Skip to content
BreachPilot

Architecture

Local-first engine, operator-supervised at every gate

One supervised pipeline (plan, execute, prove, report) over a target-locked tool layer. Your data stays in your lab. Only your approvals move the run forward. For authorized testing only.

Plan · Recon · Exploit · Verify · Report

Install for your lab Read the safety model

Authorized testing only. Every action is allowlist-gated and audited. Safety model

Runtime pipeline

attack plan · dag done active todo
  1. Operator: approves gated (done)
  2. Planner: AttackPlan DAG (done)
  3. Agent: Flow A loop (active)
  4. MCP Tools: 153 · 33 fam. (active)
  5. Sandbox: allowlist-locked (todo)
  6. Evidence: CONF / REFUTED (todo)
  7. Verification: oracle · score (finding)
  8. Report: md · html · MITRE (todo)
  1. Operatorapproves gated
  2. PlannerAttackPlan DAG
  3. AgentFlow A loop
  4. MCP Tools153 · 33 fam.
  5. Sandboxallowlist-locked
  6. EvidenceCONF / REFUTED
  7. Verificationoracle · score
  8. Reportmd · html · MITRE

operator → planner → agent → mcp tools → sandbox → evidence → verification → report

Layers

The stack, top to bottom

Authority flows down, evidence flows up. The enforcement line between planning and execution turns scope into physics: no allowlist entry, no packets.

  1. Operator

    human

  2. Planner

    control

  3. Agent

    control

  4. MCP Tool Layer

    enforced

  5. Sandbox

    enforced

  6. Evidence

    proven

  7. Verification

    proven

  8. Report

    proven

Highlighted rows run inside the sandbox lock: target-IP pinned, fail-closed DROP on anything outside scope.

  1. Operator

    Starts runs, sets scope, approves gated actions. The only authority. Nothing executes without an allowlisted target.

  2. Planner

    Resolves goals into an AttackPlan DAG, resolves policy gates, and sequences hypotheses.

  3. Agent

    Flow A loop: hypothesize, execute, validate. Every tool call goes through the policy gate first.

  4. MCP Tool Layer

    153 tools across 33 families. Every tool carries @audit_tool + @require_allowlist. No allowlist entry means no execution.

  5. Sandbox

    Disposable worker locked to the target IP. Fail-closed DROP on anything outside scope.

  6. Evidence

    Execution outcome and evidential outcome stay separate. OutcomeJudge records what the run proved.

  7. Verification

    Validation scoring per claim: CONFIRMED, REFUTED, or EXHAUSTED, with oracle probes and scoring rationale.

  8. Report

    Markdown and HTML with timeline, CVSS, and MITRE export, sealed by a SHA-256 audit chain.

Data flow

How one finding gets made

Six stages from scope to sealed report. Each stage does its own job and leaves the next one alone.

  1. 01 · Scope

    Allowlist first

    Operator declares targets. The sandbox locks to those IPs. Everything else drops, fail-closed.

  2. 02 · Plan

    DAG of hypotheses

    Planner builds an AttackPlan DAG of testable hypotheses, each tagged with its policy gate.

  3. 03 · Execute

    Gated tool calls

    The agent runs MCP tools inside the sandbox. Gated and high-risk actions pause for operator approval.

  4. 04 · Judge

    Separate signal from noise

    OutcomeJudge splits execution output from evidential outcome, so a crashed tool never becomes a finding.

  5. 05 · Verify

    Prove or refute

    Oracle probes re-test each claim. Only CONFIRMED findings ship; REFUTED and EXHAUSTED stay in the log.

  6. 06 · Report

    Sealed output

    Timeline, CVSS, and MITRE-mapped report with a SHA-256 audit chain from plan to finding.

Trust model

Local-first data, supervised actions

Two guarantees that never trade off against each other: your lab data stays yours, and no consequential action runs without a human.

Local-first

  • Runs, evidence, and memory live on your machine. Serve the WebUI on localhost (default port 8765).
  • Reports generate locally as Markdown and HTML with a SHA-256 audit chain. No cloud round-trip required.
  • 139 advisory skills and semantic memory are file-backed and inspectable in your workspace.

Operator-supervised

  • You set scope; the sandbox enforces it. Out-of-scope destinations drop, fail-closed.
  • Gated and high-impact actions pause with full context. Approve or deny from the WebUI.
  • Every approval, tool call, and verdict lands in the audit log. Authorized testing only.

Policy gates

  • SAFE

    Read-only recon and passive checks run without interruption once scope is set.

  • GATED

    Active testing pauses for operator approval. One click in the WebUI, full context attached.

  • HIGH

    High-impact actions need explicit approval plus audit justification. Deny-by-default.

Alongside every run

Orchestration, memory, and models

Three systems run next to the pipeline: specialists that split up the work, memory that carries lessons forward, and a provider layer behind one contract.

Swarm orchestrator 6 agents

  • Recon

    Attack-surface discovery and fingerprinting

  • Vuln

    Vulnerability / CVE and module correlation

  • Exploit

    Capability selection, payload work and execution

  • Post Exploit

    Credential, loot and lateral-target handling

  • Critic

    Scope, risk and policy review

  • Reflection

    Strategy review and lessons

Provider layer: one contract

  • Ollama / Ollama Cloud

    Default chat/generate path: a cloud endpoint with bearer key, or a local daemon. Handles context-window translation and the model catalog sync.

    ollama.host · ollama.model glm-5.2:cloud · ollama.embed_host

  • OpenCode Go

    OpenAI Responses API over HTTPS. Model discovery from the provider's /models endpoint with caching.

    providers.opencode_go · base_url https://opencode.ai/zen/go/v1

  • ChatGPT

    Opt-in route via the vendored oauth/ loopback proxy, backed by browser OAuth. Tokens stay in the OAuth store.

    models.provider: chatgpt · loopback 127.0.0.1:10531

Skills + memory

139 advisory skills guide planning without executing anything; semantic and experience memory carry fingerprints, layouts, and lessons across runs. All on disk, all inspectable.

Go deeper

Engineering depth: architecture · runtime flows · MCP wiring · sandbox · source

Install for your lab See what it can do

Authorized testing only. Every action is allowlist-gated and audited. Safety model