 | Multi-stage attack chains (SQLiβ†’RCEβ†’LPE, SSRFβ†’cloud, …) | +| `recon/` | 12 | Information gathering / attack surface | Each agent is a self-contained markdown playbook (`## User Prompt` methodology + `## System Prompt` strict anti-false-positive rules). Drop a new `.md` into the -matching folder and the harness picks it up. +matching folder β€” or generate one from the web console's "+ Custom lead" (see above) β€” and the +harness picks it up; `neurosploit agents` shows live counts. ---