Metadata-Version: 2.4
Name: ravage
Version: 0.5.0
Summary: Autonomous web security research agent for controlled authorized targets
Project-URL: Repository, https://github.com/duriantaco/ravage
Project-URL: Issues, https://github.com/duriantaco/ravage/issues
Author: Ravage contributors
License: Apache-2.0
License-File: LICENSE
Keywords: authorized-testing,pentesting,research,security,web-security
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: <3.13,>=3.12
Requires-Dist: cryptography>=42.0
Requires-Dist: pyyaml>=6.0
Requires-Dist: ravage-schemas
Provides-Extra: browser
Requires-Dist: playwright>=1.40; extra == 'browser'
Description-Content-Type: text/markdown

# Ravage

Ravage is an evidence-first web security research agent for controlled,
authorized targets. This package provides the `ravage` CLI and runtime modules.

The project is a pre-1.0 research alpha. Use it only on local fixtures, isolated
labs, or systems you own and are explicitly authorized to assess. The active
public CLI is localhost-first.

## Source Checkout

The canonical development setup is the repository bootstrap:

```bash
scripts/bootstrap.sh
source .venv/bin/activate
ravage --version
```

The `0.0.1` PyPI package is a legacy preview. Until a newer tagged release is
published, use a source checkout and record its exact commit when reporting
results.

## Active Commands

Run deterministic probes without model calls:

```bash
ravage scan brief.yaml --run-dir runs/local-scan --report
```

Run the model-driven agent after configuring a model route and adding a useful
`context.description` to the brief:

```bash
ravage attack brief.yaml \
  --model-profile hosted-openai \
  --model-tier low \
  --allow-paid-models \
  --report
```

Inspect and verify a run:

```bash
ravage observe runs/<run-dir>
ravage audit verify runs/<run-dir>
ravage report runs/<run-dir> --brief brief.yaml
```

Use `ravage --help` and each subcommand's `--help` for the installed version.

External scanners such as `nmap`, `sqlmap`, `katana`, `nuclei`, and `ffuf` are
not Python dependencies. From a source checkout, use
`scripts/install_tools.sh --method docker --execute`, then run
`ravage tools check`.

The optional `browser` extra adds Playwright support; install its Chromium
runtime separately with `playwright install chromium`.

## Documentation

See the [repository README](https://github.com/duriantaco/ravage#readme),
[setup guide](https://github.com/duriantaco/ravage/blob/main/docs/setup.md), and
[operator guide](https://github.com/duriantaco/ravage/blob/main/docs/ai-web-operator-guide.md).

Ravage is open source under the Apache License 2.0. See the repository
`SECURITY.md`, `CONTRIBUTING.md`, `DISCLAIMER.md`, and `LICENSE` before use or
contribution.
