Safety model
Built for authorized security testing.
Layered controls with honest language about what each layer does and what it cannot do. The attack path is unrestricted but target-locked, and recon stays fully gated.
Only test systems you own or have explicit written permission to assess.
BreachPilot is Apache-2.0-licensed and local-first. Safety is enforced in the open. Every control below is auditable in the repository.
The layers
8 controls, no single point of trust
Each layer narrows what the agent may do. Scope, risk, routing, and audit must all agree before a target-touching action runs.
Disposable execution sandbox
Hardened per-run container with default-DROP network containment that authorizes only the effective target allowlist. Sandbox failures fail closed.
Limitation: Not a complete sandbox. The operator-box filesystem is unrestricted by design.
Mission authorization
mission.yaml lists allowed and disallowed assets, forbidden actions, rate limits, testing modes, and risk profile before anything runs.
Limitation: A declaration, not a detector. It only protects what you wrote down accurately.
Scope gate
Exact domains, wildcards, IPs, CIDRs, explicit denies, forbidden action types, third-party detection, and per-target rate limits.
Limitation: Denies with a SCOPE_DENIED audit row. It cannot judge whether your scope itself was authorized.
Risk + budget enforcement
Action risk classification with per-session command budgets and human approval required for high-risk actions.
Limitation: Budgets cap volume, not intent. An approved budget spent in-scope is still spent.
Tool routing controls
Controls which tools may run, where outputs land, and how secrets get redacted before they reach logs or reports.
Limitation: Redaction covers known secret shapes. Treat all output as sensitive until reviewed.
Exploit permission modes
read_only proposes recon only · approve_only pauses for operator approval with denials audited · full_access is lab attack posture.
Limitation: Modes relax approvals, never the target allowlist or scope gate.
OPSEC advisory layer
Target-aware pacing and noise suggestions to help you stay quiet during authorized engagements.
Limitation: Advisory only, never a gate. The command always executes.
Audit + evidence
Evidence store, state-transition audit log, exploit-session timelines, and encrypted credential handling.
Limitation: Tamper-evident, not tamper-proof. Export and protect the chain yourself.
Full-access mode
Attack posture, stated plainly
For authorized lab targets only. Approvals relax here. The destination guard and the scope gate do not.
Full-access mode details
Lab only, never against third parties
In full_access, the policy auto-approves every in-scope action with no command-content inspection. Destructive commands, egress, reverse shells, credential dumping, Metasploit and Python write/run are all allowed against authorized targets. The two safeties that remain:
- The target-IP allowlist lock, enforced at the MCP tool layer. Every destination is extracted from every command (URL authorities, /dev/tcp hosts, LHOST/RHOST, scanner targets, bare IPs, hostnames, Python script bodies, MSF RHOSTS and pivot hosts). Anything off-allowlist is
BLOCKED. It is a destination guard, not a complete sandbox. - The mission scope gate. Tools mapped to forbidden-action categories, or assets outside allow rules / inside disallowed assets, are denied with a
SCOPE_DENIEDaudit row.
The operator-box filesystem is unrestricted by design, so run on a throwaway lab box. Every target-touching action, denial, and scope event lands in the tamper-evident SHA-256 audit chain.
mission:
name: "authorized-lab-assessment"
targets:
allowed: ["lab-target.example", "192.0.2.0/28"]
disallowed: ["*.customer-prod.example"]
forbidden_actions: ["data-destruction-outside-lab", "third-party-pivot"]
risk_profile: "lab"
permission_mode: "approve_only # graduate to full_access only on throwaway hosts"How to read this example
- Allowed targets use documentation ranges. Replace with your own authorized scope.
- Disallowed entries and forbidden actions deny first, even when an allow rule would match.
- approve_only keeps a human on every sensitive action; the denial itself becomes evidence.
Scope · risk · policy
The operator is a safety layer
BreachPilot assumes a supervised run: written authorization, reviewed scope, a present human, and protected evidence. Skip any of these and the model breaks down.
Operator responsibilities
Written permission first
A signed scope, a testing window, and named contacts. Verbal approval does not count. Without a scope document, there is no run.
Your lab first
Prove every new workflow against systems you own (a throwaway lab box on an isolated network) before any client engagement.
Least privilege always
Start in read_only, move up to approve_only, and save full_access for disposable lab targets. Never lead with the strongest mode.
Watch the run
Operator supervision is part of the safety model. Budgets and approvals assume a human is present, reading output, ready to stop.
Protect the evidence
Findings contain live credentials and exploitable detail. Encrypt, limit distribution, and retain only as long as the engagement requires.
Stop and disclose on drift
Out-of-scope host, third-party asset, production impact, or unexpected egress: halt, preserve the audit chain, and notify the asset owner.
Honest limits
What safety does not cover
No tool can authorize your test for you. The operator carries these residual risks on every run.
Residual risks
In-scope destruction is allowed
In full_access there is no command-content inspection. Against an authorized target, wiping data or dropping shells is working as configured.
Scope text is trusted
A typo in an allow rule or CIDR can widen the blast radius. Review mission.yaml in diff form before every run.
The lab box is expendable
Assume the operator filesystem can be changed by any run. Never point BreachPilot at a workstation you care about.
Authorized testing only. Only test systems you own or have explicit written permission to assess. If you discover an out-of-scope vulnerability, stop, preserve the audit chain, and disclose to the asset owner. Do not verify further without fresh authorization. Misuse reports: https://github.com/braydos-h/BreachPilot/issues.
Further reading
What to read next
Further reading
Sandbox
Disposable worker architecture, network containment, fail-closed posture, residual risks.
Full source: docs/safety-model.md