- LLM-based finding dedup: fast-path deterministic (title+endpoint, CWE+endpoint) + LLM semantic judge for fuzzy cases
- Progressive budget warnings at 70/85/95% with stop-new-agents gate at 95%
- Token tracking on ModelPool (record_tokens on every completion, set_token_limit from budget config)
- Agent lifecycle nudge: retry failed agents up to 3x with progressively simplified prompts
- Image budget enforcement: cap base64 screenshots in prompts, strip-all for recovery
- Run snapshot/resume: persist RunSnapshot to workdir, skip already-completed agents on resume
- 21 unit tests for all new features (500 total pass)
Adds a "Re-run" button to the run detail view that opens the wizard
pre-populated with the previous run's settings (target, model, votes,
chain depth, recon, max agents, mode flags). Server now includes
launch params in the detail API response by looking up the persisted
job file. Previous findings and reports are preserved (new run ID).
- Remove filter that dropped terminal AttackStep nodes, which caused
the graph to show only isolated Finding nodes
- Rewrite hostOf to use OBSERVED_IN edges (Finding -> Endpoint) and
climb structural edges (HAS_ENDPOINT, EXPOSES, HAS_ASSET) to reach
host/asset nodes
- Hide all views (including pentestsView) when navigating to live/detail
- Scroll to top on all view transitions
- Treat all-agents-selected same as none (let recon decide)
- attachLiveJob now hides ALL views (including pentestsView) before
showing liveView, fixing the detail appearing below the pentests list
- Scroll to top on all view transitions (detail, live, fallback)
- When all agents are selected, treat as none selected so recon decides
which agents to run instead of pinning all 300+ agents
Add Max Agents input to Run Settings section in wizard. Wire maxAgents
through POST body, sanitizeLaunch, buildArgs (CLI), and buildReplScript
(REPL /agents command). Also pass --quick and --research as CLI flags
in buildArgs for modes that support them (run/whitebox/greybox).
Include needs-review in severity counts in report template and rename
KPI card from "Confirmed" to "Validated" combining both confirmed and
needs-review statuses.
Server-side credential validation for GitHub, GitLab, Jira, Slack, AWS, GCP, Azure before saving.
Modal pre-populates existing config and shows previous validation status on reopen.
Replace browser prompt() dialogs with proper floating modals for
Add Repository, Add Domain, and Add Network buttons. Replace
placeholder configureIntegration toast with real per-service config
modal (GitHub, GitLab, Jira, Slack, MCP). Add overlay click and
Escape key to close all modals. Fix Issues page to show real target
URL from run meta.json. Hide run history sidebar on asset pages.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqW6BbQgqGkEDn3RYuCVoM
Collection import:
- parse_path() auto-detects file vs directory; parse_dir() walks a folder of
.json collections (Postman/OpenAPI/Swagger/HAR), merges and deduplicates
endpoints across all files. walkdir (already a dep) now used in collection.rs.
- CLI --collection, REPL /collection, pipeline injection, and web console all
accept a directory path transparently.
MCP server (neurosploit mcp):
- Expanded from 8 to 24 tools: added whitebox, greybox, host, aitest, mobile,
skills, pr, graph, audit, poc, traffic, assurance, agents, models, and
import_collection. neurosploit_run gained --collection and --objective params.
- Clients: Claude Code, Codex CLI, Cursor, Windsurf, VS Code — all documented
in tool descriptions.
Web console:
- Full sidebar navigation: Dashboard, Pentests, PR Reviews, Issues,
Repositories, Domains, Networks, Integrations, Settings. Chat removed.
- switchView() navigation system with lazy-loading per page.
- Pentests page: tabular list of all engagements with click-to-detail.
- PR Reviews page: filtered view of PR review runs.
- Issues page: aggregate findings across every run, filterable by severity.
- Repositories page: connect/manage source repos (persisted in .neurosploit/).
- Domains page: manage target domains for black-box scans.
- Networks page: manage network ranges for infra scanning.
- Integrations page: GitHub, GitLab, Jira, Slack, MCP status cards.
- Settings page: default model, environment, TypeSafe, network, proxy config.
- Server: CRUD API endpoints for repos/domains/networks/integrations/settings
with JSON file persistence in .neurosploit/ directory.
- New CSS: nav items, config cards, data tables, stat cards, integration cards,
form modals, accent buttons.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqW6BbQgqGkEDn3RYuCVoM
The web console had the version hardcoded in three places (/api/meta, the
startup log, and the page title/badge), so it drifted from the CLI binary on
every release and had to be bumped by hand. Resolve it once at startup from
`neurosploit --version` and serve that through /api/meta; the sidebar badge and
the document title now follow it too. CLI and Web stay in lockstep — bump the
crate, rebuild, and the UA, the badge and the title all move together with no
web edit. Falls back to the package string only when the binary is missing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The verbose default User-Agent ("NeuroSploit/<ver> (authorized security
assessment; +https://...)") was getting blocked/fingerprinted by WAFs and
CDNs, causing false negatives and breaking scans. Shrink the default UA to a
plain `NeuroSploit/<ver>` token and move attribution to headers carried on
every request:
User-Agent: NeuroSploit/<ver>
Accept: */*
X-NeuroSploit-Scan: <ver>
New pipeline::default_scan_headers() is applied on every harness HTTP client
(probe.rs + the authz-matrix and subdomain-enum clients), so defenders still
see the scan via the header even after a browser-UA switch. The web console
shells the same binary and sets no UA override, so CLI and Web stay in sync on
the new default. Tests cover the plain UA and the attribution header.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Subscription/model and web-console fixes plus GLM and API-collection support
since 4.3.0:
- force subscription CLI login (strip stray ANTHROPIC/OPENAI keys); add
claude-opus-4-6
- scope: don't treat an endpoint's HTTP method as its host (findings no longer
wrongly quarantined; no bogus graph HOST nodes)
- web: resolve run-id to live job, collapse the pinned-leads header, parse live
findings/agent progress from decorated REPL output
- GLM 5.1/5.2/5.3 via API and via the Claude Code CLI (Z.ai devpack)
- import a Postman/OpenAPI/HAR collection as test surface (CLI/REPL/web)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add an API-collection field to the launch form (Creds panel): upload a
Postman/OpenAPI/Swagger/HAR file or point at a path on disk. Uploaded content
is written to a temp file and passed to the CLI via --collection (one-shot
modes) or /collection (REPL-backed run/greybox/whitebox), so the console
imports exactly the surface the CLI does. The picker previews the endpoint
count client-side.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Operators often already have the API mapped. Add a collection importer so a
Postman collection, an OpenAPI 3/Swagger 2 spec, or a HAR capture (JSON) is
parsed into a flat endpoint list and injected into every agent as known
in-scope surface — tested directly, alongside what recon finds, so documented
and auth-gated routes recon might miss are still covered.
- new harness module `collection` (format auto-detected by shape; de-duped;
render capped so a huge collection can't blow the prompt budget) + 6 tests
- RunConfig.api_collection; injected in operator_directives
- CLI: global `--collection <file>` on run/greybox/aitest, validated at launch
- REPL: `/collection <file>` (and `/import-api`), persisted in the session,
shown in /status, added to help + completion
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add GLM 5.1, 5.2 and 5.3 to the Z.ai provider (harness + web). Z.ai GLM can
now run two ways:
- plain API (OpenAI-compatible, api.z.ai/api/paas/v4) as before, and
- agentically through the Claude Code CLI pointed at Z.ai's Anthropic-compatible
endpoint (the Z.ai devpack / cline / zcode setup) when the subscription
toggle is on — chat_claude_stream injects ANTHROPIC_BASE_URL +
ANTHROPIC_AUTH_TOKEN from ZAI_API_KEY for the zai provider.
cli_binary_for("zai") -> claude; cli_login_status checks ZAI_API_KEY instead of
probing the Claude login; web verifies the key against z.ai's /models. GLM is
reasoning-heavy so it keeps the larger token ceiling. Covered by a new test.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The REPL decorates every streamed line with a leading glyph (" · ",
" ✗ ", " 🧪 testing "), so the server's anchored regexes for finding_json:
and "exploit <name> via … → N candidate(s)" never matched — findings and
per-agent progress reached the attack graph (built from findings.json) but
never the live Findings tab or the "what's being tested" panel.
Normalize each line (strip the leading decoration) before matching the
machine markers, and relax the anchors accordingly.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lock in the bugs just fixed so they can't come back:
- scope: host-relative "METHOD /path" findings stay in scope; host_of strips
a leading HTTP method (covered in scope.rs).
- graph_memory: a finding endpoint's method never becomes a HOST node.
- models/rectify: claude-opus-4-6 is in the anthropic catalog and resolves to
itself instead of being corrected to claude-opus-4-8.
- repl: add /sandbox to ACCEPTED so the completable command is dispatchable
(every_completable_command_is_accepted_by_the_dispatch now passes).
Full suite: 491 passed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Agents report endpoints as "METHOD /path" (e.g. "GET /api/search"). host_of
split on whitespace/slash and returned the method ("get"/"post") as the host,
so host-relative findings were wrongly quarantined as out-of-scope and the
attack graph grew bogus HOST "get"/HOST "post" nodes — real findings vanished
from the report.
Add scope::strip_leading_method and apply it in host_of and in the graph
finding projection. A host-relative endpoint now resolves to an empty host
(kept in scope, relative to the authorized target) and a method+URL endpoint
resolves to the real host. Covered by new scope tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Subscription runs were failing with "Invalid API key · Fix external API
key": the claude/codex subscription CLIs inherit the harness environment,
and a stray ANTHROPIC_API_KEY/OPENAI_API_KEY (e.g. a stale key saved in the
web console) made them switch to API-key billing and reject the request.
Strip those vars before spawning the CLI so the subscription login is always
used on the CLI path (API-key users go through the HTTP path, unaffected).
Also register claude-opus-4-6 in the anthropic model list — both the harness
allowlist (so it's no longer auto-corrected to claude-opus-4-8) and the web
console provider list.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A /run that pins every lead (hundreds of agents) printed all of them inline
in the live header, flooding the viewport and pushing the Findings/Activity
tabs below the fold — the run looked stuck on one screen when it was simply
scrolled off. Collapse #livePinned to a count + preview with "+N more",
click to expand, capped height with scroll.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Opening a running run from the sidebar attached the live view with the
run-id (ns-…), but harness jobs are keyed by their own UUID — so
/api/exploit/<run-id> 404'd and the activity log stayed empty even though
recon/exploitation was running normally in the backend.
Add resolveJobId(run): maps a run-id to the owning live job via
/api/exploit (matching job.runId), falling back to the static detail view
when no live job exists. openRun now resolves before attaching.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Web console
- LLM API keys: Save now verifies the key with a cheap authenticated call per
provider (anthropic/openai/xai/gemini/deepseek/mistral/groq/together/openrouter/
moonshot/qwen/nvidia) and shows ✓ valid / ✗ rejected / • saved; new
POST /api/keys/verify. Keys still save when a provider isn't auto-verifiable.
- Leads: a single "category" dropdown filters the board to one category.
- Provider/Model row alignment fixed (stacked-group top margin no longer applies
inside a field-row).
- "own interceptor" renamed to "NeuroSploit Interceptor" in the proxy picker.
Installers
- setup.sh: v4.3.0; detects a package manager (apt/brew/dnf/pacman/apk) and
installs missing deps (curl, git, nmap, node; rustscan + typst via cargo);
optional launch at the end (NEUROSPLOIT_RUN=1 or a prompt). Skip with
NEUROSPLOIT_NO_DEPS=1.
- install.ps1: v4.3.0; installs deps via winget (Node, Nmap, Git; typst via
cargo); optional launch at the end.
- setup.bat (new): Windows CMD entry point that bootstraps install.ps1 (local or
from GitHub).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
REPL (parity with the one-shot run flags)
- /compliance <pci-dss,hipaa,soc2,gdpr> — map confirmed findings onto frameworks.
- /budget <eco|balanced|aggressive|unlimited> and /budget token <N> — reasoning
budget + token ceiling. Both applied to the run config at /run (black-box and
whitebox/greybox), mirroring --compliance / --budget / --token-limit.
- Added to help and Tab completion.
Web console
- The run/whitebox/greybox path (interactive REPL) now also emits the settings it
was silently dropping: compliance, budget mode, token limit, and vuln-class
focus — via the REPL's own /compliance, /budget and /class commands (capability,
in-scope, intercept, sandbox, OOB, scope file stay launch-level in authArgs).
- New "Focus vuln classes" field in the Scope step.
Docs
- TUTORIAL.md: /compliance and /budget in the REPL command reference.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Harness / CLI
- redact: credentials become $SECRET_n in every human-facing report
(md/html/json/sarif/typ, findings.md); findings.json & vault keep raw values.
- poc: `--only <id> --json` re-tests a single finding (powers the web Re-test).
- version bump 4.2.4 → 4.3.0 (Cargo, CLI banner, web).
Web console
- Attack graph replaces "Generative Attack Path Chaining": one tab, findings
ordered by kill-chain stage, click a finding to open it. Mounted in detail + live.
- Finding modal: Wire evidence — the real request/response pairs behind a finding
(baseline/attack, identity pair, matrix probes, oracle) with wire provenance,
the wire-check summary, and recorded flows on the same endpoint.
- Per-finding Re-test with dated history (reproduced/changed/gone/unverifiable).
- Transcript viewer in the Traces tab (navigable blocks; search spans all agents).
- Regression vs the previous run of the same target: new / recurring badges and a
"fixed since" banner.
- Chains tab: readable formatting (node refs as chips, relations as labels).
- Custom lead: describe-it (Claude writes it) OR paste your own agent/system
prompt (verbatim); remove a custom lead from the board.
- GDPR added to compliance mapping; LLM API keys tab clarified; Reasoning-budget
and Authorization layouts fixed; NeuroSploit logo added.
Docs / config
- README rewritten as a concise landing page; TUTORIAL.md updated to v4.3.0 with
new web/graph/Neo4j/wire sections and first-time configuration.
- .env.example: v4.3.0, Z.ai/Moonshot keys, Neo4j + graph-salt + capability env.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Harness
- graph_memory: typed attack graph (web + internal network) with Neo4j sync
over the HTTP API. Graph checkpoints run after recon, validation, each
chaining round and at the end. They direct agent selection and feed the
live chains, next moves and dependency todolist into every prompt.
- wire: every reported exchange is checked against recorded flows and
re-sent through the scope-guarded replay engine. A contradiction means the
finding cannot stand as confirmed.
- traces: each agent's transcript is shared with the others as a fenced,
structured digest (endpoints, params, error signatures, versions).
- authz_matrix: role x route authorization matrix validator, with
identity tiers in creds.
- deliverables: evidence custody, exploit-as-test (honest oracles only),
detection content and personas, with no credential leakage.
- redact: credentials quoted by agents become $SECRET_n in every
human-facing report (md/html/json/sarif/typ, findings.md). findings.json
and the vault keep raw values for re-testing.
- compliance: GDPR replaces LGPD.
- New agents: authorization_matrix, session_lifecycle, api_token_structure,
exposed_datastore, postgres_superuser_rce, meta/graph_reasoning.
Web console
- New tabs, mounted in both the detail and live views: Attack graph
(replaces Generative Attack Path Chaining), Chains, Dependencies,
Traffic, Traces, Deliverables.
- Wire/Status columns, KPIs, CSV export.
- Graph recompute / Neo4j push / Re-test actions, all through the CLI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015v24fuCWxkanS31HDmaDB6
- Add AUTHORIZATION_PREAMBLE system prompt for operator-attested pentest authorization
- Docker socket auto-discovery across user/root boundaries (macOS Desktop/Colima/standard)
- Auto-sandbox for wildcard scope engagements
- Persist vote-rejected findings to rejected.jsonl for harness refinement
- Prosecutor phase: tokio timeout (120s) prevents infinite loop on quota exhaustion
- crt.sh timeout increased to 30s for large domains
- REPL /sandbox command for on-the-fly sandbox toggling
- Add claude-mythos-5-1 model to all provider lists
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Spin Kali up for the engagement, run tool-recon in it, let the LLM refine on top,
tear it down after.
- kali_provision_recon_tools(): installs the recon toolbox (subfinder/httpx/
katana/gau/waybackurls/nuclei/naabu/dnsx/assetfinder/gf/qsreplace/anew via
go install + apt) in the Kali sandbox on demand, idempotent, once per run.
- kali_tool_recon(): deterministic tool-recon phase — gau/waybackurls/katana URL
harvest + targeted nuclei (exposures/misconfig/takeovers, high-signal only) +
gf-flagged candidate URLs by class — over the live hosts, then folded into the
recon context so the LLM works on top of the tool output and confirms each.
Runs in the sandbox (--sandbox) or on host tools via recon_tool().
- Engine autostart: if the container engine is installed but not running, start
it automatically (colima start / open -a Docker / systemctl start docker /
podman machine start) and poll until up — a --sandbox run no longer fails just
because the daemon wasn't started. Clear guidance if it can't be started.
- Teardown: the Kali container is removed at the end of the run (override with
NEUROSPLOIT_KEEP_SANDBOX=1).
Version 4.2.4 across CLI/clap/web/README/TUTORIAL. 423 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
RECON_SYS enriched with the concrete bug-bounty recon arsenal and tool pipelines
(subfinder/amass/assetfinder/crt.sh → httpx liveness → gau/waybackurls/katana/
gospider URL harvest → JS analysis & secret regexes → arjun/x8 params → gf vuln
patterns + qsreplace → ffuf/feroxbuster content discovery → naabu ports → dnsx/
nuclei takeovers → cloud bucket grep → targeted nuclei → chained pipeline),
passive-first and scope-respecting. Shared by the black-box run path, so it
applies identically to the CLI, the REPL and the web console.
Version bumped to 4.2.3 across CLI/clap/web/README/TUTORIAL. 423 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(1) Preflight now checks EVERY configured model, not just the primary — a 3-model
jury that silently collapses to 1 (others not logged in / no key) is now shown:
each model prints usable/needs-login/needs-key, with a '→ N/M models usable'
summary. Fixes 'I set 3 models and only opus ran'. (qwen is API-only: use
nous:qwen3.8-max for Hermes, or export DASHSCOPE_API_KEY.)
(2) Wildcard engagement (*.domain in scope) now gets a deterministic subdomain
fan-out before recon: enumerate via crt.sh + subfinder/amass (in the Kali sandbox
when --sandbox, else host), keep only IN-SCOPE hosts, probe liveness, drop
soft-404/parked catch-alls, rank (401/403 auth hosts first — flagged for bypass —
then interesting names admin/api/dev/staging), and fold the live list into the
test surface so the run tests the WHOLE authorized domain end-to-end, not just the
seed host. Scope-respecting: one lightweight GET per host, no degradation.
(3) recon_tool() runs a recon tool in the Kali sandbox or on the host — the basis
for tool-powered recon.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A copy-paste full-surface focus string (all web classes, prioritise authed
surface + subdomains, chain to impact, reproducible receipt) and an
objective-vs-focus note; the engagement template now carries the broad
focus/objective in its one-file config.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Wildcard target from a scope-file (target: "*.nasa.gov") was probed literally
→ "builder error" / target unreachable. It's now reduced to the apex
(https://nasa.gov) for the seed, while the scope keeps *.nasa.gov so subdomain
enumeration stays authorized. (The /target command already did this; the
engagement-file meta path didn't.)
- Provenance was a OnceLock ("first run wins"), so in the REPL every run after
the first minted markers and the provenance line with the FIRST run's id
(nasa run showing a rockstargames id). Now a RwLock that rebinds per run —
each engagement gets its own id; the build fingerprint stays stable.
- Nous/Hermes: qwen3.8-max / qwen3.8-omni-flash added to the provider list so
`nous:qwen3.8-max` routes qwen through the Hermes portal (model name passes
through `hermes chat -m <model> --provider nous`).
- Black-box `run` now gets a broad DEFAULT objective when none is set: a
comprehensive WEB assessment grounded in OWASP Top 10 / ASVS / WSTG / CWE that
traverses every applicable web vuln class then goes deep — web-only (this path
loads only web vuln agents; mobile/binary are separate modes), so it never
drifts into mobile/exe.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A copy-paste recipe (cross-model jury, /ua browser, /recon 4, scope-file +
authorization, natural-language focus on the high-value surface, /run) plus a
table of high-value knobs and an honest benchmark reality-check, so people run
NeuroSploit more effectively against real targets.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
While a run streams, every printed line makes rustyline redraw the input line.
The high-volume tool echoes (exec/net/read — the ⌘/🌐/📄 lines, dozens/sec during
recon/curl bursts) flooded the terminal so arrow keys and backspace felt stuck
while typing. Those lines are now rate-limited to ~1/200ms in the live feed (they
remain in full via /logs); findings, phase changes, votes and notices still print
immediately. Editing stays responsive during a run.
(Note: the /model-rewrite the user hit was the OLD binary — v4.2.2 keeps the exact
models typed; verified anthropic:claude-opus-4-8 + openai:gpt-5.6-sol are kept.)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
/show showed only the policy profile ('web') and hid the actual hard-scope
allowlist, the authorization reference, the pinned agents (/class, /only) and
research mode — so an operator couldn't confirm what was really configured.
Now shows: authorized (the enforced hard-scope hosts, flagged when pinned),
guardrails (rate/accounts/destructive/excludes), authz ref, pinned agent list,
and research in opts.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Field feedback: real, reproducible findings (missing HSTS, insecure cookie flags,
internal IP leaked in a header) were being down-rated/dropped by the adversarial
opinion-vote. The user's rule: never discard something real; another person must
be able to reproduce the same finding.
Validation:
- has_http_receipt(): a finding whose proof is a captured HTTP response (status
line / security headers / Set-Cookie / a header the class is proven by) or a
file:line citation is REPRODUCIBLE by definition.
- validate(): a finding unanimously rejected by the vote but carrying such a
receipt is NO LONGER dropped — it is kept as needs-review (capped to what the
receipt alone proves), because "the response lacks HSTS" is a fact, not a
story. grounded_receipt() now also recognizes an in-prose HTTP receipt.
- reproducibility: a kept finding at a URL with no explicit repro steps gets a
minimal pasteable `curl -i` so anyone can reproduce the exact finding.
Also:
- /pocs (aliases /poc /evidence /artifacts): list a run's synthesized/written
PoC + evidence files with their paths (was: "unknown command /pocs").
- version bumped to 4.2.2 across CLI/clap/web; stale v4.2.1/v4.1.0 labels fixed.
423 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Field feedback from a live run (only SQLi being hit, auth flows skipped, scanner
UA behind a CDN):
- EXPLORE_DOCTRINE injected into every exploit prompt: the agent's named class is
a starting point, not a cage. It maps what the app actually does and reports
ANY class it can prove — with authentication/identity (login, signup, password
reset, MFA, OAuth/OIDC/SAML, JWT, session) as a first-class target, plus
business-logic/multi-step flows and both client- and back-end surfaces. When
its own class yields nothing, it pivots instead of idling.
- Selection (SELECT_SYS) now covers the surface instead of collapsing into one
family: diverse set, MUST include auth/identity agents when any auth/OAuth/JWT
surface is present, include business-logic/access-control on authed/multi-step
flows, cover client + back-end when both exist.
- UA quality: /ua browser sets a realistic Chrome UA (attribution stays in the
X-NeuroSploit-Scan header) for accuracy behind a WAF/CDN, where a self-declaring
scanner UA gets blocked/challenged and causes false negatives; /ua identify
keeps the transparent NeuroSploit UA. The UA doctrine now tells agents to
compare both early and switch to the browser UA if responses differ.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- /scope-file now reads optional engagement keys from the SAME YAML (target,
models, focus, objective, authorization, classes) so one file defines the
whole engagement, not just scope. examples/scopes/nasa.yaml and
engagement.example.yaml show the keys.
- When importing a scope (/scope-file) or declaring one (/authorize), a target
left over from a previous session that falls OUTSIDE the new scope is reset to
a host inside it (was: silently kept, then denied on /run — the "nothing
changed" confusion). Added scope_seed_target() + in_hard_scope() check.
- UI/help strings are English; the natural-language REPL still accepts input in
any language (the two example lines are now English).
- README + TUTORIAL updated: new REPL commands (/authorize, /scope-file, /class,
/research, /quick, /authorization, /guardrail), a "Scope — three ways" section
with the one-file YAML, version/counts refreshed to 4.2.1 / 480 agents.
422 tests passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Hard scope stays the safety boundary (you must say what you're allowed to test),
but setting it is now frictionless for a normal client pentest where authorization
comes from a signed SOW/contract — no bug-bounty program or capability token.
- /authorize <host|*.dom|cidr|url> ... (aliases /grant, /inscope-set): set the
entire authorized scope in one line (multiple entries), pins it so /target
won't re-derive, and seeds the target so /run works immediately. The operator
asserts written authorization for the listed assets; guardrails (rate,
accounts, destructive) remain tunable via /guardrail.
- examples/scopes/engagement.example.yaml — neutral direct-engagement template
(no program framing): fill hard scope from the SOW, guardrails documented as
yours to tune (e.g. allow destructive in a staging env, raise rate for a lab).
The frictionless path already worked (/target x -> authorized against x); this
makes the multi-asset direct engagement a single clear command. 422 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
