riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.
Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.
Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.
Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.
Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.
Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.
Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# Run a SAST code audit
riciplay scan investigate ./my-project --mode sast --budget 8

# Manual-analysis mode
riciplay scan investigate https://example.com --mode manual --budget 15

Configuration

riciplay auth status — Check authentication and tier
riciplay auth whoami — Show current account info
riciplay review <path> — Code review with markdown output
riciplay --help — Full command reference

Release files for riciplay-cli 1.8.81

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for riciplay-cli 1.8.81
File	Size	Uploaded
riciplay_cli-1.8.81.tar.gz	903.2 kB	Sep 10, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for riciplay-cli 1.8.81
File	Interpreter	ABI	Platform	Reset
riciplay_cli-1.8.81-py3-none-any.whl 874.1 kB Sep 10, 2026	Python 3	none	any	Details

Total release size: 1.8 MB

Release files / riciplay_cli-1.8.81.tar.gz

Download URL	riciplay_cli-1.8.81.tar.gz
Size	903.2 kB
Tags	Source
SHA-256 checksum How to use checksums	`898201b1c3c954e53c7c702efd85fe3eb73979fd2a3d45a3355771d0f9dca88c`
BLAKE2b-256 checksum How to use checksums	`126f4d3ed4b2fc641e19849b573ca86641f3364067098065a28bf3be8b20508c`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.12.3`

Release files / riciplay_cli-1.8.81-py3-none-any.whl

Download URL	riciplay_cli-1.8.81-py3-none-any.whl
Size	874.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`e365b0c88452bb1b188bad589bccae911bddcee6fb0b4547f0037171f4334a1e`
BLAKE2b-256 checksum How to use checksums	`a9dbff87d86342ef44dd4502e3c0beae234019f4634a226095d779b2db34f1b1`
Upload date	Sep 10, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/6.2.0 CPython/3.12.3`