How yayalingo/agent-vuln-loop works
agent-vuln-loop is an authorized security-assessment application. A user starts an engagement through the CLI; the LangGraph pipeline coordinates discovery, hypothesis planning, non-weaponized proof-of-concept descriptions, independent validation (including optional read-only HTTP probes), reporting, and human-gated remediation drafts. The validator can send rejected candidates back for a bounded exploitation retry. Authorization is a shared tool-call gate. The graph preserves documented capabilities whose implementation was not sampled; wiring is shown only where the README or excerpts support it.
Main entry points: authorization.py Authorization gate · validator.py Validator · cli.py CLI · pipeline.py Graph pipeline
Components 13
Engagement interface
- CLI
src/agent_vuln_loop/cli.py
Assessment workflow
- Graph pipeline
src/agent_vuln_loop/pipeline.py - Engagement state
src/agent_vuln_loop/schema.py - Recon
src/agent_vuln_loop/agents/recon.py - Planner
src/agent_vuln_loop/agents/planner.py - Exploit descriptions
src/agent_vuln_loop/agents/exploit.py
Safety and evidence
- Validator
src/agent_vuln_loop/agents/validator.py - HTTP probes
src/agent_vuln_loop/probes.py - Authorization gate
src/agent_vuln_loop/authorization.py
Reporting and remediation
- Reporter
src/agent_vuln_loop/agents/reporter.py - Remediation drafts
src/agent_vuln_loop/agents/remediation.py
Other components
- Operator
- Human approver
Connections 20
- Operator → CLI: starts engagement
- CLI → Graph pipeline: invokes graph
- Graph pipeline → Engagement state: coerces state
- Graph pipeline → Recon: dispatches
- Recon → Planner: observations
- Planner → Exploit descriptions: hypotheses
- Exploit descriptions → Validator: candidate evidence
- Validator → Exploit descriptions: retries rejected candidates
- Validator → Reporter: validated findings
- Reporter → Remediation drafts: report and drafts
- CLI → Authorization gate: reads audit trail
- Recon → Authorization gate: checks techniques
- Planner → Authorization gate: checks techniques
- Exploit descriptions → Authorization gate: checks techniques
- Validator → Authorization gate: checks techniques
- Reporter → Authorization gate: checks techniques
- Remediation drafts → Authorization gate: checks techniques
- Validator → HTTP probes: runs live checks
- Human approver → CLI: approves drafts
- CLI → Graph pipeline: resumes after approval