samugit83/redamon

plugin-platform

The plugin platform, always on: third-party plugin code runs isolated in the plugin runner, reaches RedAmon only through the Gateway, and changes agent behaviour only through text a person approved in core UI. The base repository holds no plugin logic, and a…

原文の言語: 英語

redamon-testing

How RedAmon tests actually run and how to author them: the per-file Docker gate, the unit/integration/live tiers, and the failure modes that make a green run a lie. Trigger: editing any test_*.py, *.test.ts(x) or tests/*.sh; a test that is red, skipped or…

原文の言語: 英語

builtin-agent-skill

Adding a built-in Agent Skill (an attack technique like ssrf, xxe, rce) that ships hardcoded in RedAmon: classified by the Intent Router, injected into the agent prompt, toggled per project, badged in the chat drawer. Ten layers across agentic and webapp, two…

原文の言語: 英語

recon-ai-enrichment

Wiring an LLM into a recon tool's decisions ("let AI pick {feature} for {tool}"): the never-raise contract, the per-target cache, the full+partial coverage, and the two UI toggles bound to one field. A raising AI helper or an empty fallback silently breaks or…

原文の言語: 英語

llm-provider-integration

Adding an LLM provider to RedAmon: the credential boundary (keys must never reach scan containers), prefix-routed model ids, and the provider registry. A misrouted model id or a leaked key are the two failures this guards. Trigger: adding or editing an LLM…

原文の言語: 英語

graph-db-writes

Writing to the Neo4j attack-surface graph in RedAmon: the tenant-isolation MERGE key every entity node must carry, where graph methods live (mixins, not the client), and the schema places that must be updated together. A MERGE missing the tenant key silently…

原文の言語: 英語

mcp-server-tools

Adding, removing or changing a tool on RedAmon's INBOUND MCP server, where external agents connect in with a personal access token. The wiki API reference is generated from the server's live tools/list and goes stale silently, and each tool's annotations and…

原文の言語: 英語

priority-board-triage

The Priority Board's three-layer score model (rules BASE, REVIEW by the built-in AI or an MCP agent, a person's DECISION) and who may write which layer. A writer that sets a final score itself, or touches another layer, silently undoes a review or a person's…

原文の言語: 英語

recon-tool-integration

Adding a new tool to the recon pipeline: the enrichment-module contract and its isolated wrapper (the actual fan-out and test call path), graph completeness, and the preset catalog that silently strips unknown settings. Miss the isolated wrapper and the tool…

原文の言語: 英語

add-partial-recon

Adding partial-recon support for a tool: running a single pipeline phase on demand from the workflow graph, reading its inputs from the existing Neo4j graph and merging results back. The input-node map decides the modal UI, and some input types must never be…

原文の言語: 英語

add-community-skill

Adding a Community Agent Skill: a Markdown attack-workflow file that users import from the catalog, which then competes in the Intent Router and is injected into the agent's system prompt. No Python, no rebuild - but it must name only real tools and stay…

原文の言語: 英語

project-settings-cascade

Changing or adding a project setting / default value in RedAmon. A single setting is duplicated across Prisma, two separate Python settings modules, the orchestrator defaults endpoint, and the frontend fallback; miss a layer and the UI shows one value while…

原文の言語: 英語

orchestrator-container-spawn

Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling. cap_drop and no-new-privileges were each reverted after breaking real scans. Trigger:…

原文の言語: 英語

agentic-tool-integration

Wiring a new tool the AI agent can call (not the recon pipeline): the tool registry, the phase map, the hardcoded dispatch chokepoint, and the duplicated execution paths that make a tool work in single mode but silently break in parallel plans. Trigger:…

原文の言語: 英語

supply-chain-scan

Working on RedAmon's supply-chain scanner (offline OSV + GuardDog + retire + trufflehog): the offline OSV database that the scan path does not bootstrap, the world-readable requirement for the hardened scanner, and the soft-error markers that record what was…

原文の言語: 英語

traffic-capture

Working on the HTTP capture proxy and its replay/fuzz path: the egress guard that stops the proxy becoming an SSRF pivot, why it checks the resolved IP, and keeping capture off the scan's critical path. Trigger: editing scanners/capture_proxy/…

原文の言語: 英語