riciplay-cli
Riciplay Security Platform — Command-line Interface
An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.
Features
-
Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.
-
Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.
-
Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.
-
Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.
-
Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.
-
Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.
-
Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).
Installation
pip install riciplay-cli
Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium
(via Playwright) for browser-based discoveries.
Quick Start
# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>
# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12
# SAST code audit — point it at a path and name a focus skill
riciplay scan investigate ./my-project --focus sast-audit --budget 8
# Headless: natural-language instruction, JSON to stdout
riciplay scan investigate https://example.com --prompt "find IDOR in /api/orders" --budget 15
# Named session so an interrupted run can be resumed
riciplay scan investigate https://example.com --session audit-1 --budget 12
Options: --budget/-b · --focus/-f · --prompt/-p · --authorized/-a
(lab/CTF, skips prompts) · --session/-s · --output/-o · --plan-mode.
There is no --mode flag — DAST and SAST are the same command pointed at a URL
or a path.
Configuration
riciplay auth status— Check authentication and tierriciplay auth whoami— Show current account inforiciplay review <path>— Code review with markdown outputriciplay --help— Full command reference
1 maintainer
Metadata
1 maintainer
Release files for riciplay-cli 1.8.86
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| riciplay_cli-1.8.86.tar.gz | 995.6 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| riciplay_cli-1.8.86-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.9 MB
Release files / riciplay_cli-1.8.86.tar.gz
| Download URL | riciplay_cli-1.8.86.tar.gz |
|---|---|
| Size | 995.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ad9eb14a80d50e0a8ce886c05f1159e8299a7cb2bb98641449a3350d89172be9
|
|
BLAKE2b-256 checksum How to use checksums |
a8f5f746e7e6bc56858966edfebb1b21247d11dc918041ea99eef6c847291c9f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Release files / riciplay_cli-1.8.86-py3-none-any.whl
| Download URL | riciplay_cli-1.8.86-py3-none-any.whl |
|---|---|
| Size | 935.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
72b9c6e20c26be7469a844628b1adb02c033fd0b9c921a8b0daa6db6a13e4d1a
|
|
BLAKE2b-256 checksum How to use checksums |
497fed6b2491c3e35c65aee4b580adf5e04e6d2816cb6ae6e41d7a2014de9f75
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.12.3
|
Security for riciplay-cli 1.8.86
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
