Metadata-Version: 2.4
Name: vigil-redteam
Version: 0.1.0
Summary: AI-powered red teaming harness
Author: zimkk
License: MIT
Project-URL: Homepage, https://github.com/zimkk/vigil
Project-URL: Repository, https://github.com/zimkk/vigil
Project-URL: Issues, https://github.com/zimkk/vigil/issues
Keywords: redteam,security,penetration-testing,ai-security,vulnerability-scanner
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: anthropic>=0.40.0
Requires-Dist: openai>=1.0.0
Requires-Dist: pydantic>=2.6.0
Requires-Dist: typer>=0.12.0
Requires-Dist: rich>=13.7.0
Requires-Dist: pyyaml>=6.0.1
Requires-Dist: dnspython>=2.6.0
Requires-Dist: python-whois>=0.9.0
Requires-Dist: playwright>=1.40.0
Requires-Dist: beautifulsoup4>=4.12.0
Requires-Dist: pypdf>=4.0.0
Requires-Dist: httpx>=0.27.0
Requires-Dist: questionary>=2.0.0
Requires-Dist: textual>=0.80.0
Provides-Extra: desktop
Requires-Dist: PySide6>=6.8; extra == "desktop"
Dynamic: license-file

<p align="center">
  <img src="vigil-brand/svg/vigil-lockup-stacked.svg" alt="Vigil" height="120" />
</p>

<p align="center">
  <img src="vigil-brand/svg/vigil-lockup-stacked.svg" alt="Vigil" height="120" />
</p>

<p align="center">
  <strong>AI-powered red team framework</strong>
</p>

<p align="center">
  <a href="https://github.com/zimkk/vigil/releases"><img src="https://img.shields.io/github/v/release/zimkk/vigil?color=C24A22&label=version" alt="version"></a>
  <a href="https://pypi.org/project/vigil-redteam/"><img src="https://img.shields.io/pypi/pyversions/vigil-redteam?color=1C1C1A" alt="python"></a>
  <a href="LICENSE"><img src="https://img.shields.io/github/license/zimkk/vigil?color=C24A22" alt="license"></a>
</p>

---

## Install

```bash
curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install.sh | bash
```

Or with pip / pipx:

```bash
pipx install vigil-redteam
# or
pip install vigil-redteam
```

Requires Python 3.11+.

### Desktop app

With desktop support installed, running `vigil` opens the native Windows,
Linux, and macOS desktop client. The CLI and Textual TUI remain available for
automation and terminal-first workflows. Install the optional desktop client
with PySide6:

```bash
pipx install "vigil-redteam[desktop]"
vigil gui
```

Use `vigil tui` to explicitly open the terminal UI. Standard help never opens
a graphical window:

```bash
vigil --help
vigil gui --help
vigil review --help
```

The desktop app calls the same Python application services as the CLI. It does
not create shell commands from UI actions; active operations retain explicit
authorization and code-review LLM consent checks.

---

## What it does

Vigil drives an agentic red team engagement from a single CLI. Each command maps to a phase of the [PTES](http://www.pentest-standard.org/) methodology and spins up one or more AI agents that plan, call real security tools, interpret output, and write findings to a local SQLite database.

| Phase | Command | Description |
|---|---|---|
| OSINT / Passive recon | `vigil enumerate` | Subdomain enum, DNS, WHOIS, cert transparency — no active probing |
| Developer / Blue Team | `vigil review ./src` | Local static code review for injection, session, TLS, secret, and other security gaps |
| Active recon | `vigil active` | Port scan, service fingerprint, web crawl |
| Vulnerability assessment | `vigil assess` | Nuclei, nikto, SSL/TLS checks, tech-stack CVEs |
| Validation | `vigil validate` | Confirm findings, eliminate false positives |
| Exploitation | `vigil exploit` | Controlled PoC against validated findings |
| Post-exploitation | `vigil post-exploit` | Enumerate from foothold |
| Privilege escalation | `vigil privesc` | Local privesc vector detection |
| Credential access | `vigil cred-access` | Credential hunting |
| Discovery | `vigil discover` | Users, files, services, internal hosts |
| Lateral movement | `vigil lateral` | Pivot via harvested credentials |
| Persistence | `vigil persist` | Persistence mechanism identification |
| Defense evasion | `vigil evade` | Security control detection and evasion planning |
| C2 assessment | `vigil c2` | C2 channel feasibility and evasion-aware planning |
| Collection | `vigil collect` | Sensitive data staging for exfil simulation |
| Exfiltration | `vigil exfil` | Channel testing and impact estimation |
| Impact | `vigil impact` | Business risk quantification |
| Cleanup | `vigil cleanup` | Remove Vigil-created artifacts from target |
| Report | `vigil report` | Final engagement report across all phases |

---

## Usage

```bash
# Passive recon (no authorization required)
vigil enumerate example.com

# Full active assessment (requires written authorization)
vigil active example.com
vigil assess example.com
vigil validate
vigil report --output report.md
```

Run a local developer / blue-team review without sending traffic or source code externally:

```bash
vigil review ./src --output blue-team-review.md
# Use a .json extension to write machine-readable findings.
vigil review ./src --output blue-team-review.json
```

For contextual, advisory triage, add the configured LLM backend. Local
OpenAI-compatible endpoints (for example Ollama) are supported directly. An
API backend requires an explicit acknowledgement before Vigil sends redacted,
size-limited source excerpts:

```bash
vigil review ./src --llm
vigil review ./src --llm --allow-remote-code --llm-max-chars 60000
```

The review flags likely SQL and command injection, disabled TLS verification (MITM risk),
cookie and session hijacking gaps, hardcoded secrets, weak cryptography, unsafe
deserialization, SSRF, path traversal, open redirects, and unsafe CORS. Findings are
static-analysis signals and should be validated in application context.

Run any phase in `--mode sequential` (single agent) or the default `--mode parallel` (multi-agent wave).

```bash
vigil enumerate --mode sequential example.com
```

List the tools registered for any phase:

```bash
vigil tools enumerate
```

---

## LLM backend

Vigil works with Anthropic Claude (default) or any OpenAI-compatible endpoint — Ollama, vLLM, LM Studio, OpenRouter.

Create a `.env` file in your working directory:

```bash
# Anthropic (default)
VIGIL_BACKEND=anthropic
VIGIL_API_KEY=sk-ant-...
VIGIL_MODEL=claude-sonnet-4-6

# Ollama (local)
VIGIL_BACKEND=openai_compat
VIGIL_BASE_URL=http://localhost:11434/v1
VIGIL_API_KEY=ollama
VIGIL_MODEL=qwen2.5:7b
```

---

## External tools

Vigil calls real security binaries. Install them all at once:

```bash
curl -sSfL https://raw.githubusercontent.com/zimkk/vigil/main/install-tools.sh | bash
```

Key tools installed: `nmap`, `masscan`, `nuclei`, `subfinder`, `httpx`, `ffuf`, `gobuster`, `sqlmap`, `nikto`, `dalfox`, `gitleaks`, `trufflehog`, `rustscan`, `feroxbuster`, `wpscan`, and more (426 total across Go, Cargo, pip, npm, and gem).

---

## Legal

Vigil is built for authorized security testing. Running it against systems you do not own or have explicit written permission to test is illegal. The authors accept no liability for unauthorized use.

---

<p align="center">
  <img src="vigil-brand/svg/vigil-mark.svg" alt="" height="32" />
</p>
