Skip to content
BreachPilot

Capabilities

Full assessment lifecycle, under supervision

Specialist agents plan against allowlisted targets, chain capabilities through a structured attack graph, and prove each claim with oracle-checked evidence and export-ready reports. This is a capability overview. For authorized testing only.

6 swarm specialists15 attack families153 MCP tools139 advisory skills
  1. Swarmspecialists
  2. Attack graphstructured plan
  3. Evidenceevidence-backed
  4. Reportingexport-ready
Install for your lab Read the safety model

Authorized testing only. Only test systems you own or have explicit written permission to assess.

Swarm

Specialists that negotiate over shared state

Parallel specialists read and write one shared blackboard rather than chaining messages. A critic gate kills out-of-scope actions before anything runs. For authorized targets only.

  • recon · Discover

    Recon

    Attack-surface discovery and fingerprinting

  • vuln · Correlate

    Vuln

    Vulnerability / CVE and module correlation

  • exploit · Execute

    Exploit

    Capability selection, payload work and execution

  • post_exploit · Consolidate

    Post Exploit

    Credential, loot and lateral-target handling

  • Safety gate

    critic · Gate · Review

    Critic

    Scope, risk and policy review

  • reflection · Learn

    Reflection

    Strategy review and lessons

Explore the swarm Swarm engineering docs

Attack graph

A structured plan with visible state

Every run builds a structured plan with hypotheses, prerequisites and blocked steps, rendered live in the WebUI graph. Planning stays supervised throughout.

  • Prerequisite chaining

    Capabilities declare what they need and what they produce. The planner composes valid chains, skips dead ends, and keeps every hop target-locked.

  • Hypothesis lifecycle

    Suspicious observations become testable hypotheses with explicit pass criteria. An independent oracle probe decides each one.

  • Blocked steps stay visible

    Ready, blocked and exhausted steps stay visible in the WebUI graph, with the reason attached. A stuck plan says why it stopped.

attack plan · dag done active todo
  1. Target: 127.0.0.1 · allowlisted (done)
  2. Recon: ports · services · OS (done)
  3. HTTP :443: fingerprint · WAF check (done)
  4. Web Analysis: surface scoring (done)
  5. Hypothesis: H-03 · testable claim (active)
  6. Verification: oracle probe · evidence (todo)
  7. Finding: CONFIRMED / REFUTED (finding)
  8. Report: timeline · CVSS · chains (todo)
  1. Target127.0.0.1 · allowlisted
  2. Reconports · services · OS
  3. HTTP :443fingerprint · WAF check
  4. Web Analysissurface scoring
  5. HypothesisH-03 · testable claim
  6. Verificationoracle probe · evidence
  7. FindingCONFIRMED / REFUTED
  8. Reporttimeline · CVSS · chains

prerequisites · hypotheses · blocked steps · evidence-linked outcomes

How planning fits the architecture →

Evidence

Verified, not claimed

Claims without proof are noise. Execution success and evidential success are tracked separately, and only oracle-observed effects become findings.

  • Oracle-checked verdicts

    Running a capability and proving a weakness are separate events. Only an independent probe that observes the claimed effect produces a confirmed finding.

    CONFIRMED / REFUTED / EXHAUSTED · oracle probes

  • Tamper-evident audit chain

    Every proposal, approval, execution and verdict lands in a hash-chained audit log. Rerun the chain to replay the run. Reviewers see the same steps the operator saw.

    SHA-256 audit chain · decision_log.jsonl

  • Loot vault, still in scope

    Recovered credentials and collected material rest in an encrypted vault (for example, C:\BreachPilot\vault\…). They never land in chat logs or terminal scrollback.

    encrypted vault · allowlist-scoped handling

See how outcomes are verified →

Reporting

Evidence-backed, export-ready

Reports assemble from the same evidence the operator watched accumulate: timelines, chains and verdicts.

  • Findings reviewers trust

    Each finding ships with timeline, severity, attack chain and linked probe output. A defender gets the evidence needed to reproduce the result.

    Markdown + HTML · CVSS · chain view

  • ATT&CK-mapped output

    Confirmed techniques map to tactics and export for Navigator. The report plugs straight into detection-gap reviews.

    ATT&CK Navigator export

  • Handoff to remediation

    Findings convert to tickets with severity, reproduction context and evidence links attached, so remediation starts from proof.

    ticket creation · evidence-linked

Use cases

Built for authorized work

Where teams point it: systems they own or have explicit written permission to test.

  • Internal assessment teams

    Scope a release or network segment, let the swarm work the allowlist in parallel, and hand stakeholders a report where every claim links to probe output.

    Scope: systems your team owns or is contracted to test.

  • Labs and detection validation

    Emulate adversary behavior against lab infrastructure, then check which techniques your detections caught. The audit chain works as exercise notes.

    Scope: isolated lab ranges and cyber-range targets.

  • Continuous authorized validation

    Re-run authorized assessments on a schedule and diff the findings. Reflection memory and the experience store give each cycle a head start on the last.

    Scope: standing written authorization, same allowlist discipline.

Extends your workflow: 14 plugins (shodan_recon · github_dorks · webhook_notify, and more) plus 3 model-provider routes over 153 tools. Plugins · Providers

Built for authorized security testing

Only test systems you own or have explicit written permission to assess.

Attack mode auto-approves in-scope actions. The target-IP allowlist lock and the mission scope gate stay enforced, with every action in a tamper-evident audit chain.

Read the safety modelInstall for your lab

Source on GitHub →