Skip to content
BreachPilot

Extensibility

Extend without forking core

Plugins are opt-in, trusted Python managed by tools/plugins.py: a plugin.yaml manifest plus a single register(registry) hook contributing attack modules, MCP tools, skill directories and config sections. Target-touching plugin tools carry the same allowlist lock and audit trail as core tools.

Build a plugin →Safety model

For authorized testing only — only run plugins against systems you own or have explicit written permission to assess.

14 opt-in extensions

Plugin catalog

Every plugin is disabled by default. Target-touching plugin tools carry the same allowlist lock and audit trail as core tools.

  • shodan_recon

    needs credentials

    Passive Shodan OSINT — port, banner and CVE enrichment without touching the target. Advisory-only.

    requires API credentials / server config

  • github_dorks

    needs credentials

    Authorized-target code-leak discovery via GitHub Code Search. Finds leaked credentials in the target org's public repos, pre-recon. Advisory-only.

    requires API credentials / server config

  • webhook_notify

    needs credentials

    Outbound-only Slack / Discord run-status notifications on milestones and findings.

    requires API credentials / server config

  • sliver_c2

    needs credentials

    Sliver C2 bridge — implant generation, team server and session management.

    requires API credentials / server config

  • bloodhound_ce

    needs credentials

    BloodHound CE data exchange — AD attack-path ingest and query.

    requires API credentials / server config

  • zap_scan

    needs credentials

    OWASP ZAP REST integration — spider plus active scan for authenticated web targets.

    requires API credentials / server config

  • browser_attack

    no credentials

    Headless Chromium / Playwright driver for authenticated web testing and XSS-hunter callbacks.

  • mobile_attack

    no credentials

    Mobile testing — Frida, objection, apktool and jadx for local APK analysis and device instrumentation.

  • wireless

    no credentials

    Wireless / Bluetooth assessment — bettercap, aircrack-ng, hcxtools and bluez for authorized WLAN / BT testing.

  • spiderfoot

    needs credentials

    SpiderFoot OSINT integration (passive) — DNS, whois, certificates and leaks in one tool.

    requires API credentials / server config

  • atomic_red_team

    no credentials

    Atomic Red Team test YAML generator — maps weaknesses to MITRE ATT&CK techniques for detection validation. Local-only, no execution.

  • caldera

    needs credentials

    MITRE Caldera adversary-emulation plugin — runs abilities against an authorized Caldera server.

    requires API credentials / server config

  • firmware_analysis

    no credentials

    Firmware analysis — binwalk, firmadyne, FACT-extractor and EMUX for IoT firmware unpacking and emulation.

  • snmp

    no credentials

    SNMP enumeration — system inventory, users, processes and community-string checks.

Safety checklist for plugin authors

Plugin MCP tools must stack the allowlist / audit decorators, respect the target lock, redact secrets and add focused tests. Hard-blocked: log clearing, timestomping, EDR/AV defeat, DoS and malware distribution. See plugin development, extension guide and safety model.