- Container image scanning: new `container` mode + 4 skills (vuln, secret,
misconfig, SBOM) driving trivy/grype/syft headless, read-only. Scans an OCI
ref / tar / Dockerfile for vulnerable packages (CVE/fixed-in/KEV), exposed
secrets in any layer, Dockerfile+runtime misconfig, and writes an SBOM in
both SPDX and CycloneDX to the run's sbom/. Also exposed as an MCP tool
(neurosploit_container).
- Coverage report: every run writes coverage.md — which agents ran (tested
surface), findings per agent, and the high-value classes NOT covered — so the
reader sees the engagement's reach. Added to the assurance bundle.
- Login-verification evidence: doctrine now requires capturing the login
request/response + a Playwright screenshot and recording success/failure
before authenticated testing.
- HTTP traffic export: `neurosploit traffic <run>` turns the intercepted
flows.jsonl into a traffic.http archive for external tools.
Not ported: Asset Discovery (enterprise-only, skipped per request).
383 tests.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
