# r-s0n/ars0n-framework-v2 architecture

> Architecture diagram of the GitHub repository r-s0n/ars0n-framework-v2, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/r-s0n/ars0n-framework-v2
- Repository: https://github.com/r-s0n/ars0n-framework-v2

## Overview

Ars0n Framework v2 is a bug-bounty workflow platform that guides authorized target testing, wraps reconnaissance and scanning tools, and retains results for attack-surface analysis. Its main user journey runs from target and scope setup through asset discovery, URL/endpoint work, scanning, and review; learning guidance and browser-assisted capture support that journey. The repository also exposes workflows through an MCP server and includes a target-behavior probe. Edges reflect README statements and shown source references; some subsystem connections remain unverified because their wiring was not sampled.

Main entry points: [`server/main.go`](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/main.go) (Framework API), [`server/database.go`](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/database.go) (Results database), [`client/src/App.js`](https://github.com/r-s0n/ars0n-framework-v2/blob/main/client/src/App.js) (Framework UI), [`docker/mcp-server/src/index.js`](https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/index.js) (MCP assistant tools)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_app["Framework application"]
  node_ui["Framework UI<br/>[App.js]"]
  node_api["Framework API<br/>[main.go]"]
  node_store[("Results database<br/>[database.go]")]
  node_scope["Targets and scope"]
end

subgraph group_testing["Recon and testing"]
  node_recon["Asset discovery"]
  node_company["Company assets<br/>[companyTools.go]"]
  node_urlwork["URL workflows<br/>[urlScanUtils.go]"]
  node_endpoints["Endpoint analysis"]
  node_scans["Vulnerability scans<br/>[nucleiUtils.go]"]
  node_waf["Target behavior probe<br/>[waf_probe.py]"]
  node_triage["Finding triage<br/>[triageRun.go]"]
  node_auth["Auth flows and sessions<br/>[authFlowsUtils.go]"]
end

subgraph group_interfaces["Assistant and capture"]
  node_extension["Browser capture<br/>[background.js]"]
  node_mcp["MCP assistant tools<br/>[index.js]"]
  node_mcpauth["MCP auth tools<br/>[authsessions.js]"]
  node_mcpaz["MCP authorization tools<br/>[authz.js]"]
end

subgraph group_support["Learning and analysis"]
  node_guidance["Methodology lessons<br/>[lessons.js]"]
  node_attack["Attack surface review"]
  node_ai["Document Q&amp;A service<br/>[main.py]"]
end

node_user(("Security researcher"))

node_user -->|"uses"| node_ui
node_ui -.->|"submits workflows"| node_api
node_api -->|"persists results"| node_store
node_api -.->|"manages scope"| node_scope
node_api -.->|"orchestrates discovery"| node_recon
node_api -.->|"runs asset tools"| node_company
node_api -.->|"runs URL tools"| node_urlwork
node_api -.->|"supports endpoint work"| node_endpoints
node_api -.->|"runs scanners"| node_scans
node_api -->|"drives probe"| node_waf
node_api -.->|"supports triage"| node_triage
node_api -.->|"manages authentication"| node_auth
node_recon -->|"stores results"| node_store
node_urlwork -->|"stores results"| node_store
node_scans -->|"stores results"| node_store
node_store -->|"feeds asset review"| node_attack
node_ui -->|"presents lessons"| node_guidance
node_user -->|"asks assistant"| node_mcp
node_mcp -->|"registers tools"| node_mcpauth
node_mcp -->|"registers tools"| node_mcpaz
node_mcpauth -->|"calls API"| node_api
node_mcpaz -->|"calls API"| node_api
node_extension -.->|"checks capture scope"| node_scope
node_user -.->|"captures browser traffic"| node_extension
node_user -->|"asks document questions"| node_ai

click node_ui "https://github.com/r-s0n/ars0n-framework-v2/blob/main/client/src/App.js"
click node_api "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/main.go"
click node_store "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/database.go"
click node_scope "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/scopeTargetUtils.go"
click node_recon "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/autoScanOrchestrator.go"
click node_company "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/companyTools.go"
click node_urlwork "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/urlScanUtils.go"
click node_endpoints "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/endpointInvestigationUtils.go"
click node_scans "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/nucleiUtils.go"
click node_waf "https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/waf-probe/waf_probe.py"
click node_triage "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/triageRun.go"
click node_auth "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/authFlowsUtils.go"
click node_extension "https://github.com/r-s0n/ars0n-framework-v2/blob/main/extension/background.js"
click node_mcp "https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/index.js"
click node_mcpauth "https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/tools/authsessions.js"
click node_mcpaz "https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/tools/authz.js"
click node_guidance "https://github.com/r-s0n/ars0n-framework-v2/blob/main/client/src/data/lessons.js"
click node_attack "https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/attackSurfaceAssetManagement.go"
click node_ai "https://github.com/r-s0n/ars0n-framework-v2/blob/main/ai_service/main.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_ui,node_api,node_store,node_scope toneBlue
class node_recon,node_company,node_urlwork,node_endpoints,node_scans,node_waf,node_triage,node_auth toneAmber
class node_extension,node_mcp,node_mcpauth,node_mcpaz toneMint
class node_guidance,node_attack,node_ai toneRose
class node_user toneIndigo
```

## Components

### Framework application

- [Framework UI](https://github.com/r-s0n/ars0n-framework-v2/blob/main/client/src/App.js): `client/src/App.js`
- [Framework API](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/main.go): `server/main.go`
- [Results database](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/database.go): `server/database.go`
- [Targets and scope](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/scopeTargetUtils.go): `server/utils/scopeTargetUtils.go`

### Recon and testing

- [Asset discovery](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/autoScanOrchestrator.go): `server/utils/autoScanOrchestrator.go`
- [Company assets](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/companyTools.go): `server/utils/companyTools.go`
- [URL workflows](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/urlScanUtils.go): `server/utils/urlScanUtils.go`
- [Endpoint analysis](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/endpointInvestigationUtils.go): `server/utils/endpointInvestigationUtils.go`
- [Vulnerability scans](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/nucleiUtils.go): `server/utils/nucleiUtils.go`
- [Target behavior probe](https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/waf-probe/waf_probe.py): `docker/waf-probe/waf_probe.py`
- [Finding triage](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/triageRun.go): `server/utils/triageRun.go`
- [Auth flows and sessions](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/authFlowsUtils.go): `server/utils/authFlowsUtils.go`

### Assistant and capture

- [Browser capture](https://github.com/r-s0n/ars0n-framework-v2/blob/main/extension/background.js): `extension/background.js`
- [MCP assistant tools](https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/index.js): `docker/mcp-server/src/index.js`
- [MCP auth tools](https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/tools/authsessions.js): `docker/mcp-server/src/tools/authsessions.js`
- [MCP authorization tools](https://github.com/r-s0n/ars0n-framework-v2/blob/main/docker/mcp-server/src/tools/authz.js): `docker/mcp-server/src/tools/authz.js`

### Learning and analysis

- [Methodology lessons](https://github.com/r-s0n/ars0n-framework-v2/blob/main/client/src/data/lessons.js): `client/src/data/lessons.js`
- [Attack surface review](https://github.com/r-s0n/ars0n-framework-v2/blob/main/server/utils/attackSurfaceAssetManagement.go): `server/utils/attackSurfaceAssetManagement.go`
- [Document Q&A service](https://github.com/r-s0n/ars0n-framework-v2/blob/main/ai_service/main.py): `ai_service/main.py`

### Other components

- **Security researcher**

## Connections

- Security researcher → Framework UI: uses
- Framework UI → Framework API: submits workflows
- Framework API → Results database: persists results
- Framework API → Targets and scope: manages scope
- Framework API → Asset discovery: orchestrates discovery
- Framework API → Company assets: runs asset tools
- Framework API → URL workflows: runs URL tools
- Framework API → Endpoint analysis: supports endpoint work
- Framework API → Vulnerability scans: runs scanners
- Framework API → Target behavior probe: drives probe (evidence: `docker/waf-probe/waf_probe.py`)
- Framework API → Finding triage: supports triage
- Framework API → Auth flows and sessions: manages authentication
- Asset discovery → Results database: stores results
- URL workflows → Results database: stores results
- Vulnerability scans → Results database: stores results
- Results database → Attack surface review: feeds asset review
- Framework UI → Methodology lessons: presents lessons
- Security researcher → MCP assistant tools: asks assistant
- MCP assistant tools → MCP auth tools: registers tools (evidence: `docker/mcp-server/src/index.js`)
- MCP assistant tools → MCP authorization tools: registers tools (evidence: `docker/mcp-server/src/index.js`)
- MCP auth tools → Framework API: calls API (evidence: `docker/mcp-server/src/tools/authsessions.js`)
- MCP authorization tools → Framework API: calls API (evidence: `docker/mcp-server/src/tools/authz.js`)
- Browser capture → Targets and scope: checks capture scope
- Security researcher → Browser capture: captures browser traffic
- Security researcher → Document Q&A service: asks document questions (evidence: `ai_service/main.py`)