riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

  • Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

  • Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

  • Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

  • Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

  • Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

  • Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

  • Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

  • riciplay auth status — Check authentication and tier
  • riciplay auth whoami — Show current account info
  • riciplay review <path> — Code review with markdown output
  • riciplay --help — Full command reference

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zislasher from gravatar.com zislasher

Credits

Author: Zaidux

License

MIT License (MIT)

Requires

Python >=3.10

Provides Extra

browser

Tags

security bug-bounty dast sast pentest vulnerability-scanner ai-security cli

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

riciplay_cli-1.8.42.tar.gz (698.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

riciplay_cli-1.8.42-py3-none-any.whl (747.6 kB view details)

Uploaded Python 3

File details

Details for the file riciplay_cli-1.8.42.tar.gz.

File metadata

  • Download URL: riciplay_cli-1.8.42.tar.gz
  • Upload date:
  • Size: 698.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.42.tar.gz
Algorithm Hash digest
SHA256 f8647cb584767b3e7344853a37c3778484874fa12d2a32e125d1ecced0533e57
MD5 90fefd84a4be63c75cbcc8f20b99ded9
BLAKE2b-256 0ca680205d4e289e8d05d71bd7f1bb1ddd5b8ce3dcb32afb3a7b9ab63eb8994b

See more details on using hashes here.

File details

Details for the file riciplay_cli-1.8.42-py3-none-any.whl.

File metadata

  • Download URL: riciplay_cli-1.8.42-py3-none-any.whl
  • Upload date:
  • Size: 747.6 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.42-py3-none-any.whl
Algorithm Hash digest
SHA256 8ded07aed1553b94a18ec15139f4d8839fc55c0c1d69435e24066d70497b741a
MD5 60a63d2e8d158043b2d175a0563b7f24
BLAKE2b-256 8feb8e8b0a608904b8c4610229f75e35ab3d6bdede9e1b3199970441d76668b0

See more details on using hashes here.

Release history Release notifications | RSS feed

This release

1.8.42

1.8.41

1.8.40

1.8.39

1.8.38

1.8.37

1.8.36

1.8.35

1.8.34

1.8.33

1.8.32

1.8.31

1.8.30

1.8.29

1.8.28

1.8.27

1.8.26

1.8.25

1.8.24

1.8.23

1.8.22

1.8.21

1.8.20

1.8.19

1.8.18

1.8.17

1.8.16

1.8.15

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.99

1.7.98

1.7.97

1.7.96

1.7.95

1.7.94

1.7.93

1.7.92

1.7.91

1.7.90

1.7.89

1.7.88

1.7.87

1.7.86

1.7.85

1.7.84

1.7.83

1.7.82

1.7.81

1.7.80

1.7.79

1.7.78

1.7.77

1.7.76

1.7.75

1.7.74

1.7.73

1.7.72

1.7.71

1.7.70

1.7.69

1.7.68

1.7.67

1.7.66

1.7.65

1.7.64

1.7.63

1.7.62

1.7.61

1.7.60

1.7.59

1.7.58

1.7.57

1.7.56

1.7.55

1.7.54

1.7.53

1.7.52

1.7.51

1.7.50

1.7.49

1.7.48

1.7.47

1.7.46

1.7.45

1.7.44

1.7.43

1.7.42

1.7.41

1.7.40

1.7.39

1.7.38

1.7.37

1.7.36

1.7.35

1.7.34

1.7.33

1.7.32

1.7.31

1.7.30

1.7.29

1.7.28

1.7.27

1.7.26

1.7.25

1.7.24

1.7.23

1.7.22

1.7.21

1.7.20

1.7.19

1.7.18

1.7.17

1.7.16

1.7.14

1.7.10

1.7.9

1.7.3

1.7.2

1.7.1

1.7.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page