A Claude Code plugin that runs a full pentest engagement from inside your coding agent. Point it at a target and it works through recon, deep testing, exploit verification, chain-building, judging, and writes audit report.
Agent
Vertical access control testing (role escalation, 403 bypass, forwarded-header tricks, admin-path access). Triggered when recon found 403 responses, admin panels, role-gated routes, or privilege tiers in creds.md.
Agent
REST and GraphQL API testing — OpenAPI schema fuzzing, GraphQL introspection + abuse, verb tampering, mass assignment, rate-limit bypass. Triggered when recon found an OpenAPI / Swagger URL, a /graphql endpoint, or ID-bearing REST routes without those found.
Agent
Tests a single authenticated endpoint for authentication bypass. Triggered when recon surfaces a login / SSO / OAuth / JWT-gated route and a valid token is available in creds.md.
Agent
Combines individual verified findings into escalation chains that move severity up. Runs in Turn 3c after the verifier and before the judge.
Agent
Client-side vulnerability testing — reflected / stored XSS, CSRF, clickjacking, postMessage handlers, open redirect, DOM sinks. Use for any live web host with user-facing interactivity.
Agent
Hidden path, file, and parameter discovery via directory + file fuzzing and hidden-param enumeration. Use when the crawler's surface is thin or when specific high-value paths (admin, debug, backup, .git, .env) might exist but weren't linked.
Agent
CORS, security headers, CRLF, host-header injection, and cache-poisoning probes for a single host. Use for every live web target.
Agent
Horizontal IDOR / BOLA probe using two accounts. Triggered when recon found an API endpoint with object IDs in the path or query, and creds.md has both attacker and victim tokens.
Agent
SQL / NoSQL / command / template / LDAP injection probes. Triggered when recon surfaced parameterised URLs, search fields, forms, or GraphQL variables.
Agent
Secrets and sensitive tokens in JavaScript bundles, source maps, and static assets. Use in Turn 1 once the crawler has collected JS file URLs.
Agent
Final quality gate before findings reach the audit report. Applies the 4-gate filter, confidence scoring, severity + CVSS assignment, deduplication, and exclusion-list enforcement. Runs in Turn 3d after verify and chain.
Agent
Business-logic and workflow abuse — race conditions, coupon / voucher reuse, rate-limit bypass, signup abuse, referral fraud, multi-step flow skipping, quantity manipulation. Triggered when recon found payment / coupon / redeem / invite / signup endpoints.
Agent
Fast port scan with service detection and high-value-target classification. Use in Turn 1 when live hosts have been enumerated.
Agent
Renders the final consolidated audit report from approved findings. Runs in Turn 4 after the judge has produced approvedfindings.json.
Agent
SSRF probe against a URL-accepting parameter. Triggered when recon found a param like url=, redirect=, proxy=, image=, callback=, fetch=, webhook=.
Agent
Independently re-tests one exploit PoC in a clean session to confirm reproducibility. Sits between exploiter and judge — only verified findings proceed.
Agent
Runs the template-based vuln scanner against the live-host list from Turn 1 discovery and summarises findings by severity. Isolates long-running scan output from the main orchestrator's context.
Agent
Performs ultra-granular per-function deep analysis for security audit context building. Use when analyzing dense functions, data-flow chains, cryptographic implementations, or state machines.