mcp2agy-recon

/recon — Multi-Agent Reconnaissance & Intelligence Engine (v3.0.0)

0. Prime Directive & Orchestration Model

The Reconnaissance engine builds an irrefutable, actionable map of the target's attack surface before exploitation. It coordinates specialized subagents running concurrently to minimize engagement time and maximize surface coverage:

                      ┌─────────────────────────────────┐
                      │   Recon Orchestrator (/recon)   │
                      └────────────────┬────────────────┘
                                       │
        ┌──────────────────┬───────────┴───────────┬──────────────────┐
        ▼                  ▼                       ▼                  ▼
┌──────────────┐   ┌──────────────┐        ┌──────────────┐   ┌──────────────┐
│ Passive OSINT│   │ Active Ports │        │ Web & API Map│   │ Cloud Assets │
│   Subagent   │   │  & Services  │        │   Subagent   │   │   Subagent   │
└──────────────┘   └──────────────┘        └──────────────┘   └──────────────┘
        │                  │                       │                  │
        └──────────────────┴───────────┬───────────┴──────────────────┘
                                       ▼
                     mcp2agy_workspace/recon/results/<target>/
                     ├── target_profile.json
                     ├── attack_surface.md
                     └── active_endpoints.txt ──► [Handoff to /scan or /audit]

---

1. Multi-Agent Reconnaissance Playbook

Step 1: Initialize Recon Workspace

$target = "target_domain_or_host"
$reconDir = "mcp2agy_workspace/recon/results/$target"
New-Item -ItemType Directory -Force -Path $reconDir | Out-Null

Step 2: Spawn Concurrent Recon Subagents

Use invoke_subagent to spawn specialized recon workers concurrently:

{
  "Subagents": [
    {
      "TypeName": "mcp2agy-recon-agent",
      "Role": "Passive OSINT & DNS Intelligence",
      "Model": "flash",
      "Workspace": "inherit",
      "Prompt": "Perform Passive OSINT & Subdomain Discovery on <target>.\nOutput Dir: mcp2agy_workspace/recon/results/<target>/\nTasks:\n1. Query Certificate Transparency logs (crt.sh), DNS records (A, AAAA, MX, TXT, CNAME).\n2. Enumerate subdomains via subfinder / amass passive.\n3. Check historical endpoints via Wayback Machine.\n4. Write discovered hostnames to mcp2agy_workspace/recon/results/<target>/subdomains.txt."
    },
    {
      "TypeName": "mcp2agy-recon-agent",
      "Role": "Active Service & Port Scanner",
      "Model": "flash",
      "Workspace": "inherit",
      "Prompt": "Perform Active Port & Service Discovery on <target>.\nOutput Dir: mcp2agy_workspace/recon/results/<target>/\nTasks:\n1. Run fast port scan (Top 1000 ports via nmap / masscan).\n2. Probe HTTP/HTTPS services with httpx for title, status, TLS cert, and tech stack fingerprint.\n3. Write active services to mcp2agy_workspace/recon/results/<target>/services.json."
    },
    {
      "TypeName": "mcp2agy-recon-agent",
      "Role": "Cloud Asset & Storage Enumerator",
      "Model": "flash",
      "Workspace": "inherit",
      "Prompt": "Enumerate Cloud Assets & Buckets for <target>.\nOutput Dir: mcp2agy_workspace/recon/results/<target>/\nTasks:\n1. Check for public AWS S3 buckets, Azure Blob containers, and GCP storage buckets named after target.\n2. Check for exposed cloud metadata endpoints / DNS records.\n3. Write findings to mcp2agy_workspace/recon/results/<target>/cloud_assets.json."
    }
  ]
}