riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

  • Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

  • Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

  • Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

  • Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

  • Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

  • Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

  • Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

  • riciplay auth status — Check authentication and tier
  • riciplay auth whoami — Show current account info
  • riciplay review <path> — Code review with markdown output
  • riciplay --help — Full command reference

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.8.42)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zislasher from gravatar.com zislasher

Credits

Author: Zaidux

License

MIT License (MIT)

Requires

Python >=3.10

Provides Extra

browser

Tags

security bug-bounty dast sast pentest vulnerability-scanner ai-security cli

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

riciplay_cli-1.8.37.tar.gz (690.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

riciplay_cli-1.8.37-py3-none-any.whl (740.2 kB view details)

Uploaded Python 3

File details

Details for the file riciplay_cli-1.8.37.tar.gz.

File metadata

  • Download URL: riciplay_cli-1.8.37.tar.gz
  • Upload date:
  • Size: 690.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.37.tar.gz
Algorithm Hash digest
SHA256 919f1829c6f262d0e2ba1e0a4a4682c698cbffb3ac180806faf2d1d70e31c3aa
MD5 7d2713c8d5e8bd4133dccf9e40994e89
BLAKE2b-256 81da62f09bb2a50de8d4b66eed88d1c277de33d144326b29350a4a6c997f0f19

See more details on using hashes here.

File details

Details for the file riciplay_cli-1.8.37-py3-none-any.whl.

File metadata

  • Download URL: riciplay_cli-1.8.37-py3-none-any.whl
  • Upload date:
  • Size: 740.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.37-py3-none-any.whl
Algorithm Hash digest
SHA256 57cd4e4bf5d394349071a1c967ce3d94b427dfed17c3e9112bcbcd871eca1889
MD5 82e43e3f2e7ee3cd3bae6cfcad352f06
BLAKE2b-256 baa8c61a34beec5772a85907d7c7388dad381dc9c25c84de87ba494b77bcb755

See more details on using hashes here.

Release history Release notifications | RSS feed

1.8.42

1.8.41

1.8.40

1.8.39

1.8.38

This release

1.8.37

1.8.36

1.8.35

1.8.34

1.8.33

1.8.32

1.8.31

1.8.30

1.8.29

1.8.28

1.8.27

1.8.26

1.8.25

1.8.24

1.8.23

1.8.22

1.8.21

1.8.20

1.8.19

1.8.18

1.8.17

1.8.16

1.8.15

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.99

1.7.98

1.7.97

1.7.96

1.7.95

1.7.94

1.7.93

1.7.92

1.7.91

1.7.90

1.7.89

1.7.88

1.7.87

1.7.86

1.7.85

1.7.84

1.7.83

1.7.82

1.7.81

1.7.80

1.7.79

1.7.78

1.7.77

1.7.76

1.7.75

1.7.74

1.7.73

1.7.72

1.7.71

1.7.70

1.7.69

1.7.68

1.7.67

1.7.66

1.7.65

1.7.64

1.7.63

1.7.62

1.7.61

1.7.60

1.7.59

1.7.58

1.7.57

1.7.56

1.7.55

1.7.54

1.7.53

1.7.52

1.7.51

1.7.50

1.7.49

1.7.48

1.7.47

1.7.46

1.7.45

1.7.44

1.7.43

1.7.42

1.7.41

1.7.40

1.7.39

1.7.38

1.7.37

1.7.36

1.7.35

1.7.34

1.7.33

1.7.32

1.7.31

1.7.30

1.7.29

1.7.28

1.7.27

1.7.26

1.7.25

1.7.24

1.7.23

1.7.22

1.7.21

1.7.20

1.7.19

1.7.18

1.7.17

1.7.16

1.7.14

1.7.10

1.7.9

1.7.3

1.7.2

1.7.1

1.7.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page