riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.
Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.
Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.
Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.
Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.
Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.
Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

riciplay auth status — Check authentication and tier
riciplay auth whoami — Show current account info
riciplay review <path> — Code review with markdown output
riciplay --help — Full command reference

Release files for riciplay-cli 1.8.80

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for riciplay-cli 1.8.80
File	Size	Uploaded
riciplay_cli-1.8.80.tar.gz	898.5 kB	Sep 10, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for riciplay-cli 1.8.80
File	Interpreter	ABI	Platform	Reset
riciplay_cli-1.8.80-py3-none-any.whl 871.3 kB Sep 10, 2026	Python 3	none	any	Details

Total release size: 1.8 MB

Release files / riciplay_cli-1.8.80.tar.gz

Download URL	riciplay_cli-1.8.80.tar.gz
Size	898.5 kB
Tags	Source
SHA-256 checksum How to use checksums	`08e929cf212572d20055e29aef0e87c334b9cae1b844dde6e29411de7a89e518`
BLAKE2b-256 checksum How to use checksums	`b510d21156f38069ebdad8b27db9a4d0af07ef2cfe025857aa2407ed61746d72`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.12.3`

Release files / riciplay_cli-1.8.80-py3-none-any.whl

Download URL	riciplay_cli-1.8.80-py3-none-any.whl
Size	871.3 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`852d4d5f0c047d2ee30b93a0379631237467580b5264516fbff5a3ae1617ee68`
BLAKE2b-256 checksum How to use checksums	`9f28a47773edb6bc54974aa8ae69dd9304cb164301e070afa39c53fd232dd878`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.12.3`