T3MP3ST Feature Documentation

July 5, 2026 · View on GitHub

Comprehensive feature list for the Tactical Execution Multi-agent Platform for Elite Security Testing

Legend:

  • Implemented and working
  • [~] Partially implemented / stub
  • Planned / ideal feature

Table of Contents

  1. Core Architecture
  2. LLM Backbone
  3. Operator System (Agents)
  4. Mission Control
  5. Target Environment
  6. Arsenal (Tools)
  7. Pliny Specials
  8. Evidence Vault
  9. OPSEC Layer
  10. Communications
  11. Analysis & Reporting
  12. CLI Interface
  13. API Server
  14. MCP Server (Agent Integration)
  15. Web UI Dashboard
  16. Advanced Modules
  17. Configuration System
  18. Integration & Extensibility

1. Core Architecture

TempestCommand Orchestrator

  • Central command class extending EventEmitter
  • Lifecycle management (start, stop, pause, resume)
  • Tick-based execution loop
  • Event emission for all major actions
  • Status reporting and health checks
  • [~] Hooks system for lifecycle events
  • Distributed command across multiple nodes
  • State persistence and recovery after crash

Factory Functions

  • createTempest() - Standard operation
  • createTestTempest() - Testing with mock LLM
  • createAutoTempest() - Auto-configured with best available LLM
  • createStealthOperation() - Silent OPSEC preset
  • createAggressiveOperation() - Loud OPSEC preset
  • createDistributedTempest() - Multi-node operation
  • createCloudTempest() - Cloud-native deployment

Event System

  • command:started / command:stopped
  • command:paused / command:resumed
  • operator:spawned / operator:burned
  • finding:discovered
  • credential:harvested
  • target:owned
  • detection:triggered
  • mission:phase_changed
  • abort:recommended
  • chain:completed - Full kill chain success
  • exfil:complete - Data exfiltration finished

2. LLM Backbone

Provider Support

  • OpenRouter - Multi-model gateway (50+ models)
  • Anthropic - Direct Claude API
  • OpenAI - GPT models
  • Mock - Testing without API
  • Local - Ollama support
  • Azure OpenAI - Enterprise deployment
  • AWS Bedrock - Claude via AWS
  • Google Vertex AI - Gemini via GCP

Model Registry (50+ models configured)

  • Claude Opus 4.5, Sonnet 4.5, Sonnet 4
  • GPT-4o, GPT-4 Turbo, o1
  • Gemini 3 Pro, Gemini 3 Flash, Gemini 2.5 Flash
  • Grok 4, Grok 4 Fast, Grok 4.1 Fast
  • DeepSeek R1, DeepSeek V3
  • Llama 3.3 70B
  • Mistral Large
  • GLM 4.7

LLM Features

  • Chat completion with retry logic
  • Conversation history management
  • System prompt configuration
  • Streaming responses (OpenRouter)
  • Token usage tracking
  • Provider validation
  • Automatic provider selection
  • Function calling / tool use
  • Vision/multimodal support
  • Embeddings for semantic search
  • Fine-tuned model support
  • Cost tracking and budgeting

3. Operator System (Agents)

8 Operator Archetypes

ArchetypePhaseMITRE TacticsStatus
RECONReconnaissanceTA0043[x] Implemented
SCANNERDiscoveryTA0007[x] Implemented
EXPLOITERInitial AccessTA0001, TA0002⚠️ Experimental¹
INFILTRATORLateral MovementTA0008, TA0004⚠️ Experimental¹
EXFILTRATORExfiltrationTA0009, TA0010⚠️ Experimental¹
GHOSTPersistenceTA0003, TA0005⚠️ Experimental¹
COORDINATORC2TA0011⚠️ Experimental¹
ANALYSTReporting-[x] Implemented

¹ Experimental = runs the SAME real, tool-backed ReAct loop as RECON/SCANNER (real tools, not stubs), but end-to-end swarm exploitation is unbenchmarked and unproven — 0 executed exploits in full-chain runs, and the headline benchmark numbers came from a single agent, not the coordinated 8-operator cell. See the README status table + WHITEPAPER for the honest limits.

Operator Features

  • State management (idle, tasked, executing, cooldown, burned)
  • Task assignment and completion tracking
  • Detection risk monitoring
  • Cooldown management
  • Finding and credential recording
  • Archetype-specific system prompts
  • MITRE ATT&CK technique mapping
  • [~] Autonomous decision making via LLM
  • Inter-operator coordination
  • Learning from past engagements
  • Skill leveling system
  • Custom archetype creation

Team Factories

  • createBalancedTeam() - General purpose
  • createStealthTeam() - Minimal detection
  • createBreachTeam() - Aggressive initial access
  • createAPTTeam() - Advanced persistent threat simulation
  • createInsiderTeam() - Insider threat simulation
  • createCloudTeam() - Cloud-focused operations

Operator Cell Management

  • Spawn/despawn operators
  • Status aggregation
  • Count by status
  • Automatic scaling based on workload
  • Operator health monitoring
  • Failover and replacement

4. Mission Control

Mission Lifecycle

  • Create mission with objectives
  • Start/pause/resume/complete/abort
  • Rules of Engagement (RoE) enforcement
  • Phase transitions
  • [~] Objective tracking and completion
  • Mission templates
  • Multi-mission management
  • Mission scheduling

Task Queue

  • Priority-based task management
  • Add/remove tasks
  • Get next task (global or by archetype)
  • Status updates
  • Mission-scoped task queries
  • Task dependencies
  • Parallel task execution
  • Task retry with backoff
  • Deadline enforcement

Rules of Engagement

  • Scope definition (in-scope targets)
  • Forbidden techniques list
  • Detection event limits
  • createDefaultRoE() preset
  • createStrictRoE() preset
  • Time-based restrictions
  • Geographic restrictions
  • Data handling rules
  • Escalation procedures

Kill Chain Phases

  • RECON - Reconnaissance
  • WEAPONIZE - Weaponization
  • DELIVER - Delivery
  • EXPLOIT - Exploitation
  • INSTALL - Installation
  • C2 - Command & Control
  • ACTIONS_ON_OBJECTIVES - Actions on Objectives
  • Phase-to-archetype mapping
  • Custom phase definitions
  • Phase-specific tooling

5. Target Environment

Target Management

  • Add/update/remove targets
  • Status transitions (discovered → scanning → vulnerable → exploited → owned)
  • Zone classification (external, dmz, internal, restricted)
  • Type classification (web_app, api, server, network_device, etc.)
  • Service and vulnerability tracking
  • Statistics aggregation
  • Asset discovery automation
  • Network topology mapping
  • Relationship tracking between targets

Target Factories

  • createTargetFromUrl() - Parse URL into target
  • createTargetFromIP() - Create from IP address
  • createDMZArchitecture() - Sample architecture
  • importFromNmap() - Import from Nmap XML
  • importFromShodan() - Import from Shodan
  • importFromCloud() - Import from AWS/GCP/Azure

Target Types

  • web_application
  • api
  • server
  • workstation
  • network_device
  • database
  • cloud_service
  • container
  • iot_device
  • mobile_app

6. Arsenal (Tools)

Built-in Tools

  • dns_lookup - DNS resolution with multiple record types
  • port_scan - Port scanning with service detection
  • http_request - Full HTTP client with headers/body
  • subdomain_enum - Subdomain enumeration
  • dir_bruteforce - Directory bruteforcing with wordlists
  • whois_lookup - Domain WHOIS lookup
  • header_analysis - Security header analyzer
  • technology_detect - Tech stack fingerprinting
  • xss_scan - XSS vulnerability testing
  • sqli_scan - SQL injection testing
  • ssl_scan - TLS/SSL configuration analysis
  • password_spray - Common password testing
  • hash_crack - Hash identification and cracking
  • base64_decode - Base64 decoding utility
  • jwt_decode - JWT analysis with security checks
  • vuln_scan - Comprehensive vulnerability scanning
  • exploit_search - Exploit database search

Tool Management

  • Tool registration
  • Category-based filtering
  • Tool execution with context
  • Execution history tracking
  • Custom tool support
  • Tool chaining
  • Tool output parsing
  • Tool version management
  • Tool health checks

Whitelisted CLI Tools (via API)

Availability tiers: default = wired without extra flags; opt-in = catalog-gated behind T3MP3ST_FULL_ARSENAL; approval-gated = also requires per-call approval (real auth/attack traffic). See the 35 default / 83 opt-in split in the README. Real, re-derivable catalog (verify-claims): 35 built-in (default) + 48 opt-in adapters = 83.

  • default built-ins (callable with no flag) — nmap_scan, nuclei_scan, ffuf_fuzz, curl_request, port_scan, subdomain_enum, http_request, xss_scan, sqli_scan, dns_lookup, … (35)
  • opt-in adapters (T3MP3ST_FULL_ARSENAL) — nuclei, subfinder, httpx, naabu, katana, ffuf, gobuster, feroxbuster, nikto, dalfox, sqlmap · semgrep, gitleaks, trufflehog, trivy, grype, osv-scanner, checkov · slither, mythril, echidna, foundry, solhint · openssl, john, hashcat, radare2, apktool, jadx, exiftool, binwalk, yara (48)
  • approval-gated post-ex drivers (opt-in + human approval + local CLI installed) — metasploit (msfconsole, riskTier dangerous), hydra (credential); bloodhound is import-only (graph pipeline)
  • burp suite integration (genuinely not integrated)

7. Pliny Specials — ⛔ RETIRED

⛔ These nine tools were REMOVED and are NOT shipped or callable. The /api/pliny/* routes and the pliny_* MCP tools no longer exist in the codebase (see the retirement notes later in this file). Only security_recon survives as a live MCP tool. The table and feature checklists below are kept only as a historical record of the retired design — every [x] describes what the removed design once did, not a shipping capability. Nothing in this section is wired up.

The Nine Pliny Specials (all retired)

ToolPowerTypeStatus
LEVIATHAN99Kill Chain Orchestrator⛔ RETIRED
SPHINX88Vulnerability Validator⛔ RETIRED
GORGON92Precision Exploitation⛔ RETIRED
CERBERUS85Privilege Escalation⛔ RETIRED
TYPHON90Payload Encoding⛔ RETIRED
GRIFFIN95Secret Harvesting⛔ RETIRED
SIMURGH100Zero-Day Research⛔ RETIRED
HYDRA85Multi-Vector Attacks⛔ RETIRED
ARACHNE87Exploit Chaining⛔ RETIRED

The per-tool checklists below document the retired design (historical only):

LEVIATHAN Features

  • Engagement planning
  • Phase orchestration
  • Tool recommendations
  • Autonomy levels (FULL, GUIDED, MANUAL)
  • Real-time execution
  • Progress tracking
  • Abort/rollback capability

SPHINX Features

  • Finding analysis
  • False positive elimination
  • PoC generation
  • Confidence scoring
  • Integration with major scanners
  • Automated retesting
  • Finding deduplication

GORGON Features

  • Payload selection
  • Delivery method planning
  • Stealth rating calculation
  • Mode selection (surgical, aggressive, stealth)
  • Actual exploit execution
  • Session management
  • Post-exploitation hooks

TYPHON Features

  • URL encoding (single/double)
  • Base64 encoding
  • Hex encoding
  • Unicode escaping
  • HTML entity encoding
  • WAF bypass techniques
  • Custom encoding chains
  • Context-aware encoding
  • Encoding detection/decode

GRIFFIN Features

  • JWT extraction and decoding
  • AWS credential detection
  • GitHub token detection
  • API key extraction
  • Password pattern matching
  • Private key detection
  • Cloud credential validation
  • Token expiry checking
  • Credential spraying integration

SIMURGH Features

  • Vulnerability class targeting
  • Protection analysis
  • Attack surface mapping
  • Exploitation primitive identification
  • Fuzzer integration
  • Crash analysis
  • Exploit development assistance

CERBERUS Features

  • Linux privesc vectors (sudo, SUID, kernel, cron)
  • Windows privesc vectors (UAC, services, tokens)
  • Confidence scoring
  • Recommended execution order
  • Automated enumeration
  • Exploit suggestion
  • Success probability calculation

HYDRA Features

  • Multi-vector coordination with 14 attack vectors
  • Parallel attack planning with configurable heads
  • Vector selection (SQLi, XSS, SSRF, SSTI, LFI, RCE, etc.)
  • Priority scoring based on target type
  • API integration for enhanced analysis
  • Web UI integration with real-time status
  • Comprehensive payload databases per vector
  • Rate limiting
  • Result aggregation
  • Attack surface coverage metrics

ARACHNE Features

  • Chain building from vulnerabilities
  • Objective-based pathfinding (14 attack primitives)
  • 8 strategic objectives with MITRE ATT&CK mapping
  • 18 known exploit chains with CVE mappings
  • Reliability and detection risk scoring
  • Playbook generation with phases
  • API integration for enhanced chains
  • Web UI findChainsEnhanced() method
  • Chain length limits
  • Multiple chain generation
  • Graph-based visualization
  • Chain validation

8. Evidence Vault

Finding Management

  • Create findings with severity
  • CVSS score support
  • Verification status tracking
  • Query by severity/target/operator
  • Evidence attachment
  • Finding templates
  • Duplicate detection
  • Finding workflows (triage → verify → report)

Credential Management

  • Credential storage
  • Type classification (password, hash, token, key, certificate)
  • Source tracking
  • Query all credentials
  • Credential validation
  • Password cracking integration
  • Credential rotation detection

Evidence Types

  • Screenshots
  • HTTP requests/responses
  • Command output
  • Files
  • Network captures
  • Video recordings
  • Memory dumps
  • Disk images

Severity Levels

  • Critical (score: 10)
  • High (score: 7.5)
  • Medium (score: 5)
  • Low (score: 2.5)
  • Info (score: 0)
  • CVSS to severity conversion

9. OPSEC Layer

OPSEC Levels

  • Silent - Maximum stealth, 1 detection limit, 5min cooldown
  • Covert - Balanced, 3 detection limit, 1min cooldown
  • Loud - Speed priority, 20 detection limit, 2s cooldown

Detection Management

  • Detection event recording
  • Abort recommendation threshold
  • Cooldown enforcement
  • IOC (Indicator of Compromise) tracking
  • Detection pattern analysis
  • Evasion recommendations
  • Real-time alert integration

OPSEC Features

  • Traffic blending option
  • Timing jitter
  • Logging sanitization
  • Cleanup on complete
  • [~] Avoid detection heuristics
  • TOR/proxy integration
  • Domain fronting
  • Traffic encryption
  • Decoy traffic generation

OPSEC Presets

  • createSilentOpsecConfig()
  • createAggressiveOpsecConfig()
  • createBalancedOpsecConfig()
  • createAPTOpsecConfig()
  • createRedTeamOpsecConfig()

10. Communications

Channel Types

  • Broadcast - All operators
  • Direct - One-to-one
  • Team - Group channels
  • Encrypted channels
  • External C2 integration

Message Types

  • Intel - Intelligence sharing
  • Task - Task assignments
  • Alert - Warnings
  • Status - Status updates
  • Finding - Finding reports
  • Coordination - Team coordination
  • Heartbeat - Health checks
  • Emergency - Critical alerts

Comms Features

  • Channel creation/closure
  • Subscription management
  • Message routing
  • Message history
  • Priority levels
  • Message encryption
  • Message acknowledgment
  • Offline message queue

11. Analysis & Reporting

Report Types

  • Executive summary
  • Technical findings
  • Full report
  • Findings only
  • Compliance report (PCI, HIPAA, SOC2)
  • Remediation report
  • Trend analysis

Report Features

  • Risk rating calculation
  • Attack path inference
  • Recommendation generation
  • Markdown export
  • [~] HTML export
  • PDF export
  • DOCX export
  • JSON/XML export

Analysis Features

  • Severity aggregation
  • Target coverage analysis
  • Finding categorization
  • CVSS calculation
  • Risk scoring models
  • Trend analysis over time
  • Comparison with baselines

Executive Summary Includes

  • Total findings by severity
  • Risk rating (Critical/High/Medium/Low)
  • Top recommendations
  • Key findings highlights
  • Business impact assessment
  • Compliance status
  • Remediation timeline

12. CLI Interface

Commands

  • t3mp3st - Interactive mode (default)
  • t3mp3st setup - Configuration wizard
  • t3mp3st status - Show configuration
  • t3mp3st test - Test LLM connection
  • t3mp3st models - List available models
  • t3mp3st run <mission> - Run mission file
  • t3mp3st report <output> - Generate report
  • t3mp3st import <file> - Import targets
  • t3mp3st export <file> - Export findings

Interactive Mode Features

  • Start new operation (4 presets)
  • View status (operators, findings, OPSEC)
  • Spawn operator (8 archetypes)
  • Add target
  • Create mission
  • Chat with AI
  • Generate report
  • Stop operation
  • Settings management
  • Mission templates
  • Batch operations
  • Scripting support

UI Features

  • Colored output (chalk)
  • ASCII banner (figlet)
  • Gradient text
  • Progress spinners (ora)
  • Interactive prompts (inquirer)
  • Table display (cli-table3)
  • Box formatting (boxen)

13. API Server

Server Configuration

  • Express.js server
  • Port 3333 (configurable)
  • CORS enabled
  • JSON body parsing
  • Static file serving for UI

Health Endpoints

  • GET /api/health - Server health
  • GET /api/llm/status - LLM connection status

Pliny Specials Endpoints — ❌ RETIRED (removed 2026-06)

The /api/pliny/* "adversarial engine" routes were removed. They were static payload-catalog lookups with no measured uplift to the benchmark and were never on the hunt path. The live offensive surface is the mission-control API (/api/mission/*), the arsenal (/api/tools/*), and the recon engine — documented in the sections above. No /api/pliny/* route exists in the server today.

Tool Endpoints

  • POST /api/tools/execute - Execute whitelisted tool
  • POST /api/tools/recon - Quick reconnaissance
  • GET /api/tools - List available tools
  • GET /api/tools/:id/history - Tool execution history

LLM Endpoints

  • POST /api/llm/chat - Chat with LLM
  • POST /api/llm/stream - Streaming chat
  • GET /api/llm/models - List models

Missing Endpoints (Planned)

  • GET /api/operators - List operators
  • POST /api/operators - Spawn operator
  • DELETE /api/operators/:id - Remove operator
  • GET /api/targets - List targets
  • POST /api/targets - Add target
  • GET /api/findings - List findings
  • GET /api/missions - List missions
  • POST /api/missions - Create mission
  • GET /api/reports - Generate report

14. MCP Server (Agent Integration)

MCP Tools Exposed

The pliny_* MCP tools were retired (2026-06) alongside the /api/pliny routes — they were catalog lookups, not engines. The MCP server exposes the real, tool-backed surface:

  • security_recon - Network reconnaissance (nmap / DNS / HTTP / fingerprinting, every finding traces to live tool output)

MCP Features

  • Tool definitions with JSON Schema
  • Tool execution handlers
  • Stdio transport
  • Error handling
  • SSE transport
  • WebSocket transport
  • Authentication
  • Rate limiting
  • Usage tracking

Integration Support

  • Claude Desktop configuration
  • Claude Code integration
  • ChatGPT plugin format
  • LangChain tools
  • AutoGPT plugins

15. Web UI Dashboard

  • Sidebar navigation
  • Section collapse/expand
  • Mobile responsive toggle
  • Active section highlighting
  • Badge indicators

Dashboard Page

  • Kill chain visualization
  • Operator swarm status
  • Live intel feed
  • Statistics cards
  • OPSEC monitor
  • Quick actions

Pages Implemented

  • Dashboard - Overview
  • Operators - Agent management
  • Missions - Mission control
  • Evidence - Findings vault
  • Arsenal - Tool registry
  • Terminal - Command execution
  • Benchmarks - Performance testing
  • Config Library - OPSEC presets
  • CTF Range - Practice targets
  • Settings - Configuration
  • About - Project info

Visual Features

  • Dark cyberpunk theme
  • Neon color scheme
  • Animated elements
  • Grid background
  • Progress bars
  • Status indicators
  • Code syntax highlighting

Interactive Features

  • Real-time updates
  • Filter controls
  • Modal dialogs
  • Toast notifications
  • Keyboard shortcuts
  • Copy to clipboard
  • View source on GitHub links
  • Drag and drop
  • Export functionality
  • Dark/light theme toggle

Arsenal Features

  • Tool cards with stats
  • Category filtering
  • Search functionality
  • Tool info modals
  • Code viewer tab
  • Stats tab
  • Run demo buttons
  • Copy code functionality
  • View full source links

16. Advanced Modules

Module Implementations

ModulePurposeStatus
KnowledgeBaseCVE/MITRE database[x] Full - 20 CVEs, 40+ MITRE techniques, 15 patterns
EvasionEngineEncoding & bypass[x] Full - 10 encoders, obfuscators, WAF bypass
ExploitEnginePayload generation & delivery[~] Stub
ScannerOrchestratorMulti-scanner coordination[~] Stub
BrowserAutomationHeadless browser control[~] Stub
BenchmarkRunnerPerformance testing[~] Stub
ReasoningEngineChain-of-thought reasoning[~] Stub
CognitionEngineAdvanced thought patterns[~] Stub
SwarmControllerMulti-agent swarm behavior[~] Stub
CloudSecurityEngineCloud enumeration[~] Stub
PersistenceControllerImplant deployment[~] Stub
LearningEngineExperience recording[~] Stub
ProtocolHandlerProtocol abstraction[~] Stub
ReportingEngineAutomated reports[~] Stub
WorkflowOrchestratorMulti-step automation[~] Stub

KnowledgeBase Features (NEW)

  • 20 critical CVE entries (Log4Shell, Spring4Shell, ProxyLogon, etc.)
  • 40+ MITRE ATT&CK techniques across all tactics
  • 15 vulnerability patterns for injection detection
  • query() - Search CVEs, techniques, patterns
  • getCVE() / getTechnique() - Direct lookups
  • getTechniquesByTactic() - Filter by MITRE tactic
  • getCriticalCVEs() - Filter by CVSS threshold
  • matchPatterns() - Detect vulnerabilities in content

EvasionEngine Features (NEW)

  • 10 encoding schemes: base64, base64url, hex, unicode, rot13, url, html, octal
  • Multi-layer encoding with multiEncode()
  • Code obfuscators: string_split, variable_rename, junk_code
  • Sandbox detection (VM, timing, CPU, memory checks)
  • generatePolymorphic() - Multiple payload variants
  • getWAFBypassVariants() - WAF evasion techniques

Planned Advanced Features

Cognition Patterns

  • Chain-of-Thought (CoT) reasoning
  • ReAct (Reasoning + Acting)
  • Tree-of-Thought exploration
  • Self-consistency checking
  • Debate mode (multiple perspectives)

Swarm Intelligence

  • Pheromone-based communication
  • Emergent behavior coordination
  • Task distribution algorithms
  • Collective decision making

Cloud Security

  • AWS enumeration & exploitation
  • GCP security testing
  • Azure penetration testing
  • Multi-cloud support
  • IAM analysis
  • S3/blob storage auditing

Persistence & C2

  • Implant generation
  • C2 channel establishment
  • Beacon management
  • Persistence mechanism deployment

Learning & Adaptation

  • Experience recording
  • Pattern recognition
  • Technique effectiveness tracking
  • Adaptive strategy selection

17. Configuration System

Storage

  • Persistent config via Conf library
  • Project-scoped storage
  • Environment variable loading
  • .env file support
  • Config file import/export
  • Config encryption
  • Remote config sync

API Key Management

  • Store/retrieve API keys
  • Key validation
  • Multi-provider support
  • Environment variable precedence
  • Key rotation
  • Key expiry warnings
  • Secure key storage (keychain)

Provider Configuration

  • Base URL customization
  • Default model selection
  • Site URL/name for OpenRouter
  • Timeout configuration
  • Temperature settings
  • Max tokens configuration

OPSEC Configuration

  • Level presets
  • Detection thresholds
  • Cooldown settings
  • Cleanup preferences

UI Preferences

  • Show/hide banner
  • Color output toggle
  • Verbose logging toggle
  • Theme selection
  • Custom shortcuts

18. Integration & Extensibility

Current Integrations

  • OpenRouter API
  • Anthropic API
  • OpenAI API
  • Ollama (local)
  • Model Context Protocol (MCP)
  • LangChain
  • AutoGPT
  • BabyAGI

Extensibility Points

  • Custom tools via Arsenal.register()
  • Custom operators via createOperator()
  • Event hooks via EventEmitter
  • Custom LLM providers via adapters
  • Plugin system
  • Webhook notifications
  • External C2 integration
  • SIEM integration

Export Formats

  • JSON (findings, reports)
  • Markdown (reports)
  • PDF
  • HTML
  • CSV
  • SARIF (Static Analysis Results)
  • STIX/TAXII (threat intelligence)

Import Formats

  • Nmap XML
  • Nessus reports
  • Burp XML
  • OWASP ZAP
  • Nuclei JSON
  • Shodan export

Feature Roadmap Priority

P0 - Critical (Next Release)

  1. Full API endpoint coverage for operators/targets/missions
  2. Real exploit execution in Pliny tools
  3. PDF report generation
  4. Scanner import (Nmap, Nuclei)

P1 - High (Near Term)

  1. Cloud security module (AWS/GCP/Azure)
  2. Function calling in LLM backbone
  3. WebSocket real-time updates
  4. Plugin system architecture

P2 - Medium (Mid Term)

  1. Cognition patterns (CoT, ReAct)
  2. Swarm intelligence
  3. Learning engine
  4. Distributed operation support

P3 - Low (Long Term)

  1. Mobile app
  2. SaaS deployment
  3. Marketplace for tools/plugins
  4. AI-powered remediation suggestions

Metrics

Total Features Tracked: ~300

  • Implemented: ~150 (50%)
  • Partially Implemented: ~30 (10%)
  • Planned: ~120 (40%)

Last updated: 2026-07 Version: 1.0.0