riciplay-cli

Riciplay Security Platform — Command-line Interface

An autonomous AI-driven bug bounty hunting agent for web applications and codebases. Runs local investigations with an LLM-in-a-loop leader that orchestrates specialists, probes endpoints, verifies findings, and chains vulnerabilities.

Features

• Autonomous DAST (Dynamic Application Security Testing) — Web app vulnerability scanning with automatic attack-surface enumeration, multi-class injection probing (XSS / SQLi / IDOR / open-redirect / SSRF), and interception-driven recon through miniproxy + headless browser.

• Autonomous SAST (Static Application Security Testing) — Code audit with semgrep, code search, and AI-guided data-flow tracing. Finds injection sinks, hardcoded secrets, weak crypto, and path traversal.

• Manual-analysis mode — Human-pentester-style workflow: observe through browser, take notebook notes, register accounts, test cross-account, reason and iterate.

• Specialist orchestration — Parallel execution of domain specialists (Recon, Web, API, Auth, Cloud, Business Logic) with shared findings, cross-specialist corroboration, and compound attack chaining.

• Coverage gates — Deterministic finish-time enforcement ensures every discovered endpoint×parameter×attack-class combination is attempted before the investigation concludes.

• Two-identity IDOR testing — Automatic account registration/login and cross-account replay for authorization bypass detection.

• Phase-separated investigation — DISCOVER (breadth-first surface mapping and probing) followed by REPORT (impact verification, chaining, and quality gating).

Installation

pip install riciplay-cli

Requires Python 3.10+, mitmdump (for proxy capture), and optionally Chromium (via Playwright) for browser-based discoveries.

Quick Start

# Authenticate against the Riciplay backend
riciplay auth set-key <your-api-key>

# Run a DAST investigation against a target
riciplay scan investigate https://example.com --budget 12

# SAST code audit — point it at a path and name a focus skill
riciplay scan investigate ./my-project --focus sast-audit --budget 8

# Headless: natural-language instruction, JSON to stdout
riciplay scan investigate https://example.com --prompt "find IDOR in /api/orders" --budget 15

# Named session so an interrupted run can be resumed
riciplay scan investigate https://example.com --session audit-1 --budget 12

Options: --budget/-b · --focus/-f · --prompt/-p · --authorized/-a (lab/CTF, skips prompts) · --session/-s · --output/-o · --plan-mode. There is no --mode flag — DAST and SAST are the same command pointed at a URL or a path.

Configuration

• riciplay auth status — Check authentication and tier
• riciplay auth whoami — Show current account info
• riciplay review <path> — Code review with markdown output
• riciplay --help — Full command reference