riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

  • Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

  • Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

  • Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

  • Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

  • Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

  • Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

  • Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

  • riciplay auth status — Check authentication and tier
  • riciplay auth whoami — Show current account info
  • riciplay review <path> — Code review with markdown output
  • riciplay --help — Full command reference

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (1.8.61)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for zislasher from gravatar.com zislasher

Credits

Author: Zaidux

License

MIT License (MIT)

Requires

Python >=3.10

Provides Extra

browser

Tags

security bug-bounty dast sast pentest vulnerability-scanner ai-security cli

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

riciplay_cli-1.8.57.tar.gz (749.9 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

riciplay_cli-1.8.57-py3-none-any.whl (776.0 kB view details)

Uploaded Python 3

File details

Details for the file riciplay_cli-1.8.57.tar.gz.

File metadata

  • Download URL: riciplay_cli-1.8.57.tar.gz
  • Upload date:
  • Size: 749.9 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.57.tar.gz
Algorithm Hash digest
SHA256 f9f899eec541210f59f98bfa87679addf4ba83ea9dcd11e915dab6d0d6631e3f
MD5 dc7da8efe11c092250a796859a3f7219
BLAKE2b-256 61f6e5ff9bfa5b3ab2c2bcf7346220932ef52b8301b0382522e1f92c8c00c8b0

See more details on using hashes here.

File details

Details for the file riciplay_cli-1.8.57-py3-none-any.whl.

File metadata

  • Download URL: riciplay_cli-1.8.57-py3-none-any.whl
  • Upload date:
  • Size: 776.0 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for riciplay_cli-1.8.57-py3-none-any.whl
Algorithm Hash digest
SHA256 787381e15f3fcd50045cf9dff0e2d73852ff63dbf630a5ebf67ced38c0038446
MD5 ddb2924359debd1573c858e1598b2e28
BLAKE2b-256 6464857c7a947368e4a08c721cedcbcd914b072c82ac8437a3411cf0d0cdfd22

See more details on using hashes here.

Release history Release notifications | RSS feed

1.8.61

1.8.60

1.8.59

1.8.58

This release

1.8.57

1.8.56

1.8.55

1.8.54

1.8.53

1.8.52

1.8.51

1.8.50

1.8.49

1.8.48

1.8.47

1.8.46

1.8.45

1.8.44

1.8.43

1.8.42

1.8.41

1.8.40

1.8.39

1.8.38

1.8.37

1.8.36

1.8.35

1.8.34

1.8.33

1.8.32

1.8.31

1.8.30

1.8.29

1.8.28

1.8.27

1.8.26

1.8.25

1.8.24

1.8.23

1.8.22

1.8.21

1.8.20

1.8.19

1.8.18

1.8.17

1.8.16

1.8.15

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.99

1.7.98

1.7.97

1.7.96

1.7.95

1.7.94

1.7.93

1.7.92

1.7.91

1.7.90

1.7.89

1.7.88

1.7.87

1.7.86

1.7.85

1.7.84

1.7.83

1.7.82

1.7.81

1.7.80

1.7.79

1.7.78

1.7.77

1.7.76

1.7.75

1.7.74

1.7.73

1.7.72

1.7.71

1.7.70

1.7.69

1.7.68

1.7.67

1.7.66

1.7.65

1.7.64

1.7.63

1.7.62

1.7.61

1.7.60

1.7.59

1.7.58

1.7.57

1.7.56

1.7.55

1.7.54

1.7.53

1.7.52

1.7.51

1.7.50

1.7.49

1.7.48

1.7.47

1.7.46

1.7.45

1.7.44

1.7.43

1.7.42

1.7.41

1.7.40

1.7.39

1.7.38

1.7.37

1.7.36

1.7.35

1.7.34

1.7.33

1.7.32

1.7.31

1.7.30

1.7.29

1.7.28

1.7.27

1.7.26

1.7.25

1.7.24

1.7.23

1.7.22

1.7.21

1.7.20

1.7.19

1.7.18

1.7.17

1.7.16

1.7.14

1.7.10

1.7.9

1.7.3

1.7.2

1.7.1

1.7.0

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page