How duriantaco/ravage works
Ravage is an evidence-first CLI for authorized web-application security assessment. Its main workflow scopes an engagement, discovers the target surface, runs deterministic probes and optionally a model-guided attack, then validates and reports findings with evidence. Separate capabilities include authentication, source-guided prioritization, and bounded read-only repository review. The graph reflects documented capabilities and sampled source; several internal connections are omitted where implementation was not inspected.
Main entry points: orchestrator.py Run orchestration · entrypoint.py Autonomous attack · __main__.py Ravage CLI · finding_evidence.py Finding evidence
Components 21
Engagement setup
- Ravage CLI
packages/ravage/src/ravage/__main__.py - Engagement brief
packages/schemas/src/pentest_schemas/brief.py - Auth sessions
packages/ravage/src/ravage/auth
Assessment workflow
- Run orchestration
packages/ravage/src/orchestrator.py - Surface discovery
packages/ravage/src/ravage/web_core/recon.py - Deterministic probes
packages/ravage/src/ravage/probe_suite.py - Vulnerability probes
packages/ravage/src/ravage/probes - Source analysis
packages/ravage/src/ravage/source_analysis.py
Agent and runtime
- Autonomous attack
packages/ravage/src/ravage/agent_core/autonomous_graph/entrypoint.py - Tool runtime
packages/ravage/src/ravage/runtime - Traffic capture
packages/ravage/src/ravage/traffic
Evidence and results
- Finding evidence
packages/ravage/src/ravage/finding_evidence.py - Proof validation
packages/ravage/src/ravage/proof_bundle_verifier.py - Assessment report
packages/ravage/src/ravage/report.py - Run artifacts
packages/ravage/src/ravage/run_data
Repository review
- Review command
packages/ravage/src/ravage/repository_review_cli.py - Frozen source context
packages/ravage/src/ravage/repository_context.py - Review protocol
packages/ravage/src/ravage/repository_review.py
Other components
- Authorized tester
- Web application
- Model provider
Connections 29
- Authorized tester → Ravage CLI: runs commands
- Ravage CLI → Engagement brief: creates or reads
- Ravage CLI → Auth sessions: manages identity
- Ravage CLI → Run orchestration: starts assessment
- Engagement brief → Run orchestration: configures scope
- Auth sessions → Run orchestration: provides session
- Run orchestration → Surface discovery: discovers surface
- Surface discovery → Web application: sends requests
- Run orchestration → Deterministic probes: runs probes
- Deterministic probes → Vulnerability probes: dispatches checks
- Vulnerability probes → Web application: tests endpoints
- Run orchestration → Source analysis: optionally analyzes
- Source analysis → Autonomous attack: prioritizes candidates
- Run orchestration → Autonomous attack: optionally starts loop
- Autonomous attack → Model provider: requests decisions
- Autonomous attack → Tool runtime: dispatches actions
- Tool runtime → Web application: executes scoped tests
- Tool runtime → Traffic capture: accounts traffic
- Vulnerability probes → Finding evidence: records observations
- Autonomous attack → Finding evidence: records outcomes
- Finding evidence → Proof validation: checks evidence
- Run orchestration → Assessment report: produces results
- Finding evidence → Assessment report: supplies findings
- Run orchestration → Run artifacts: persists run data
- Authorized tester → Review command: requests review
- Review command → Frozen source context: captures snapshot
- Review command → Review protocol: runs review
- Frozen source context → Review protocol: supplies bounded context
- Review protocol → Model provider: requests analysis