cyber-harness

An everything-is-an-extension agent harness for cybersecurity

中文文档

---

cyber-harness is an agent runtime for cybersecurity. Model reasoning, tool execution, knowledge, observation, and collaboration are assembled through the same extension lifecycle. Use the reference distribution or compose the capabilities your own Go application needs.

aiscan packages the agent, core scanners, proxy routing, skills, and IOA collaboration. aiscan-full adds the Web workbench, browser automation, passive recon, and deep crawling.

Use only on explicitly authorized targets.

Start here

Download the matching aiscan or aiscan-full archive from GitHub Releases, extract it, and add the executable to PATH. See Getting started (中文) for installation, PowerShell configuration, and a complete first run.

# With an LLM configured: run a local task and save its events
aiscan agent -p "Read the current directory and explain its structure; do not modify files" -o first-run.jsonl

# Run a deterministic scan against your own local lab, without AI verification
aiscan scan -i http://127.0.0.1:3000 --verify=off

# Full edition: start the Web workbench and sign in with the printed access key
aiscan-full web

The agent lets the model choose tool calls. The scan pipeline chooses work through rules and scan events, with optional AI stages. Both use the same underlying tool infrastructure.

Configure a model

Create cyber.yaml in your working directory:

llm:
  provider: openai
  base_url: https://api.deepseek.com/v1
  model: deepseek-chat

Set OPENAI_API_KEY to your credential. For Anthropic-compatible services, use provider: anthropic and the corresponding settings. See the configuration reference for protocols, profiles, and precedence.

Documentation

Start at the documentation home. Detailed documentation is maintained in Chinese and describes the current source; use the matching Git tag for a release.

Concepts introduces the harness, models, tools, sessions, and knowledge, without requiring Go experience.

The user guide progresses from installation and a first task to sessions, tools, Skills, scanning, and collaboration.

The developer guide builds an application in Go, starting with a runnable tool and then an embedded session, extensions, and host integration.

Architecture explains composition and lifetime, the Agent loop, execution, context, and data flow. Configuration and API details remain in the reference.

Build and embed

git clone --recurse-submodules https://github.com/chainreactors/cyber-harness.git
cd cyber-harness
make          # standard distribution
make agent    # minimal local agent
make full     # frontend + full distribution

Use the Go version declared in go.mod. Full builds also need Node.js/npm; standard and full builds use CGO_ENABLED=0. Build tags are defined in editions.env; native recording requires CGO and is a separate record build.

For custom distributions, call base.New(config), append your extensions, and pass them to extension.New. The host owns Load/Close. Use pkg/aiscan.New to embed the reference distribution. See the runnable custom example and the extension development guide.

Contributing

Read the development guide and documentation standards. Describe the behavior change, affected entry points, and validation in your PR. Update the relevant guide or reference with behavior changes.

Disclaimer

1. This tool is intended for authorized security testing and research purposes only. If you need to test its capabilities, please set up your own lab environment.
2. Before using this tool for any scanning, you must ensure compliance with local laws and regulations and obtain sufficient authorization. Do not scan unauthorized targets.
3. If you engage in any illegal activity while using this tool, you shall bear all consequences yourself. We assume no legal or joint liability.
4. Before installing and using this tool, please carefully read and fully understand all terms. Limitation and disclaimer clauses may be highlighted for your attention.
5. Unless you have fully read, understood, and accepted all terms of this agreement, please do not install or use this tool. Your use or any other express or implied acceptance constitutes your agreement to be bound by these terms.

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

Links

• chainreactors — Organization
• IOA — Internet of Agents
• sdk — Scanner SDK
• proxyclient — Multi-protocol proxy client
• crtm — Security tool package registry
• utils — Shared utilities & PTY manager
• parsers — Protocol & data parsers

---