Metadata-Version: 2.4
Name: xorcise
Version: 0.1.0rc1
Summary: XORCISE — evaluate cyber AI agents.
Project-URL: Homepage, https://xorcise.ai
Project-URL: Documentation, https://docs.xorcise.ai
Project-URL: Repository, https://github.com/xorcise-ai/xorcise
Project-URL: Issues, https://github.com/xorcise-ai/xorcise/issues
Project-URL: Changelog, https://github.com/xorcise-ai/xorcise/blob/main/CHANGELOG.md
Author-email: Guru Hariharaun <guru@xorcise.ai>
Maintainer-email: Guru Hariharaun <guru@xorcise.ai>, Christo Joby Antony <christo@xorcise.ai>
License-Expression: Apache-2.0
License-File: LICENSE
Requires-Python: >=3.12
Requires-Dist: alembic>=1.13
Requires-Dist: docker>=7.0
Requires-Dist: fastapi>=0.115
Requires-Dist: httpx>=0.27
Requires-Dist: opentelemetry-proto==1.42.1
Requires-Dist: packaging>=23
Requires-Dist: pydantic-settings>=2.3
Requires-Dist: pydantic>=2.7
Requires-Dist: pyyaml>=6.0
Requires-Dist: rich>=13
Requires-Dist: sqlalchemy>=2.0
Requires-Dist: tiktoken>=0.7
Requires-Dist: typer>=0.12
Requires-Dist: uvicorn[standard]>=0.30
Provides-Extra: all
Provides-Extra: collector
Provides-Extra: control
Provides-Extra: dev
Requires-Dist: anyio>=4.4; extra == 'dev'
Requires-Dist: import-linter>=2.0; extra == 'dev'
Requires-Dist: mypy>=1.11; extra == 'dev'
Requires-Dist: pre-commit>=3.7; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest-xdist>=3.6; extra == 'dev'
Requires-Dist: pytest>=8.2; extra == 'dev'
Requires-Dist: pyyaml>=6.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Requires-Dist: twine>=6.1; extra == 'dev'
Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
Requires-Dist: zizmor>=1.28; extra == 'dev'
Provides-Extra: headscale
Provides-Extra: runner
Description-Content-Type: text/markdown

<p align="center">
  <img src="assets/readme-banner.svg" width="820" alt="XORCISE.AI — Trust Evidence, not Claims.">
</p>

<p align="center">
  <img alt="Python 3.12+" src="https://img.shields.io/badge/python-3.12%2B-e8b84b?style=flat-square&labelColor=0f0c07">
  <img alt="Tested on Ubuntu" src="https://img.shields.io/badge/ubuntu-tested-e8b84b?style=flat-square&labelColor=0f0c07&logo=ubuntu&logoColor=e8b84b">
  <a href="LICENSE"><img alt="License Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-e8b84b?style=flat-square&labelColor=0f0c07"></a>
</p>

<p align="center">
  <a href="#quickstart">Quickstart</a> ·
  <a href="#what-comes-out">Output</a> ·
  <a href="#bring-your-agent">Agents</a> ·
  <a href="#missions">Missions</a> ·
  <a href="#open-source">Open source</a> ·
  <a href="https://xorcise.ai">Website</a> ·
  <a href="https://docs.xorcise.ai">Docs</a> ·
  <a href="CONTRIBUTING.md">Contributing</a> ·
  <a href="SECURITY.md">Security</a>
</p>

---

**Run your cyber-AI agent against a real mission. Watch everything it does. Grade the evidence.**

> AI can take action. It cannot bear consequences.

A benchmark score tells you an agent finished. It says nothing about the destructive commands
it tried on the way there. XORCISE runs the agent against a live target inside a contained
environment, records every command, tool call and dead end as OpenTelemetry evidence, and
grades that evidence against the mission's own criteria.

Trust is not declared. It is demonstrated.

## Quickstart

Tested on Ubuntu. Needs **Python 3.12+** and **Docker Engine**.

```bash
pip install xorcise
xorcise up                                # boots the stack, prints the console URL
```

```bash
xorcise agent register --name my-agent
xorcise mission list
xorcise run create --agent my-agent --mission demo
xorcise run prompt <run_id>               # the ready-to-paste connect prompt
xorcise run status <run_id>               # score, breakdown, evidence
```

`xorcise doctor` checks the host first. `xorcise down` stops it all. No Docker on the box?
`xorcise up --stub` is the self-contained demo. `xorcise --help` has the rest, and
[docs.xorcise.ai](https://docs.xorcise.ai) walks through a first run end to end.

> `0.1.0` is not on PyPI yet — until it is, install from source: see
> [Contributing → Setup](CONTRIBUTING.md#setup).

## What comes out

| | |
|---|---|
| **Live trace** | every command, tool call and message, streaming into the console as it happens |
| **Score** | deterministic checks plus a bring-your-own-model judge |
| **Report** | the full run record, exportable — Markdown, HTML, JSONL |
| **Leaderboard** | agents ranked across recorded results |

Every run gets its own private network and a fresh environment, created for the run and
destroyed after it. An agent under evaluation cannot reach the host, or another run.

## Bring your agent

XORCISE evaluates the agent you already use.

| | |
|---|---|
| **OpenHands** | full trace + tool-call capture |
| **Claude Code** | via OTLP telemetry |
| **Codex CLI** | via OTLP telemetry |
| **Anything custom** | register it, drive it with the connect prompt, submit over REST |

Activity is normalised into one event model, so the trace, the grading and the report read
the same whichever harness produced the run.

## Missions

A **mission** is a self-contained target: services, a network, and the criteria an agent is
graded against. Packaged as bundles, pulled on demand.

Missions are **deliberately vulnerable** — SQL injection, IDOR, network pivots. That is the
point: they exist so an agent has something real to find.

> Run XORCISE on infrastructure you are willing to lose — a dedicated VM or an isolated cloud
> environment, never a workstation holding credentials you care about. It executes untrusted
> agent code against vulnerable targets by design.

## Open source

XORCISE goes public in parts, not whole. This repository is the engine — the CLI, harness
adapters, isolation, grading and console — under Apache-2.0, with issues and pull requests
open.

The evaluation technology is open source. The commercial layer — managed deployment, runtime,
command and sovereign hosting — is not. The agent skills and the documentation source are
published separately as they are readied.

## Documentation & help

| | |
|---|---|
| [xorcise.ai](https://xorcise.ai) | the project website — what XORCISE is and who it is for |
| [Documentation](https://docs.xorcise.ai) | first run, missions, grading, traces, the full CLI and API reference |
| [Contributing](CONTRIBUTING.md) | dev setup, the test lanes, the PR process, versioning |
| [Security](SECURITY.md) | what's in scope, and how to report privately |
| [Maintainers](MAINTAINERS.md) · [Code of Conduct](CODE_OF_CONDUCT.md) | who to ask, and how we work |

Found a vulnerability? **Do not open a public issue** — [report it privately](SECURITY.md).
Flaws in the harness, the isolation boundary or the supply chain are in scope; flaws inside a
mission are the content.

## License

[Apache-2.0](LICENSE) © The XORCISE Authors

---

<p align="center">XORCISE<b>.</b>AI — Trust Evidence, not Claims.</p>
