Create and activate an engagement session. Args: operator: Human operator name (recorded in audit log)

Expand CIDR, IP range, or comma-separated targets to a list of IP strings.

Export as JSON. Args: output_path: Path to save JSON file Returns: JSON string

Export as HTML. Args: output_path: Path to save HTML file Returns: HTML string

Export as Markdown. Args: output_path: Path to save Markdown file Returns: Markdown stri

Fuzz all endpoints in an API. Args: api: Parsed API specification Returns: Scan result with findings

Primary gate for ALL exploit/check operations. Returns (allowed: bool, reason: str).

Gate for applying AI-generated remediation scripts. Returns (allowed: bool, validation_result).

Generate a cryptographically random password. Args: length: Total character count (default 20) use_upper: In

Get LLM client by provider name. Args: provider: Provider name - "anthropic", "openai", "ollama", or "openai-compatible" model: M

Get remediation guide for a finding. Args: finding: The finding to get remediation for Returns: RemediationG

Load job history from disk. Returns: Dictionary of jobs

Load schedules from disk. Returns: Dictionary of schedules

Return the MSFModuleRef for a CVE ID (case-insensitive).

Print the Metasploit-style banner.

Execute the OSINT module against a target. Args: target: The target to investigate Returns: ScanResult conta

Enumerate DNS records for the target domain.

Execute the red-blue loop against a target. Args: target: IP, CIDR, hostname, or range mode:

Scan a single IP. Returns enriched result dict or None if VT fails.

Search for exploits. CVE-based search is tried first (most reliable), then GitHub PoC search as fallback. Returns list of ex

Search for modules matching query.

Return resolved status for all catalog entries. Returns a dict with: - ``root``: resolved SecLists root path (str) or None - ``available`

Set callback for running scans. Args: callback: Async function that takes (target, modules) and returns results

Start the phishing server.

Stop the phishing server.

Test all endpoints in an API. Args: api: Parsed API specification Returns: Scan result with findings

Test API authentication security. Args: api: Parsed API specification Returns: Scan result with findings

Convert to dictionary.

Static safety analysis of a shell script. Hard violations → safe=False (script is blocked). Warnings → safe=True (scri

Analyze JWT security configuration.

Run the security loop as a background task, logging progress.

Calculate overall risk summary.

Check for anomalies in response.

Check API-level security issues.

Check for anomalies in body fuzz response.

Check a single compliance control based on scan findings.

Check IP reputation.

Check if payload is reflected in response.

Check response for security issues.

Check for SQL error messages.

Check which TLS versions are supported.

Check URL reputation.

Check cve.circl.lu for exploit references and CAPEC entries.

Find relationships between findings.

Extract year from CVE-YYYY-NNNN. Returns 0 on failure.

Normalise msgpack response — convert byte keys/values to strings.

Deduplicate CVE list by id, keeping highest CVSS on collision.

Remove duplicate findings based on title and severity.

Parse script lines and describe what each does (for dry-run output).

Extract best available CVSS score + severity label.

Extract context around reflected payload.

Extract JSON object from model output (handles markdown code fences).

Format as Discord webhook message.

Format event as syslog message.

Format as PagerDuty event.

Format event payload based on target format.

Format as RFC 3164 (BSD syslog).

Format as RFC 5424 (modern syslog).

Format as Slack message.

Fuzz request body.

Fuzz all endpoints. Yields: FuzzResult for each test

Fuzz a single parameter.