# fulcanellir/nigredo architecture

> Architecture diagram of the GitHub repository fulcanellir/nigredo, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/fulcanellir/nigredo
- Repository: https://github.com/fulcanellir/nigredo

## Overview

nigredo is an authorized penetration-testing orchestrator with separate passive recon and active-scan engines. Its main workflow takes client domains and authorized targets as distinct inputs, gathers recon and scan results, then consolidates them into a workbook. The README documents these capabilities and the high-level flow, but no source excerpts were provided; edges therefore represent documented relationships, not inspected call sites.

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_engagement["Engagement control"]
  node_domains["Recon domains"]
  node_targets["Authorized targets"]
  node_scope["Scope allowlist"]
  node_engagement_run["Engagement runner"]
end

subgraph group_recon["Recon engine"]
  node_recon_engine["Recon orchestrator"]
  node_surface["Surface enumeration"]
  node_osint["OSINT and credentials"]
  node_web_crawl["Web crawler"]
end

subgraph group_scan["Active scanning"]
  node_scan_engine["Scan pipeline"]
  node_port_scan["Port and service scans"]
  node_web_probe["Web probing"]
  node_content_discovery["Content discovery"]
  node_vuln_checks["Vulnerability checks"]
  node_tls_ssh["TLS and SSH audits"]
end

subgraph group_delivery["Enrichment and reporting"]
  node_nessus["Nessus ingestion"]
  node_enrichment["Finding enrichment"]
  node_report["Workbook report"]
end

node_operator(("Operator"))
node_external_tools["External security tools"]
node_api_services["OSINT API services"]

node_operator -->|"starts run"| node_engagement_run
node_operator -->|"provides domains"| node_domains
node_operator -->|"provides targets"| node_targets
node_operator -->|"sets allowlist"| node_scope
node_engagement_run -->|"runs recon"| node_recon_engine
node_engagement_run -->|"runs scan"| node_scan_engine
node_domains -->|"feeds domains"| node_recon_engine
node_targets -->|"feeds targets"| node_scan_engine
node_scope -->|"gates targets"| node_scan_engine
node_recon_engine -->|"enumerates"| node_surface
node_recon_engine -->|"harvests OSINT"| node_osint
node_recon_engine -->|"crawls apps"| node_web_crawl
node_recon_engine -->|"invokes tools"| node_external_tools
node_osint -->|"queries services"| node_api_services
node_scan_engine -->|"scans ports"| node_port_scan
node_scan_engine -->|"probes hosts"| node_web_probe
node_scan_engine -->|"discovers content"| node_content_discovery
node_scan_engine -->|"checks vulnerabilities"| node_vuln_checks
node_scan_engine -->|"audits protocols"| node_tls_ssh
node_scan_engine -->|"invokes tools"| node_external_tools
node_nessus -->|"reconciles findings"| node_enrichment
node_enrichment -->|"feeds findings"| node_report
node_recon_engine -->|"contributes results"| node_report
node_scan_engine -->|"contributes results"| node_report

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_domains,node_targets,node_scope,node_engagement_run toneBlue
class node_recon_engine,node_surface,node_osint,node_web_crawl toneAmber
class node_scan_engine,node_port_scan,node_web_probe,node_content_discovery,node_vuln_checks,node_tls_ssh,node_api_services toneMint
class node_nessus,node_enrichment,node_report toneRose
class node_operator,node_external_tools toneIndigo
```

## Components

### Engagement control

- **Recon domains**
- **Authorized targets**
- **Scope allowlist**
- **Engagement runner**

### Recon engine

- **Recon orchestrator**
- **Surface enumeration**
- **OSINT and credentials**
- **Web crawler**

### Active scanning

- **Scan pipeline**
- **Port and service scans**
- **Web probing**
- **Content discovery**
- **Vulnerability checks**
- **TLS and SSH audits**

### Enrichment and reporting

- **Nessus ingestion**
- **Finding enrichment**
- **Workbook report**

### Other components

- **Operator**
- **External security tools**
- **OSINT API services**

## Connections

- Operator → Engagement runner: starts run (evidence: `README.md`)
- Operator → Recon domains: provides domains (evidence: `README.md`)
- Operator → Authorized targets: provides targets (evidence: `README.md`)
- Operator → Scope allowlist: sets allowlist (evidence: `README.md`)
- Engagement runner → Recon orchestrator: runs recon (evidence: `README.md`)
- Engagement runner → Scan pipeline: runs scan (evidence: `README.md`)
- Recon domains → Recon orchestrator: feeds domains (evidence: `README.md`)
- Authorized targets → Scan pipeline: feeds targets (evidence: `README.md`)
- Scope allowlist → Scan pipeline: gates targets (evidence: `README.md`)
- Recon orchestrator → Surface enumeration: enumerates (evidence: `README.md`)
- Recon orchestrator → OSINT and credentials: harvests OSINT (evidence: `README.md`)
- Recon orchestrator → Web crawler: crawls apps (evidence: `README.md`)
- Recon orchestrator → External security tools: invokes tools (evidence: `README.md`)
- OSINT and credentials → OSINT API services: queries services (evidence: `README.md`)
- Scan pipeline → Port and service scans: scans ports (evidence: `README.md`)
- Scan pipeline → Web probing: probes hosts (evidence: `README.md`)
- Scan pipeline → Content discovery: discovers content (evidence: `README.md`)
- Scan pipeline → Vulnerability checks: checks vulnerabilities (evidence: `README.md`)
- Scan pipeline → TLS and SSH audits: audits protocols (evidence: `README.md`)
- Scan pipeline → External security tools: invokes tools (evidence: `README.md`)
- Nessus ingestion → Finding enrichment: reconciles findings (evidence: `README.md`)
- Finding enrichment → Workbook report: feeds findings (evidence: `README.md`)
- Recon orchestrator → Workbook report: contributes results (evidence: `README.md`)
- Scan pipeline → Workbook report: contributes results (evidence: `README.md`)