| name | thefound |
| description | Master entry point for the full crypto recon pipeline. Handles URLs (web) and APK files (.apk/.apkm/.xapk). Drives the entire pipeline automatically from goal to working Python code — no intermediate stops. |
thefound — Autonomous Pipeline Entry Point
Core Principle
Run everything automatically. User states a goal, pipeline drives itself to completion. No asking "which finding do you want?" mid-way. No waiting for permission between phases. Stop only when the user's stated goal is fully achieved.
Input Detection — Route Immediately
User gives URL → invoke crypto-recon-orchestrator (full web pipeline)
User gives .apk / .apkm / .xapk file → invoke crypto-recon-apk (full APK pipeline)
User gives .har file → invoke crypto-recon-har first, then crypto-recon-building
No input → ask ONCE: "Berikan URL atau path APK file"
Do NOT ask for clarification if input is clear. Route immediately.
What "Done" Means
The pipeline is complete when:
- All specialists have finished scanning
- Final report is written:
output/[target]/final/[target].md
- The user's stated goal artifact exists:
- "cari signing / encryption / crypto" →
reconstruct_*.py with Python signing function
- "bikin script" / "flow lengkap" →
flow_*.py with complete API flow
- "cari aja" / "analisis" → report is sufficient, offer next steps
Pipeline Map
/thefound <target>
│
├─ URL ──────────────────────────────────────────────────────────────────────┐
│ │
│ [auto] crypto-recon-plans ← understand goal (no blocking questions) │
│ [auto] crypto-recon-fetch ← download all JS/WASM │
│ [auto] crypto-recon-deobf ← beautify + sourcemap + decode │
│ [auto] crypto-recon-detector ← web2 / web3 / hybrid? │
│ [PARALLEL] 10 specialists ← all run simultaneously │
│ [auto] crypto-recon-report ← write final report │
│ [auto] crypto-recon-reconstruct ← reconstruct best finding to Python │
│ [auto] crypto-recon-building ← build complete flow script if goal says so│
│ │
└─ APK ──────────────────────────────────────────────────────────────────────┘
[auto] extract base.apk from bundle if needed
[auto] python tools/apk_decompile.py ← jadx + apktool (if not cached)
[PARALLEL] 15 agents: apk-java + 10 crypto specialists + 3 flow mappers
[auto] crypto-recon-report ← write final report
[auto] crypto-recon-reconstruct ← reconstruct signing/crypto to Python
[auto] crypto-recon-building ← build complete flow script if goal says so
Goal Inference (no asking)
Extract the user's intent from their initial message:
| User says | Inferred goal | Auto-proceed to |
|---|
| "cari signing" / "gimana sign" | Find signing → Python function | reconstruct → stop |
| "reverse crypto" / "cari encryption" | Find all crypto | report → reconstruct best finding |
| "bikin script login" / "flow lengkap" | Full working script | reconstruct → building → stop |
| "analisis aja" / just URL/APK | Map all crypto | report → offer options |
| "debug" / "401 terus" | Fix existing signature | debugging |
| "pentest" / "cek vuln" / "test RCE/SQLi/IDOR" | Vulnerability testing | pentest (needs flow script first) |
After Pipeline Completes
Print one clean summary:
=== DONE ===
Target: [name]
Report: output/[name]/final/[name].md
Script: output/[name]/final/reconstruct_signing.py (if produced)
Flow: output/[name]/final/flow_complete.py (if produced)
Findings: 3 HIGH (signing: HMAC-SHA256, AES-CBC, RSA pubkey)
Next:
"debug" → verify script against live API
"flow lengkap" → build full register/login/request flow
"lihat [ClassName]" → read specific Java class
Do NOT ask "which finding do you want?" — pick automatically based on goal.
