How ekene95/okwute works
Okwute is a Claude Code AppSec co-pilot that runs a persistent penetration-testing loop: map a target, generate tests, execute them, validate findings, then stop for engineer review. The README documents the pipeline and optional browser, source-code, and mobile investigations, plus reporting and specialist skills. The graph follows those documented relationships; no source excerpts were available, so internal calls beyond the documented workflow are omitted.
Main entry points: targets Target State · appsec-loop.md AppSec Loop · run-generator.md Generator · run-executor.md Executor
Components 27
Testing Pipeline
- AppSec Loop
.claude/commands/appsec-loop.md - Mapper
.claude/commands/run-mapper.md - Generator
.claude/commands/run-generator.md - Executor
.claude/commands/run-executor.md - Validator
.claude/commands/run-validator.md
Engagement State
- Target State
.claude/targets - Pipeline Schema
schema.sql - Shared Memory
.claude/scripts/memory_db.py - Pattern Corpus
.claude/scripts/rag_db.py - Seed Patterns
.claude/rag/seed - AppSec DB Tools
.claude/scripts/appsec_db.py - Report Import
.claude/scripts/security_report_import.py - Postman Import
.claude/scripts/postman_import.py
Investigation Paths
- Browser Investigation
.claude/commands/investigate-browser.md - Code Investigation
.claude/commands/investigate-code.md
Specialist Expertise
- Mobile Expertise
.claude/skills/mobile-expert/SKILL.md - Web API Expertise
.claude/skills/web-api-expert/SKILL.md - Code Review
.claude/skills/code-review/SKILL.md - Threat Modeling
.claude/skills/threat-model/SKILL.md - Security Reporting
.claude/skills/security-reporter/SKILL.md
Other components
- Engineer
- Target Application
- Burp MCP
- Chrome DevTools MCP
- HTTP Toolkit MCP
- MobSF MCP
- Blutter MCP
Connections 35
- Engineer → AppSec Loop: starts loop
- AppSec Loop → Mapper: runs stage
- AppSec Loop → Generator: runs stage
- AppSec Loop → Executor: runs stage
- AppSec Loop → Validator: runs stage
- Mapper → Target Application: discovers endpoints
- Mapper → Target State: writes endpoints
- Generator → Target State: reads endpoints
- Generator → Target State: writes test cases
- Generator → Pattern Corpus: uses patterns
- Generator → Shared Memory: uses intelligence
- Executor → Target State: reads test cases
- Executor → Burp MCP: fires requests
- Executor → HTTP Toolkit MCP: uses fallback
- Executor → Target State: writes results
- Validator → Target State: reads results
- Validator → Target State: writes findings
- AppSec Loop → Engineer: stops for review
- Engineer → AppSec DB Tools: requests report
- AppSec DB Tools → Target State: reads findings
- Engineer → Postman Import: imports collection
- Postman Import → Target State: adds endpoints
- Engineer → Report Import: imports report
- Report Import → Target State: imports data
- Engineer → Browser Investigation: starts investigation
- Browser Investigation → Chrome DevTools MCP: investigates flows
- Engineer → Code Investigation: starts investigation
- Engineer → Mobile Expertise: loads skill
- Mobile Expertise → MobSF MCP: uses analysis
- Mobile Expertise → Blutter MCP: uses analysis
- Engineer → Web API Expertise: loads skill
- Engineer → Code Review: loads skill
- Engineer → Threat Modeling: loads skill
- Engineer → Security Reporting: loads skill
- Seed Patterns → Pattern Corpus: seeds patterns