How it works
You describe a target; the AI drafts an audit plan, picks the relevant tools and fills in their variables. Once you approve, the runner executes them for real, then the AI parses the raw output and produces structured vulnerabilities imported into the project.
Runner isolation
Tools run inside a dedicated Docker container holding only the required tooling: nmap, ffuf, sqlmap, curl, openssl, dirb and python3.
The runner is reachable only from the internal Docker network. It is unreachable from the host and from the internet.
Session lifecycle
- plan_ready: the plan is drafted, variables await your approval
- running: the tools are executing
- completed: results are ready to import
- failed: execution failed, the raw output remains available
You are notified at two points: when the plan is waiting for your variables, and when the session finishes with results.
Audit templates
Built-in playbooks cover network reconnaissance, directory enumeration, SSL/TLS analysis, HTTP headers, CORS, JWT, SQL injection, command injection, path traversal, IDOR and privilege escalation. The Team edition lets you author your own playbooks with named variables.
Only run an auto-audit against targets you hold written authorisation for. These tools generate genuine offensive traffic.