Config Reference (Generated)
Config Reference (Generated)
Machine-readable companion to
docs/config-reference.md. Every key below was verified to exist inconfig.yamlat generation time — no invented keys. Lab values (config.yaml) vs schema defaults (tools/config_manager.py:CONFIG_SCHEMA) are both shown where they differ. Seedocs/configuration/overview.mdfor loading/precedence anddocs/configuration/validation.mdfor type checks.
Source locations use config.yaml:<top-level-line> + tools/config_manager.py:CONFIG_SCHEMA path. Consumers are primary file:line citations; full call graph is in docs/module-guide.md.
Generated 2026-09-07 from config.yaml (439 leaf keys, 46 top-level blocks). Lab-only keys (not in CONFIG_SCHEMA) are marked.
| Key | Type | Default (schema → lab) | Allowed | Source | Consumer(s) | Effect | Env override | Restart | Subsystem | Tests |
|---|---|---|---|---|---|---|---|---|---|---|
adaptive_exploits.enabled | bool | True | — | config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].enabled | cli_exploit_settings.py, mcp_tools/attack_modules.py | Mutation engine | — | no | exploit | tests/test_mutator.py |
adaptive_exploits.max_mutations | int | 5 | — | config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].max_mutations | cli_exploit_settings.py, mcp_tools/attack_modules.py | Mutation engine | — | no | exploit | tests/test_mutator.py |
adaptive_exploits.mutation_strategies | list[str] | ['parameter_tweak', 'encoding_change', 'delivery_swap', 'context_aware'] | — | config.yaml:381 + CONFIG_SCHEMA['adaptive_exploits'].mutation_strategies | cli_exploit_settings.py, mcp_tools/attack_modules.py | Mutation engine | — | no | exploit | tests/test_mutator.py |
agent.capability_discovery_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].capability_discovery_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.decision_log_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].decision_log_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.generated_code_repair_attempts | int | 3 | — | config.yaml:513 + CONFIG_SCHEMA['agent'].generated_code_repair_attempts | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.max_actions | int | 0 | — | config.yaml:513 + CONFIG_SCHEMA['agent'].max_actions | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.max_retries_per_task | int | 2 | — | config.yaml:513 + CONFIG_SCHEMA['agent'].max_retries_per_task | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.planner_hints_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].planner_hints_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.reflection_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].reflection_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.state_tools_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].state_tools_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
agent.task_graph_enabled | bool | True | — | config.yaml:513 + CONFIG_SCHEMA['agent'].task_graph_enabled | attack_planner.py, decision_log.py | Task graph | — | no | agent | tests/test_agent*.py |
api.allowed_origins | list | [] | — | config.yaml:438 + CONFIG_SCHEMA['api'].allowed_origins | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.enabled | bool | True | — | config.yaml:438 + CONFIG_SCHEMA['api'].enabled | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.event_buffer_size | int | 256 | — | config.yaml:438 + CONFIG_SCHEMA['api'].event_buffer_size | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.graph_route | bool | True | — | config.yaml:438 + CONFIG_SCHEMA['api'].graph_route | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.host | str | '127.0.0.1' | 127.0.0.1 | localhost | ::1 else ERROR | config.yaml:438 + CONFIG_SCHEMA['api'].host | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.max_concurrent_runs | int | 3 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:438 (lab extra) | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.multi_operator | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:438 (lab extra) | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.port | int | 8765 | — | config.yaml:438 + CONFIG_SCHEMA['api'].port | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.serve_webui | bool | False (schema) → True (lab) | — | config.yaml:438 + CONFIG_SCHEMA['api'].serve_webui | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.shutdown_timeout_seconds | int | 15 | — | config.yaml:438 + CONFIG_SCHEMA['api'].shutdown_timeout_seconds | app.py, api/*, doctor.py | WebUI daemon | — | yes | api/webui | tests/test_api*.py |
api.token_file | str | '.webui_secret_key' | — | config.yaml:438 + CONFIG_SCHEMA['api'].token_file | app.py, api/*, doctor.py | WebUI daemon | BREACHPILOT_API_TOKEN overrides | yes | api/webui | tests/test_api*.py |
autonomous.adaptive_replan | bool | False | — | config.yaml:198 + CONFIG_SCHEMA['autonomous'].adaptive_replan | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.checkpoint_every | int | 0 | — | config.yaml:198 + CONFIG_SCHEMA['autonomous'].checkpoint_every | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.dedup_targets | bool | False (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:198 (lab extra) | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.hard_target_max_rounds | int | 0 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:198 (lab extra) | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.max_cycles | int | 100 | — | config.yaml:198 + CONFIG_SCHEMA['autonomous'].max_cycles | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.max_parallel_targets | int | 1 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:198 (lab extra) | — | — | no | autonomous | — | |
autonomous.max_pivot_depth | int | 0 | — | config.yaml:198 + CONFIG_SCHEMA['autonomous'].max_pivot_depth | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.persistence_phase | bool | False | — | config.yaml:198 + CONFIG_SCHEMA['autonomous'].persistence_phase | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
autonomous.skip_non_routable | bool | False (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:198 (lab extra) | autonomous_orchestrator.py | Orchestrator Phase 2 | — | no | autonomous | tests/test_autonomous*.py |
benchmark.baseline_path | str | 'reports/benchmarks/baseline.json' | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].baseline_path | — | — | no | benchmark | — | |
benchmark.enabled | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].enabled | — | — | no | benchmark | — | |
benchmark.output_dir | str | 'reports/benchmarks' | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].output_dir | — | — | no | benchmark | — | |
benchmark.regression.cost_tolerance | float | 0.3 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.cost_tolerance | — | — | no | benchmark | — | |
benchmark.regression.enabled | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.enabled | — | — | no | benchmark | — | |
benchmark.regression.false_positive_tolerance | float | 0.01 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.false_positive_tolerance | — | — | no | benchmark | — | |
benchmark.regression.median_time_tolerance | float | 0.2 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.median_time_tolerance | — | — | no | benchmark | — | |
benchmark.regression.success_rate_tolerance | float | 0.02 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.success_rate_tolerance | — | — | no | benchmark | — | |
benchmark.regression.tool_actions_tolerance | float | 0.3 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].regression.tool_actions_tolerance | — | — | no | benchmark | — | |
benchmark.sandbox_required | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].sandbox_required | — | — | no | benchmark | — | |
benchmark.telemetry.cost | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.cost | — | — | no | benchmark | — | |
benchmark.telemetry.events | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.events | — | — | no | benchmark | — | |
benchmark.telemetry.token_usage | bool | True | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].telemetry.token_usage | — | — | no | benchmark | — | |
benchmark.timeout_seconds | int | 1800 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].timeout_seconds | — | — | no | benchmark | — | |
benchmark.trials | int | 3 | — | config.yaml:276 + CONFIG_SCHEMA['benchmark'].trials | — | — | no | benchmark | — | |
browser.allow_mutating_actions | bool | False | — | config.yaml:299 + CONFIG_SCHEMA['browser'].allow_mutating_actions | — | — | no | browser | — | |
browser.artifact_dir | str | '' | — | config.yaml:299 + CONFIG_SCHEMA['browser'].artifact_dir | — | — | no | browser | — | |
browser.backend | str | 'none' (schema) → 'playwright' (lab) | — | config.yaml:299 + CONFIG_SCHEMA['browser'].backend | — | — | no | browser | — | |
browser.body_sample_max_bytes | int | 4096 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].body_sample_max_bytes | — | — | no | browser | — | |
browser.capture_console | bool | False | — | config.yaml:299 + CONFIG_SCHEMA['browser'].capture_console | — | — | no | browser | — | |
browser.capture_network | bool | True | — | config.yaml:299 + CONFIG_SCHEMA['browser'].capture_network | — | — | no | browser | — | |
browser.capture_screenshots | bool | True | — | config.yaml:299 + CONFIG_SCHEMA['browser'].capture_screenshots | — | — | no | browser | — | |
browser.console_max_events | int | 200 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].console_max_events | — | — | no | browser | — | |
browser.dom_summary_max_chars | int | 8000 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].dom_summary_max_chars | — | — | no | browser | — | |
browser.enabled | bool | False (schema) → True (lab) | — | config.yaml:299 + CONFIG_SCHEMA['browser'].enabled | — | — | no | browser | — | |
browser.executable_path | str | '' | — | config.yaml:299 + CONFIG_SCHEMA['browser'].executable_path | — | — | no | browser | — | |
browser.headless | bool | True | — | config.yaml:299 + CONFIG_SCHEMA['browser'].headless | — | — | no | browser | — | |
browser.max_sessions | int | 2 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].max_sessions | — | — | no | browser | — | |
browser.navigation_timeout_seconds | int | 30 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].navigation_timeout_seconds | — | — | no | browser | — | |
browser.network_max_events | int | 500 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].network_max_events | — | — | no | browser | — | |
browser.persist_storage | bool | False | — | config.yaml:299 + CONFIG_SCHEMA['browser'].persist_storage | — | — | no | browser | — | |
browser.session_timeout_seconds | int | 300 | — | config.yaml:299 + CONFIG_SCHEMA['browser'].session_timeout_seconds | — | — | no | browser | — | |
browser.worker_image | str | '' | — | config.yaml:299 + CONFIG_SCHEMA['browser'].worker_image | — | — | no | browser | — | |
caldera.api_key_env | str | 'CALDERA_API_KEY' | — | config.yaml:509 + CONFIG_SCHEMA['caldera'].api_key_env | plugins/caldera/plugin.py | Caldera emulation | CALDERA_API_KEY | no | ad | |
caldera.enabled | bool | False (schema) → True (lab) | — | config.yaml:509 + CONFIG_SCHEMA['caldera'].enabled | plugins/caldera/plugin.py | Caldera emulation | — | no | ad | |
caldera.url | str | '' | — | config.yaml:509 + CONFIG_SCHEMA['caldera'].url | plugins/caldera/plugin.py | Caldera emulation | — | no | ad | |
chatgpt.enabled | bool | False (schema) → True (lab) | — | config.yaml:561 + CONFIG_SCHEMA['chatgpt'].enabled | providers/chatgpt_provider.py, model_router.py, doctor.py | ChatGPT proxy | — | yes | providers | tests/test_chatgpt*.py |
cve_lookup.api_key_env | str | 'NVD_API_KEY' | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].api_key_env | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | NVD_API_KEY | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.cache_max_entries | int | 100 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].cache_max_entries | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.cache_ttl_seconds | int | 3600 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].cache_ttl_seconds | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.circuit_failure_threshold | int | 5 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].circuit_failure_threshold | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.circuit_recovery_timeout | float | 60.0 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].circuit_recovery_timeout | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.enabled | bool | True | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].enabled | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.epss_enabled | bool | True | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].epss_enabled | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.github.token_env | str | 'GITHUB_TOKEN' | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].github.token_env | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | GITHUB_TOKEN | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.kev_cache_path | str | '' | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_cache_path | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.kev_cache_ttl_seconds | int | 86400 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_cache_ttl_seconds | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.kev_enabled | bool | True | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].kev_enabled | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.max_results | int | 5 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].max_results | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.rate_limit_seconds | float | 6.0 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].rate_limit_seconds | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.search_rate_limit_per_minute | int | 10 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].search_rate_limit_per_minute | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
cve_lookup.timeout_seconds | int | 30 | — | config.yaml:112 + CONFIG_SCHEMA['cve_lookup'].timeout_seconds | mcp_shared, cve_lookup.py | NVD + KEV/EPSS | — | no | research/cve | tests/test_cve_lookup.py |
embeddings.provider | str | 'ollama' (schema) → 'none' (lab) | — | config.yaml:507 + CONFIG_SCHEMA['embeddings'].provider | — | — | yes | embeddings | — | |
engine_mcp.enabled | bool | True | — | config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].enabled | mcp_engine_server.py | Advisory MCP enable | — | yes | mcp/engine | |
engine_mcp.host | str | '127.0.0.1' | — | config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].host | mcp_engine_server.py | Loopback bind | — | yes | mcp/engine | |
engine_mcp.port | int | 8002 | — | config.yaml:53 + CONFIG_SCHEMA['engine_mcp'].port | mcp_engine_server.py | HTTP port | — | yes | mcp/engine | |
eval.baseline_path | str | 'reports/eval/baseline.json' | — | config.yaml:268 + CONFIG_SCHEMA['eval'].baseline_path | — | — | no | eval | — | |
eval.enabled | bool | True | — | config.yaml:268 + CONFIG_SCHEMA['eval'].enabled | eval_harness.py | Eval harness | — | no | eval | tests/test_eval*.py |
eval.max_rounds | int | 30 | — | config.yaml:268 + CONFIG_SCHEMA['eval'].max_rounds | eval_harness.py | Eval harness | — | no | eval | tests/test_eval*.py |
eval.output_dir | str | 'reports/eval' | — | config.yaml:268 + CONFIG_SCHEMA['eval'].output_dir | eval_harness.py | Eval harness | — | no | eval | tests/test_eval*.py |
eval.regression_tolerance | float | 0.05 | — | config.yaml:268 + CONFIG_SCHEMA['eval'].regression_tolerance | — | — | no | eval | — | |
eval.write_html | bool | True | — | config.yaml:268 + CONFIG_SCHEMA['eval'].write_html | eval_harness.py | Eval harness | — | no | eval | tests/test_eval*.py |
eval.write_markdown | bool | True | — | config.yaml:268 + CONFIG_SCHEMA['eval'].write_markdown | eval_harness.py | Eval harness | — | no | eval | tests/test_eval*.py |
exploit.ad_kerberos.adcs_enum | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.adcs_enum | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.asrep_roast | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.asrep_roast | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.bloodhound | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.bloodhound | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.enabled | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.enabled | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.golden_ticket | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.golden_ticket | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.pass_the_hash | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.pass_the_hash | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.responder_relay | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.responder_relay | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.ad_kerberos.smb_signing_check | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].ad_kerberos.smb_signing_check | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.allowed_targets | list[str] | [] (schema) → ['127.0.0.1'] (lab) | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].allowed_targets | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | EXPLOIT_TARGET* + EXPLOIT_DISCOVERED_TARGETS | no | exploit/agent | tests/test_scope_gate.py |
exploit.attack_max_commands | int | 150 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_commands | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.attack_max_duration_minutes | int | 360 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_duration_minutes | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.attack_max_rounds | int | 50 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_max_rounds | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.attack_mode | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].attack_mode | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.attacker_os | str | 'auto' | auto | linux | windows | config.yaml:61 + CONFIG_SCHEMA['exploit'].attacker_os | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.auto_post_exploit | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].auto_post_exploit | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.cache_max_entries | int | 50 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].cache_max_entries | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.cache_ttl_seconds | int | 3600 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].cache_ttl_seconds | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.command_timeout_seconds | int | 300 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].command_timeout_seconds | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.context_summarize_every | int | 10 (schema) → 50 (lab) | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].context_summarize_every | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.disallowed_assets | list | [] | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].disallowed_assets | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.enabled | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].enabled | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.forbidden_actions | list | [] | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].forbidden_actions | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.listeners.dns | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.dns | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.listeners.https_beacon | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.https_beacon | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.listeners.socks_pivot | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.socks_pivot | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.listeners.tls | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].listeners.tls | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.loot_workspace | str | 'exploit_workspace/loot' | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].loot_workspace | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.max_commands_per_session | int | 9999 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].max_commands_per_session | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.max_pivot_depth | int | 2 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].max_pivot_depth | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.max_query_chars | int | 200 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].max_query_chars | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.max_rounds | int | 200 | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].max_rounds | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.mode | str | 'standalone' | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].mode | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.msf.auto_local_exploit_suggester | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].msf.auto_local_exploit_suggester | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.msf.recipes_enabled | bool | False | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].msf.recipes_enabled | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.msfconsole_path | str | 'msfconsole' | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].msfconsole_path | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.permission | str | 'full_access' | full_access | approve_only | read_only | config.yaml:61 + CONFIG_SCHEMA['exploit'].permission | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.require_explicit_allowlist | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].require_explicit_allowlist | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.searchsploit_path | str | 'searchsploit' | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].searchsploit_path | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.shell | str | 'bash' | bash | config.yaml:61 + CONFIG_SCHEMA['exploit'].shell | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.terminal | str | 'visible' | visible | hidden | config.yaml:61 + CONFIG_SCHEMA['exploit'].terminal | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.web_search | bool | True | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].web_search | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | — | no | exploit/agent | tests/test_scope_gate.py |
exploit.workspace_dir | str | 'exploit_workspace' | — | config.yaml:61 + CONFIG_SCHEMA['exploit'].workspace_dir | cli_exploit_settings.py, mcp_tools/terminal, mcp_shared | Attack posture/budgets/allowlist lock | EXPLOIT_WORKSPACE | no | exploit/agent | tests/test_scope_gate.py |
fsm.enabled | bool | False | — | config.yaml:208 + CONFIG_SCHEMA['fsm'].enabled | — | — | no | fsm | — | |
fsm.max_retries_per_step | int | 3 | — | config.yaml:208 + CONFIG_SCHEMA['fsm'].max_retries_per_step | — | — | no | fsm | — | |
hitl.enabled | bool | True | — | config.yaml:361 + CONFIG_SCHEMA['hitl'].enabled | — | — | no | hitl | — | |
ics.allow_write | bool | False | — | config.yaml:450 + CONFIG_SCHEMA['ics'].allow_write | attack_modules/modules/ics_iot.py | ICS write gates | — | no | ics | tests/test_ics*.py |
ics.destructive_ics | bool | False | — | config.yaml:450 + CONFIG_SCHEMA['ics'].destructive_ics | attack_modules/modules/ics_iot.py | ICS write gates | — | no | ics | tests/test_ics*.py |
killchain.enabled | bool | False | — | config.yaml:294 + CONFIG_SCHEMA['killchain'].enabled | — | — | no | killchain | — | |
killchain.goal_state | str | 'shell_as_root' | — | config.yaml:294 + CONFIG_SCHEMA['killchain'].goal_state | — | — | no | killchain | — | |
killchain.graph_db | str | '' | — | config.yaml:294 + CONFIG_SCHEMA['killchain'].graph_db | — | — | no | killchain | — | |
killchain.require_verification | bool | True | — | config.yaml:294 + CONFIG_SCHEMA['killchain'].require_verification | — | — | no | killchain | — | |
long_session.attack_max_commands | int | 1000 | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_commands | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.attack_max_duration_minutes | int | 720 | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_duration_minutes | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.attack_max_rounds | int | 200 | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].attack_max_rounds | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.enabled | bool | False (schema) → True (lab) | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].enabled | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.persist_messages | bool | True | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].persist_messages | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.request_timeout_seconds | int | 600 | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].request_timeout_seconds | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
long_session.swarm_session_timeout_minutes | int | 30 | — | config.yaml:318 + CONFIG_SCHEMA['long_session'].swarm_session_timeout_minutes | cli_exploit_settings.py, run_service/service.py | Multi-hour budgets | — | no | long_session | tests/test_long*.py |
mcp.default_transport | str | 'stdio' | stdio | http | config.yaml:51 + CONFIG_SCHEMA['mcp'].default_transport | config_manager, mcp_session.py | stdio|http | — | yes | mcp | tests/test_config_manager.py |
memory.attack_memory_enabled | bool | True | — | config.yaml:335 + CONFIG_SCHEMA['memory'].attack_memory_enabled | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.attack_memory_max_context_chars | int | 6000 | — | config.yaml:335 + CONFIG_SCHEMA['memory'].attack_memory_max_context_chars | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.cross_mission_learning | bool | True | — | config.yaml:335 + CONFIG_SCHEMA['memory'].cross_mission_learning | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.embedding_model | str | 'nomic-embed-text' | — | config.yaml:335 + CONFIG_SCHEMA['memory'].embedding_model | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.experience_min_samples | int | 3 | — | config.yaml:335 + CONFIG_SCHEMA['memory'].experience_min_samples | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.experience_time_decay_days | int | 90 | — | config.yaml:335 + CONFIG_SCHEMA['memory'].experience_time_decay_days | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
memory.semantic_enabled | bool | True | — | config.yaml:335 + CONFIG_SCHEMA['memory'].semantic_enabled | tools/exploit_agent/runner/_impl.py, semantic_memory.py | Cross-mission memory | — | no | memory | tests/test_memory.py |
mitre.enabled | bool | True | — | config.yaml:482 + CONFIG_SCHEMA['mitre'].enabled | mitre_export.py | ATT&CK export | — | no | mitre | |
mitre.include_skill_tags | bool | True | — | config.yaml:482 + CONFIG_SCHEMA['mitre'].include_skill_tags | mitre_export.py | ATT&CK export | — | no | mitre | |
mitre.navigator_output_dir | str | 'reports/mitre' | — | config.yaml:482 + CONFIG_SCHEMA['mitre'].navigator_output_dir | mitre_export.py | ATT&CK export | — | no | mitre | |
mitre.technique_map | str | 'tools/mitre_technique_map.json' | — | config.yaml:482 + CONFIG_SCHEMA['mitre'].technique_map | mitre_export.py | ATT&CK export | — | no | mitre | |
models.auto_update | bool | True | — | config.yaml:6 + CONFIG_SCHEMA['models'].auto_update | — | — | yes | models | — | |
models.default_alias | str | 'glm' | — | config.yaml:6 + CONFIG_SCHEMA['models'].default_alias | config_manager, run_service/service.py | Active alias | — | yes | models | tests/test_config_manager.py |
models.info.deepseek.context_window | int | 1000000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.context_window | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.deepseek.description | str | 'DeepSeek V4 Pro — 1M token context, deep code reasoning.' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.description | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.deepseek.label | str | 'DeepSeek V4 Pro' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek.label | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.deepseek_flash.context_window | int | 1000000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.context_window | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.deepseek_flash.description | str | 'DeepSeek V4 Flash - 1M token context, fast DeepSeek option for lower-latency work.' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.description | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.deepseek_flash.label | str | 'DeepSeek V4 Flash' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.deepseek_flash.label | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.glm.context_window | int | 976000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.context_window | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.glm.description | str | 'Zhipu GLM-5.2 — 976K context, the smartest/newest GLM for deep reasoning + coding.' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.description | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.glm.label | str | 'GLM-5.2' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm.label | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.glm3.context_window | int | 128000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.context_window | — | — | yes | memory/context | — | |
models.info.glm3.description | str | 'Zhipu GLM-5.3 Flash — fast low-latency GLM option (128K context).' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.description | — | — | yes | memory/context | — | |
models.info.glm3.label | str | 'GLM-5.3 Flash' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.glm3.label | — | — | yes | memory/context | — | |
models.info.kimi.context_window | int | 256000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.context_window | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.kimi.description | str | 'Moonshot Kimi K2.6 — strong long-form reasoning, 256K context.' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.description | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.kimi.label | str | 'Kimi K2.6' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.kimi.label | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.minimax.context_window | int | 512000 | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.context_window | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.minimax.description | str | 'Minimax M3 (cloud) — 512K context, balanced coding + reasoning.' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.description | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.info.minimax.label | str | 'Minimax M3' | — | config.yaml:6 + CONFIG_SCHEMA['models'].info.minimax.label | model_router, exploit_agent/context | Context windows | — | yes | memory/context | tests/test_config_manager.py |
models.provider | str | 'ollama' (schema) → 'opencode_go' (lab) | ollama | chatgpt | config.yaml:6 + CONFIG_SCHEMA['models'].provider | config_manager.get_ai_provider, model_router, doctor.py | Active chat provider | — | yes | providers | tests/test_config_manager.py |
models.registry.deepseek | str | 'deepseek-v4-pro:cloud' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.deepseek | config_manager, doctor.py, run_service | Alias→model_id map | — | yes | models | tests/test_config_manager.py |
models.registry.deepseek_flash | str | 'deepseek-v4-flash:cloud' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.deepseek_flash | config_manager, doctor.py, run_service | Alias→model_id map | — | yes | models | tests/test_config_manager.py |
models.registry.glm | str | 'glm-5.2:cloud' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.glm | config_manager, doctor.py, run_service | Alias→model_id map | — | yes | models | tests/test_config_manager.py |
models.registry.glm3 | str | 'glm-5.3-flash' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.glm3 | — | — | yes | models | — | |
models.registry.kimi | str | 'kimi-k2.6:cloud' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.kimi | config_manager, doctor.py, run_service | Alias→model_id map | — | yes | models | tests/test_config_manager.py |
models.registry.minimax | str | 'minimax-m3:cloud' | — | config.yaml:6 + CONFIG_SCHEMA['models'].registry.minimax | config_manager, doctor.py, run_service | Alias→model_id map | — | yes | models | tests/test_config_manager.py |
models.roles.code_generator | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.code_generator | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
models.roles.critic | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.critic | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
models.roles.executor | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.executor | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
models.roles.interpreter | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.interpreter | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
models.roles.planner | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.planner | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
models.roles.summarizer | str | '' | — | config.yaml:6 + CONFIG_SCHEMA['models'].roles.summarizer | model_router.get_client_for_role | Per-role model alias | — | yes | reasoning | tests/test_config_manager.py |
multi_model.consult_aliases | list[str] | ['kimi', 'deepseek', 'deepseek_flash', 'glm', 'minimax'] | — | config.yaml:389 + CONFIG_SCHEMA['multi_model'].consult_aliases | mcp_tools/peer_models.py, exploit_agent/reflection.py | Peer consultation | — | no | multi-model | tests/test_peer*.py |
multi_model.enabled | bool | False (schema) → True (lab) | — | config.yaml:389 + CONFIG_SCHEMA['multi_model'].enabled | mcp_tools/peer_models.py, exploit_agent/reflection.py | Peer consultation | — | no | multi-model | tests/test_peer*.py |
multi_model.max_answer_chars | int | 8000 | — | config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_answer_chars | mcp_tools/peer_models.py, exploit_agent/reflection.py | Peer consultation | — | no | multi-model | tests/test_peer*.py |
multi_model.max_consultations | int | 10 | — | config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_consultations | mcp_tools/peer_models.py, exploit_agent/reflection.py | Peer consultation | — | no | multi-model | tests/test_peer*.py |
multi_model.max_question_chars | int | 4000 | — | config.yaml:389 + CONFIG_SCHEMA['multi_model'].max_question_chars | mcp_tools/peer_models.py, exploit_agent/reflection.py | Peer consultation | — | no | multi-model | tests/test_peer*.py |
nmap.path | str | 'nmap' | — | config.yaml:57 + CONFIG_SCHEMA['nmap'].path | recon_pipeline, mcp_server, doctor | Binary override | — | no | recon | tests/test_recon.py |
nmap.priv_fallback | bool | True | — | config.yaml:57 + CONFIG_SCHEMA['nmap'].priv_fallback | recon_pipeline | auto-downgrade | — | no | recon | tests/test_recon.py |
nmap.sudo | bool | False | — | config.yaml:57 + CONFIG_SCHEMA['nmap'].sudo | recon_pipeline, nmap_priv | sudo -n | — | no | recon | tests/test_recon.py |
ollama.api_key_env | str | 'OLLAMA_API_KEY' | — | config.yaml:1 + CONFIG_SCHEMA['ollama'].api_key_env | api_key_store.py, model_router.py | Env var name holding bearer token | OLLAMA_API_KEY (named by this key) | yes | secrets | tests/test_config_cli.py |
ollama.embed_host | str | 'http://localhost:11434' | — | config.yaml:1 + CONFIG_SCHEMA['ollama'].embed_host | config_manager.py, tools/exploit_agent/runner/_impl.py | Embedding host fallback | — | yes | memory/embeddings | tests/test_config_manager.py |
ollama.host | str | 'https://api.ollama.com' | — | config.yaml:1 + CONFIG_SCHEMA['ollama'].host | model_router.py, doctor.py | Ollama endpoint for chat/generate | — | yes | models/provider | tests/test_config_manager.py |
ollama.model | str | 'glm-5.2:cloud' | — | config.yaml:1 + CONFIG_SCHEMA['ollama'].model | config_manager.py, interactive_menu.py | Default concrete model id | — | yes | models | tests/test_config_manager.py |
opencode_go.enabled | bool | False (schema) → True (lab) | — | config.yaml:563 + CONFIG_SCHEMA['opencode_go'].enabled | — | — | yes | providers | — | |
operator_connection.auto_start_listener | bool | True | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].auto_start_listener | — | — | no | operator | — | |
operator_connection.beacon_interval_seconds | int | 300 | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].beacon_interval_seconds | — | — | no | operator | — | |
operator_connection.default_callback_port | int | 4444 | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].default_callback_port | — | — | no | operator | — | |
operator_connection.default_listener_type | str | 'netcat' | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].default_listener_type | — | — | no | operator | — | |
operator_connection.enabled | bool | True | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].enabled | — | — | no | operator | — | |
operator_connection.health_check_interval_seconds | int | 60 | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].health_check_interval_seconds | — | — | no | operator | — | |
operator_connection.workspace_dir | str | 'exploit_workspace' | — | config.yaml:523 + CONFIG_SCHEMA['operator_connection'].workspace_dir | — | — | no | operator | — | |
opsec.doh | bool | False | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].doh | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.doh_provider | str | 'cloudflare' | cloudflare | google | config.yaml:255 + CONFIG_SCHEMA['opsec'].doh_provider | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.enabled | bool | False | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].enabled | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.jitter_seconds | float | 0.0 | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].jitter_seconds | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.local_cidrs | list | [] | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].local_cidrs | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.local_targets_off | bool | True | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].local_targets_off | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.min_gap_seconds | float | 0.0 | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].min_gap_seconds | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.noise_budget | int | 0 | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].noise_budget | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.public_autonomy | bool | True | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].public_autonomy | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.quiet_command_patterns | list | [] | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].quiet_command_patterns | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.rate_per_minute | int | 0 | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].rate_per_minute | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
opsec.ua_rotation | bool | False | — | config.yaml:255 + CONFIG_SCHEMA['opsec'].ua_rotation | opsec.py, validation_utils.is_private_or_local_target | OPSEC hardening | — | no | opsec | tests/test_opsec.py |
orchestrator.semantic_memory | bool | True | — | config.yaml:211 + CONFIG_SCHEMA['orchestrator'].semantic_memory | autonomous_orchestrator.py | Cross-mission semantic memory | — | no | autonomous | |
outcome_judgment.confirmation_threshold | float | 0.75 | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].confirmation_threshold | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
outcome_judgment.flow_a | bool | False (schema) → True (lab) | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].flow_a | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
outcome_judgment.max_inconclusive_attempts | int | 3 | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].max_inconclusive_attempts | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
outcome_judgment.min_evidence_references | int | 1 | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].min_evidence_references | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
outcome_judgment.peer_review | bool | False (schema) → True (lab) | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].peer_review | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
outcome_judgment.refutation_threshold | float | 0.75 | — | config.yaml:343 + CONFIG_SCHEMA['outcome_judgment'].refutation_threshold | cli_exploit_settings.py, outcome_judge.py | Evidence verdicts | — | no | eval | tests/test_outcome*.py |
plugins.disabled | list | [] | — | config.yaml:453 + CONFIG_SCHEMA['plugins'].disabled | plugins.py | Plugin discovery | — | no | plugins | tests/test_plugins*.py |
plugins.enabled | list[str] | [] (schema) → ['shodan_recon', 'github_dorks', 'webhook_notify', 'sliver_c2', 'bloodhound_ce', 'zap_scan', 'browser_attack', 'mobile_attack', 'wireless', 'spiderfoot', 'atomic_red_team', 'caldera', 'firmware_analysis'] (lab) | — | config.yaml:453 + CONFIG_SCHEMA['plugins'].enabled | plugins.py | Plugin discovery | — | no | plugins | tests/test_plugins*.py |
plugins.entry_points | bool | True | — | config.yaml:453 + CONFIG_SCHEMA['plugins'].entry_points | plugins.py | Plugin discovery | — | no | plugins | tests/test_plugins*.py |
plugins.search_paths | list[str] | ['plugins'] | — | config.yaml:453 + CONFIG_SCHEMA['plugins'].search_paths | plugins.py | Plugin discovery | — | no | plugins | tests/test_plugins*.py |
poc_verification.compile_timeout_seconds | int | 30 | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].compile_timeout_seconds | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.docker_image | str | 'python:3.11-slim' | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_image | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.docker_memory | str | '256m' | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_memory | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.docker_network | str | 'none' | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_network | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.docker_read_only | bool | True | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].docker_read_only | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.enabled | bool | False (schema) → True (lab) | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].enabled | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
poc_verification.max_retries | int | 3 | — | config.yaml:350 + CONFIG_SCHEMA['poc_verification'].max_retries | poc_verifier.py, mcp_tools/attack_modules.py | PoC compile gate | — | no | poc | tests/test_poc*.py |
providers.chatgpt.enabled | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.api_key_env | str | 'OPENCODE_GO_API_KEY' (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.base_url | str | 'https://opencode.ai/zen/go/v1' (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.context_window | int | 128000 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.default_model | str | 'muse-spark-1.2-contributor' (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.discover_cache_seconds | int | 300 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.enabled | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.models | list | [] (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
providers.opencode_go.request_timeout_seconds | int | 300 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:495 (lab extra) | — | — | yes | providers | — | |
reasoning.chain_of_thought | bool | True | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].chain_of_thought | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.critic_enabled | bool | True | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].critic_enabled | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.llm_reflection | bool | False (schema) → True (lab) | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].llm_reflection | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.observer_mode | str | 'hybrid' | heuristic | llm | hybrid | config.yaml:326 + CONFIG_SCHEMA['reasoning'].observer_mode | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.peer_consult_on_failure_threshold | int | 3 | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].peer_consult_on_failure_threshold | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.reflection_every_n_actions | int | 10 | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].reflection_every_n_actions | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.ultrathink | bool | False (schema) → True (lab) | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].ultrathink | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
reasoning.ultrathink_reflection_interval | int | 3 | — | config.yaml:326 + CONFIG_SCHEMA['reasoning'].ultrathink_reflection_interval | cli_exploit_settings.py, tools/exploit_agent/runner/_impl.py | CoT / reflection | — | no | reasoning | tests/test_reasoning.py |
recon.asn_whois | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].asn_whois | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.cloud_metadata_probe | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].cloud_metadata_probe | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.dns_zone_transfer | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].dns_zone_transfer | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.domain_resolution.dns_zone_transfer | bool | False (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.domain_resolution.enabled | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.domain_resolution.max_subdomains | int | 500 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.domain_resolution.subdomain_sources | list[str] | ['crt_sh', 'dns_bruteforce', 'subfinder', 'amass'] (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.domain_resolution.whois_enabled | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.extended_enumerators | bool | True | — | config.yaml:213 + CONFIG_SCHEMA['recon'].extended_enumerators | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.cache_ttl_seconds | int | 300 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.cve_concurrency | int | 8 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.cve_lookup | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.enabled | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.max_concurrency | int | 8 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.overall_timeout_seconds | int | 180 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.passive_osint | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.per_task_timeout_seconds | int | 60 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.service_concurrency | int | 6 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.service_enumeration | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.tcp_discovery | bool | True (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.fast.udp_top_ports | int | 50 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.max_retries | int | 2 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.preflight_ports | list[int] | [80, 443] (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.preflight_probe | bool | False (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.preflight_timeout_ms | int | 1000 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.retry_delay | float | 5.0 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.shodan_api_key | str | '' | — | config.yaml:213 + CONFIG_SCHEMA['recon'].shodan_api_key | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | SHODAN_API_KEY (file wins) | no | recon | tests/test_recon*.py |
recon.snmp_enum | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].snmp_enum | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.subdomain_enum | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].subdomain_enum | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.timeout_seconds | int | 300 (lab-only, not in CONFIG_SCHEMA) | — | config.yaml:213 (lab extra) | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.udp_top_ports | int | 100 | — | config.yaml:213 + CONFIG_SCHEMA['recon'].udp_top_ports | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.vhost_discovery | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].vhost_discovery | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
recon.waf_fingerprint | bool | False | — | config.yaml:213 + CONFIG_SCHEMA['recon'].waf_fingerprint | recon_pipeline.py, tools/mcp_tools/domain.py | Recon coverage & depth | — | no | recon | tests/test_recon*.py |
replay_simulator.counterfactual | bool | False | — | config.yaml:358 + CONFIG_SCHEMA['replay_simulator'].counterfactual | — | — | no | — | — | |
replay_simulator.enabled | bool | False (schema) → True (lab) | — | config.yaml:358 + CONFIG_SCHEMA['replay_simulator'].enabled | — | — | — | no | — | — |
research.allow_local_fetch | bool | False | — | config.yaml:141 + CONFIG_SCHEMA['research'].allow_local_fetch | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.automatic | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.automatic | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.enabled | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.enabled | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.failure_trigger | int | 2 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.failure_trigger | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.max_advisory_chars | int | 4000 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_advisory_chars | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.max_auto_consultations | int | 4 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_auto_consultations | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.max_model_rounds | int | 3 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_model_rounds | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.max_tool_calls_per_consultation | int | 5 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.max_tool_calls_per_consultation | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.model_alias | str | '' | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.model_alias | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.save_advisories | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.save_advisories | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.assistant.timeout_seconds | int | 90 | — | config.yaml:141 + CONFIG_SCHEMA['research'].assistant.timeout_seconds | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.cache_max_entries | int | 250 | — | config.yaml:141 + CONFIG_SCHEMA['research'].cache_max_entries | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.cache_ttl_seconds | int | 1800 | — | config.yaml:141 + CONFIG_SCHEMA['research'].cache_ttl_seconds | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.enabled | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].enabled | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.fallback_provider | str | 'serpapi' | ollama | serpapi | stdlib | "" | config.yaml:141 + CONFIG_SCHEMA['research'].fallback_provider | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.max_content_chars | int | 12000 | — | config.yaml:141 + CONFIG_SCHEMA['research'].max_content_chars | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.max_fetch_depth | int | 5 | — | config.yaml:141 + CONFIG_SCHEMA['research'].max_fetch_depth | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.max_results | int | 8 | — | config.yaml:141 + CONFIG_SCHEMA['research'].max_results | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.min_source_quality | str | 'medium' | low | medium | high | config.yaml:141 + CONFIG_SCHEMA['research'].min_source_quality | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.ollama.api_key_env | str | 'OLLAMA_API_KEY' | — | config.yaml:141 + CONFIG_SCHEMA['research'].ollama.api_key_env | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | OLLAMA_API_KEY | no | research | tests/test_research.py |
research.ollama.max_results | int | 8 | — | config.yaml:141 + CONFIG_SCHEMA['research'].ollama.max_results | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.ollama.use_web_fetch | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].ollama.use_web_fetch | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.ollama.use_web_search | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].ollama.use_web_search | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.provider | str | 'ollama' | ollama | serpapi | stdlib | config.yaml:141 + CONFIG_SCHEMA['research'].provider | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.require_api_key_for_mcp_tools | bool | True | — | config.yaml:141 + CONFIG_SCHEMA['research'].require_api_key_for_mcp_tools | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.serpapi.api_key_env | str | 'SERPAPI_API_KEY' | — | config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.api_key_env | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | SERPAPI_API_KEY | no | research | tests/test_research.py |
research.serpapi.endpoint | str | 'https://serpapi.com/search.json' | — | config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.endpoint | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.serpapi.engine | str | 'duckduckgo' | — | config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.engine | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.serpapi.region | str | 'us-en' | — | config.yaml:141 + CONFIG_SCHEMA['research'].serpapi.region | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
research.timeout_seconds | int | 15 | — | config.yaml:141 + CONFIG_SCHEMA['research'].timeout_seconds | mcp_shared, web_researcher.py, api_key_store.py | Web research + cache | — | no | research | tests/test_research.py |
sandbox.auto_manage_docker | bool | False (schema) → True (lab) | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].auto_manage_docker | — | — | no | sandbox | — | |
sandbox.backend | str | 'docker' | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].backend | — | — | no | sandbox | — | |
sandbox.cleanup.remove_on_exit | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].cleanup.remove_on_exit | — | — | no | sandbox | — | |
sandbox.cleanup.remove_stale_on_startup | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].cleanup.remove_stale_on_startup | — | — | no | sandbox | — | |
sandbox.docker_start_timeout_seconds | int | 60 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].docker_start_timeout_seconds | — | — | no | sandbox | — | |
sandbox.docker_stop_timeout_seconds | int | 30 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].docker_stop_timeout_seconds | — | — | no | sandbox | — | |
sandbox.enabled | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].enabled | — | — | no | sandbox | — | |
sandbox.env_passthrough | list | [] | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].env_passthrough | — | — | no | sandbox | — | |
sandbox.fallback_native | bool | False | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].fallback_native | — | — | no | sandbox | — | |
sandbox.image | str | 'breachpilot-sandbox:latest' | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].image | — | — | no | sandbox | — | |
sandbox.multi_net_raw | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].multi_net_raw | — | — | no | sandbox | — | |
sandbox.network.allow_dns | str | 'controlled' | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_dns | — | — | no | sandbox | — | |
sandbox.network.allow_gateway | bool | False | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_gateway | — | — | no | sandbox | — | |
sandbox.network.allow_research_hosts | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.allow_research_hosts | — | — | no | sandbox | — | |
sandbox.network.enforce | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.enforce | — | — | no | sandbox | — | |
sandbox.network.extra_allow_cidrs | list | [] | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.extra_allow_cidrs | — | — | no | sandbox | — | |
sandbox.network.fail_closed | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.fail_closed | — | — | no | sandbox | — | |
sandbox.network.map_host_loopback | bool | False | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].network.map_host_loopback | — | — | no | sandbox | — | |
sandbox.read_only_rootfs | bool | True | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].read_only_rootfs | — | — | no | sandbox | — | |
sandbox.resources.cpus | int | 2 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.cpus | — | — | no | sandbox | — | |
sandbox.resources.memory_mb | int | 4096 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.memory_mb | — | — | no | sandbox | — | |
sandbox.resources.output_max_bytes | int | 2000000 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.output_max_bytes | — | — | no | sandbox | — | |
sandbox.resources.pids | int | 512 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.pids | — | — | no | sandbox | — | |
sandbox.resources.timeout_seconds | int | 300 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.timeout_seconds | — | — | no | sandbox | — | |
sandbox.resources.tmpfs_size_mb | int | 256 | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].resources.tmpfs_size_mb | — | — | no | sandbox | — | |
sandbox.user | str | 'sandbox' | — | config.yaml:531 + CONFIG_SCHEMA['sandbox'].user | — | — | no | sandbox | — | |
skills.allow_model_lookup | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].allow_model_lookup | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.allow_reference_listing | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].allow_reference_listing | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.context_skill_weight | int | 24 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].context_skill_weight | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.default_enabled | list[str] | ['scanning-network-with-nmap-advanced', 'conducting-network-penetration-test', 'executing-red-team-engagement-planning', 'auditing-mcp-servers-for-tool-poisoning', 'securing-agentic-ai-tool-invocation'] (schema) → ['scanning-network-with-nmap-advanced', 'conducting-network-penetration-test', 'executing-red-team-engagement-planning', 'auditing-mcp-servers-for-tool-poisoning', 'securing-agentic-ai-tool-invocation', 'attacking-domains-end-to-end'] (lab) | — | config.yaml:400 + CONFIG_SCHEMA['skills'].default_enabled | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.default_skill_weight | int | 12 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].default_skill_weight | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.diversity_penalty | int | 12 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].diversity_penalty | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.enabled | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].enabled | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.exclude_names | list | [] | — | config.yaml:400 + CONFIG_SCHEMA['skills'].exclude_names | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.feedback_enabled | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_enabled | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.feedback_min_observations | int | 3 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_min_observations | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.feedback_skill_weight | int | 8 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].feedback_skill_weight | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.include_metadata | bool | False | — | config.yaml:400 + CONFIG_SCHEMA['skills'].include_metadata | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.include_tags | list | [] | — | config.yaml:400 + CONFIG_SCHEMA['skills'].include_tags | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.inject_startup_context | bool | False | — | config.yaml:400 + CONFIG_SCHEMA['skills'].inject_startup_context | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.max_active_skills | int | 6 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].max_active_skills | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.max_chars_per_skill | int | 2500 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].max_chars_per_skill | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.max_total_chars | int | 9000 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].max_total_chars | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.maybe_enabled | bool | False | — | config.yaml:400 + CONFIG_SCHEMA['skills'].maybe_enabled | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.min_contextual_skills | int | 3 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].min_contextual_skills | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.reselect_max_per_run | int | 3 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_max_per_run | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.reselect_mid_run | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_mid_run | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.reselect_min_interval_actions | int | 5 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_min_interval_actions | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.reselect_sticky_defaults | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].reselect_sticky_defaults | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.roots | list[str] | ['skills'] | — | config.yaml:400 + CONFIG_SCHEMA['skills'].roots | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.semantic_matching | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_matching | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.semantic_min_similarity | float | 0.35 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_min_similarity | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.semantic_model | str | 'nomic-embed-text' | — | config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_model | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.semantic_skill_weight | int | 16 | — | config.yaml:400 + CONFIG_SCHEMA['skills'].semantic_skill_weight | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.swarm_inject | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].swarm_inject | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
skills.swarm_phase_hints_only | bool | True | — | config.yaml:400 + CONFIG_SCHEMA['skills'].swarm_phase_hints_only | skill_selector.py, skill_pipeline.py, exploit_agent/skills.py | Runtime skills | — | no | skills | tests/test_skills*.py |
snapshots.auto_before_destructive | bool | True | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].auto_before_destructive | — | — | no | snapshots | — | |
snapshots.enabled | bool | False | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].enabled | — | — | no | snapshots | — | |
snapshots.max_snapshots_per_target | int | 3 | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].max_snapshots_per_target | — | — | no | snapshots | — | |
snapshots.provider | str | 'docker' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].provider | — | — | no | snapshots | — | |
snapshots.providers.docker.compose_file | str | 'eval_targets/docker-compose.yml' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.docker.compose_file | — | — | no | snapshots | — | |
snapshots.providers.hyperv.powershell_command | str | 'powershell' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.hyperv.powershell_command | — | — | no | snapshots | — | |
snapshots.providers.libvirt.virsh_path | str | 'virsh' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.libvirt.virsh_path | — | — | no | snapshots | — | |
snapshots.providers.proxmox.host | str | '' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.proxmox.host | — | — | no | snapshots | — | |
snapshots.providers.proxmox.node | str | '' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.proxmox.node | — | — | no | snapshots | — | |
snapshots.providers.vmware.vmrun_path | str | 'vmrun' | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].providers.vmware.vmrun_path | — | — | no | snapshots | — | |
snapshots.vm_map | dict | {} | — | config.yaml:363 + CONFIG_SCHEMA['snapshots'].vm_map | — | — | no | snapshots | — | |
stealth.dns_over_https | bool | False | — | config.yaml:108 + CONFIG_SCHEMA['stealth'].dns_over_https | interactive_menu.py (legacy) | Legacy stealth | — | no | opsec | |
stealth.doh_provider | str | 'cloudflare' | cloudflare | google | config.yaml:108 + CONFIG_SCHEMA['stealth'].doh_provider | interactive_menu.py (legacy) | Legacy stealth | — | no | opsec | |
stealth.rotate_ua | bool | False | — | config.yaml:108 + CONFIG_SCHEMA['stealth'].rotate_ua | interactive_menu.py (legacy) | Legacy stealth | — | no | opsec | |
swarm.agents | list[str] | ['recon', 'vuln', 'exploit', 'post_exploit', 'critic', 'reflection'] | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].agents | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.enabled | bool | True | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].enabled | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.exploit_parallel | bool | False | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].exploit_parallel | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.max_parallel_agents | int | 3 | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].max_parallel_agents | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.negotiation_rounds | int | 0 (schema) → 2 (lab) | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].negotiation_rounds | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.parallel_enabled | bool | False | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].parallel_enabled | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.per_phase_concurrency | int | 3 | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].per_phase_concurrency | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
swarm.subagent_timeout_seconds | int | 600 | — | config.yaml:175 + CONFIG_SCHEMA['swarm'].subagent_timeout_seconds | cli_exploit_settings.py, swarm/orchestrator.py | Multi-agent swarm | — | no | swarm | tests/test_swarm*.py |
threat_intel.cache_dir | str | 'exploit_workspace/.threat_intel' | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].cache_dir | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.cache_ttl_seconds | int | 86400 | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].cache_ttl_seconds | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.enabled | bool | True | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].enabled | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.github_token_env | str | 'GITHUB_TOKEN' | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].github_token_env | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | GITHUB_TOKEN | no | threat_intel | tests/test_threat*.py |
threat_intel.max_results | int | 20 | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].max_results | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.sources.exploitdb_rss | bool | False | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.exploitdb_rss | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.sources.ghsa | bool | True | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.ghsa | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.sources.kev | bool | True | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.kev | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.sources.osv | bool | True | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].sources.osv | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
threat_intel.timeout_seconds | int | 30 | — | config.yaml:129 + CONFIG_SCHEMA['threat_intel'].timeout_seconds | threat_intel.py, mcp_tools/research.py | OSV/GHSA/KEV | — | no | threat_intel | tests/test_threat*.py |
ticketing.backoff_seconds | float | 2.0 | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].backoff_seconds | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.base_url | str | '' | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].base_url | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.enabled | bool | True | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].enabled | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.max_retries | int | 3 | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].max_retries | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.project_key | str | '' | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].project_key | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.provider | str | '' | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].provider | ticketing.py | Jira/GitHub tickets | — | no | ticketing | |
ticketing.token_env | str | 'TICKETING_TOKEN' | — | config.yaml:487 + CONFIG_SCHEMA['ticketing'].token_env | ticketing.py | Jira/GitHub tickets | TICKETING_TOKEN | no | ticketing | |
webhook_notify.backoff_seconds | float | 2.0 | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].backoff_seconds | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.enabled | bool | True | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].enabled | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.events | list[str] | ['finding', 'state'] | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].events | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.max_payload_chars | int | 8192 | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].max_payload_chars | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.max_retries | int | 3 | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].max_retries | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.timeout_seconds | int | 5 | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].timeout_seconds | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
webhook_notify.url | str | '' | — | config.yaml:472 + CONFIG_SCHEMA['webhook_notify'].url | plugins/webhook_notify.py | Slack/Discord webhook | — | no | plugins | |
witness.dos_failure_threshold | int | 8 | — | config.yaml:190 + CONFIG_SCHEMA['witness'].dos_failure_threshold | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
witness.dos_failure_window_seconds | float | 60.0 | — | config.yaml:190 + CONFIG_SCHEMA['witness'].dos_failure_window_seconds | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
witness.enabled | bool | False (schema) → True (lab) | — | config.yaml:190 + CONFIG_SCHEMA['witness'].enabled | run_service/execute.py (per-run side task) + swarm/agents/witness_agent.py | Audit watcher (advisory) | — | no | witness | tests/test_witness_wiring.py, tests/test_witness.py |
witness.escalate_to_event_broker | bool | True | — | config.yaml:190 + CONFIG_SCHEMA['witness'].escalate_to_event_broker | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
witness.log_path | str | 'reports/witness.jsonl' | — | config.yaml:190 + CONFIG_SCHEMA['witness'].log_path | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
witness.max_flags_per_signal_per_minute | int | 10 | — | config.yaml:190 + CONFIG_SCHEMA['witness'].max_flags_per_signal_per_minute | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
witness.poll_interval_seconds | int | 5 | — | config.yaml:190 + CONFIG_SCHEMA['witness'].poll_interval_seconds | swarm/agents/witness_agent.py | Audit watcher | — | no | witness | tests/test_witness.py |
Notes
- Verified: every
Keyis a leaf path present inconfig.yaml(checked viayaml.safe_load). No invented keys. - Schema vs lab:
DefaultshowsCONFIG_SCHEMAdefault; when lab differs, both shown asschema → lab. Lab-only keys (autonomous.dedup_targets,recon.preflight_*,recon.fast.*,api.max_concurrent_runs) have no schema default. - Restart:
yes= daemon/router rebuild;no= nextbuild_*/orchestration. - Allowed:
—= free-form string/int/list; enums where validated (seetools/config_manager.ConfigValidator.validate).
source: repo docs (build sync)Edit this page on GitHub →