Ravage

Ravage is an evidence-first web security research agent for controlled, authorized targets. This package provides the ravage CLI and runtime modules.

The project is a pre-1.0 research alpha. Use it only on local fixtures, isolated labs, or systems you own and are explicitly authorized to assess. The active public CLI is localhost-first.

Source Checkout

The canonical development setup is the repository bootstrap:

scripts/bootstrap.sh
source .venv/bin/activate
ravage --version

The 0.0.1 PyPI package is a legacy preview. Until a newer tagged release is published, use a source checkout and record its exact commit when reporting results.

Active Commands

Run deterministic probes without model calls:

ravage scan brief.yaml --run-dir runs/local-scan --report

Run the model-driven agent after configuring a model route and adding a useful context.description to the brief:

ravage attack brief.yaml \
  --model-profile hosted-openai \
  --model-tier low \
  --allow-paid-models \
  --report

Inspect and verify a run:

ravage observe runs/<run-dir>
ravage audit verify runs/<run-dir>
ravage report runs/<run-dir> --brief brief.yaml

Use ravage --help and each subcommand's --help for the installed version.

External scanners such as nmap, sqlmap, katana, nuclei, and ffuf are not Python dependencies. From a source checkout, use scripts/install_tools.sh --method docker --execute, then run ravage tools check.

The optional browser extra adds Playwright support; install its Chromium runtime separately with playwright install chromium.

Documentation

See the repository README, setup guide, and operator guide.

Ravage is open source under the Apache License 2.0. See the repository SECURITY.md, CONTRIBUTING.md, DISCLAIMER.md, and LICENSE before use or contribution.