riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

  • Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

  • Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

  • Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

  • Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

  • Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

  • Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

  • Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

  • riciplay auth status — Check authentication and tier
  • riciplay auth whoami — Show current account info
  • riciplay review <path> — Code review with markdown output
  • riciplay --help — Full command reference

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.8.61)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zislasher from gravatar.com zislasher

Credits

Author: Zaidux

License

MIT License (MIT)

Requires

Python >=3.10

Provides Extra

browser

Tags

security bug-bounty dast sast pentest vulnerability-scanner ai-security cli

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

riciplay_cli-1.8.54.tar.gz (746.3 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

riciplay_cli-1.8.54-py3-none-any.whl (773.9 kB view details)

Uploaded Python 3

File details

Details for the file riciplay_cli-1.8.54.tar.gz.

File metadata

  • Download URL: riciplay_cli-1.8.54.tar.gz
  • Upload date:
  • Size: 746.3 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.54.tar.gz
Algorithm Hash digest
SHA256 1519105b583749afc29adb85851602e615fe898de18bb52b067e34fec5ccaa5b
MD5 1e134562edb458b6a6df1d3322a9209a
BLAKE2b-256 7a2f68c3cdbb1380ac526ca33a1d137de6f9b5b3ed5a5b4bd2bd7d39244581d3

See more details on using hashes here.

File details

Details for the file riciplay_cli-1.8.54-py3-none-any.whl.

File metadata

  • Download URL: riciplay_cli-1.8.54-py3-none-any.whl
  • Upload date:
  • Size: 773.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.54-py3-none-any.whl
Algorithm Hash digest
SHA256 fc2fe352d5fdf2d347fdca4631215bb3ef0101decfda5d4fc168b86375f5b2a4
MD5 b9bcb29dfc8a0300bb708ed22dac2f03
BLAKE2b-256 6eb8c57d4afb1ee735ca05c6a27e609da883acf044a6616d8e90c9d1d291e5aa

See more details on using hashes here.

Release history Release notifications | RSS feed

1.8.61

1.8.60

1.8.59

1.8.58

1.8.57

1.8.56

1.8.55

This release

1.8.54

1.8.53

1.8.52

1.8.51

1.8.50

1.8.49

1.8.48

1.8.47

1.8.46

1.8.45

1.8.44

1.8.43

1.8.42

1.8.41

1.8.40

1.8.39

1.8.38

1.8.37

1.8.36

1.8.35

1.8.34

1.8.33

1.8.32

1.8.31

1.8.30

1.8.29

1.8.28

1.8.27

1.8.26

1.8.25

1.8.24

1.8.23

1.8.22

1.8.21

1.8.20

1.8.19

1.8.18

1.8.17

1.8.16

1.8.15

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.99

1.7.98

1.7.97

1.7.96

1.7.95

1.7.94

1.7.93

1.7.92

1.7.91

1.7.90

1.7.89

1.7.88

1.7.87

1.7.86

1.7.85

1.7.84

1.7.83

1.7.82

1.7.81

1.7.80

1.7.79

1.7.78

1.7.77

1.7.76

1.7.75

1.7.74

1.7.73

1.7.72

1.7.71

1.7.70

1.7.69

1.7.68

1.7.67

1.7.66

1.7.65

1.7.64

1.7.63

1.7.62

1.7.61

1.7.60

1.7.59

1.7.58

1.7.57

1.7.56

1.7.55

1.7.54

1.7.53

1.7.52

1.7.51

1.7.50

1.7.49

1.7.48

1.7.47

1.7.46

1.7.45

1.7.44

1.7.43

1.7.42

1.7.41

1.7.40

1.7.39

1.7.38

1.7.37

1.7.36

1.7.35

1.7.34

1.7.33

1.7.32

1.7.31

1.7.30

1.7.29

1.7.28

1.7.27

1.7.26

1.7.25

1.7.24

1.7.23

1.7.22

1.7.21

1.7.20

1.7.19

1.7.18

1.7.17

1.7.16

1.7.14

1.7.10

1.7.9

1.7.3

1.7.2

1.7.1

1.7.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page