How yv1ing/z3r0 works
Z3r0 is an AI-native workbench for authorized security assessments. Operators use the React console to manage assessment projects and sandbox resources, then submit scoped work through the API to a session-based multi-agent runtime. Agents use tools to investigate in sandboxes and coordinate project work; project records preserve assets, evidence, findings, and attack paths, while session events support live updates and replay. The README documents these capabilities and the router-handler-service-model layering; unsampled implementation details are represented only where that documentation supports them.
Main entry points: session.py Session runtime · sandbox Sandbox services · app.py FastAPI API · tools Agent tools
Components 20
Operator console
- React workbench
web/src/app/App.tsx
Control plane
- FastAPI API
app.py - Agent routes
router/agent/sessions.py - Project routes
router/work_project/records.py
Agent runtime
- Session runtime
core/runtime/session.py - Agent system
core/agent/registry.py - Agent tools
core/tools - Session timeline
core/runtime/timeline.py - Event records
model/agent/event_log.py - Knowledge retrieval
core/lightrag/runtime.py
Assessment records
- Project services
service/work_project - Project records
model/work_project
Sandbox execution
- Sandbox services
service/sandbox - Sandbox records
model/sandbox - Control and egress proxy
sandbox/proxy/main.go - Managed hosts
service/host/hosts.py
Other components
- Authorized operator
- PostgreSQL
- REST and WebSocket API
- External targets
Connections 23
- Authorized operator → React workbench: operates
- React workbench → REST and WebSocket API: sends requests
- REST and WebSocket API → FastAPI API: serves
- FastAPI API → Agent routes: mounts routes
- FastAPI API → Project routes: mounts routes
- Agent routes → Session runtime: starts sessions
- Session runtime → Agent system: runs agents
- Session runtime → Knowledge retrieval: retrieves context
- Agent system → Agent tools: invokes tools
- Agent tools → Project services: records assessment work
- Project routes → Project services: handles requests
- Project services → Project records: persists records
- Agent tools → Sandbox services: uses sandbox
- Sandbox services → Managed hosts: uses managed hosts
- Sandbox services → Sandbox records: persists task state
- Sandbox services → Control and egress proxy: uses control proxy
- Control and egress proxy → External targets: controls egress
- Session runtime → Session timeline: emits events
- Session timeline → Event records: persists events
- Project records → PostgreSQL: stores records
- Event records → PostgreSQL: stores events
- Sandbox records → PostgreSQL: stores state
- Knowledge retrieval → PostgreSQL: uses storage