riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

  • Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

  • Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

  • Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

  • Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

  • Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

  • Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

  • Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

  • riciplay auth status — Check authentication and tier
  • riciplay auth whoami — Show current account info
  • riciplay review <path> — Code review with markdown output
  • riciplay --help — Full command reference

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.8.61)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zislasher from gravatar.com zislasher

Credits

Author: Zaidux

License

MIT License (MIT)

Requires

Python >=3.10

Provides Extra

browser

Tags

security bug-bounty dast sast pentest vulnerability-scanner ai-security cli

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

riciplay_cli-1.8.49.tar.gz (737.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

riciplay_cli-1.8.49-py3-none-any.whl (768.8 kB view details)

Uploaded Python 3

File details

Details for the file riciplay_cli-1.8.49.tar.gz.

File metadata

  • Download URL: riciplay_cli-1.8.49.tar.gz
  • Upload date:
  • Size: 737.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.49.tar.gz
Algorithm Hash digest
SHA256 d79917b32c14b886d9f4f2e58354d348c63a784929fe385c7677b9295ca22a61
MD5 27faf1d7ee3cfc0a86ea488222e2da2e
BLAKE2b-256 7891936ed4efac1bd2d7a1a750a5dad7838f808235e5452daf2ab0732bf8a2b0

See more details on using hashes here.

File details

Details for the file riciplay_cli-1.8.49-py3-none-any.whl.

File metadata

  • Download URL: riciplay_cli-1.8.49-py3-none-any.whl
  • Upload date:
  • Size: 768.8 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.49-py3-none-any.whl
Algorithm Hash digest
SHA256 a957cb7fb6e96ce3463cf89b2a4a4e980d87f37e847e32abf4e423753245ba30
MD5 c9ac444d24ba7c450b2fc60955fbeacf
BLAKE2b-256 adcb2271b2de22b38bfea90c4f21b4515ae92afea6971927b7669d957975f7dd

See more details on using hashes here.

Release history Release notifications | RSS feed

1.8.61

1.8.60

1.8.59

1.8.58

1.8.57

1.8.56

1.8.55

1.8.54

1.8.53

1.8.52

1.8.51

1.8.50

This release

1.8.49

1.8.48

1.8.47

1.8.46

1.8.45

1.8.44

1.8.43

1.8.42

1.8.41

1.8.40

1.8.39

1.8.38

1.8.37

1.8.36

1.8.35

1.8.34

1.8.33

1.8.32

1.8.31

1.8.30

1.8.29

1.8.28

1.8.27

1.8.26

1.8.25

1.8.24

1.8.23

1.8.22

1.8.21

1.8.20

1.8.19

1.8.18

1.8.17

1.8.16

1.8.15

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.99

1.7.98

1.7.97

1.7.96

1.7.95

1.7.94

1.7.93

1.7.92

1.7.91

1.7.90

1.7.89

1.7.88

1.7.87

1.7.86

1.7.85

1.7.84

1.7.83

1.7.82

1.7.81

1.7.80

1.7.79

1.7.78

1.7.77

1.7.76

1.7.75

1.7.74

1.7.73

1.7.72

1.7.71

1.7.70

1.7.69

1.7.68

1.7.67

1.7.66

1.7.65

1.7.64

1.7.63

1.7.62

1.7.61

1.7.60

1.7.59

1.7.58

1.7.57

1.7.56

1.7.55

1.7.54

1.7.53

1.7.52

1.7.51

1.7.50

1.7.49

1.7.48

1.7.47

1.7.46

1.7.45

1.7.44

1.7.43

1.7.42

1.7.41

1.7.40

1.7.39

1.7.38

1.7.37

1.7.36

1.7.35

1.7.34

1.7.33

1.7.32

1.7.31

1.7.30

1.7.29

1.7.28

1.7.27

1.7.26

1.7.25

1.7.24

1.7.23

1.7.22

1.7.21

1.7.20

1.7.19

1.7.18

1.7.17

1.7.16

1.7.14

1.7.10

1.7.9

1.7.3

1.7.2

1.7.1

1.7.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page