raptor

╔═══════════════════════════════════════════════════════════════════════════╗
║                                                                           ║
║             ██████╗  █████╗ ██████╗ ████████╗ ██████╗ ██████╗             ║
║             ██╔══██╗██╔══██╗██╔══██╗╚══██╔══╝██╔═══██╗██╔══██╗            ║
║             ██████╔╝███████║██████╔╝   ██║   ██║   ██║██████╔╝            ║
║             ██╔══██╗██╔══██║██╔═══╝    ██║   ██║   ██║██╔══██╗            ║
║             ██║  ██║██║  ██║██║        ██║   ╚██████╔╝██║  ██║            ║
║             ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝        ╚═╝    ╚═════╝ ╚═╝  ╚═╝            ║
║                                                                           ║
║             Autonomous Offensive/Defensive Research Framework             ║
║             Based on Claude Code (v3.1.0)                                 ║
║                                                                           ║
║             Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake)    ║
║             Michael Bargury, John Cartwright                              ║
║                                                                           ║
╚═══════════════════════════════════════════════════════════════════════════╝

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣤⣤⣀⣀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⣿⣿⠿⠿⠟
⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣀⣀⣀⣀⣀⣤⣴⣶⣶⣶⣤⣿⡿⠁⠀⠀⠀
⣀⠤⠴⠒⠒⠛⠛⠛⠛⠛⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠟⠁⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠛⣿⣿⣿⡟⠻⢿⡀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣾⢿⣿⠟⠀⠸⣊⡽⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡇⣿⡁⠀⠀⠀⠉⠁⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⠿⣿⣧⠀ Get them bugs.....⠀⠀⠀⠀⠀

Authors: Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), Michael Bargury, John Cartwright (@gadievron, @danielcuthbert, @thomasdullien, @mbrg, @grokjc)

Licence: MIT, see LICENSE. CodeQL and other third-party components have their own licence terms; see third-party notices and dependencies.

Repository: https://github.com/gadievron/raptor

---

What is RAPTOR?

Built by hackers, for hackers.

RAPTOR is an autonomous security research framework built on top of Claude Code (but not tied to it -- you can plug in your own analysis layer too). It chains together static analysis, binary analysis, LLM-powered vulnerability validation, exploit generation, and patch writing into a single workflow you can run against a codebase or binary.

It is not polished software. It was built in free time, held together with enthusiasm and duct tape, and it works well enough that we can't stop using it. If you want to make it better, open a PR.

RAPTOR supports security research and human review; its reports do not certify that a codebase is secure.

RAPTOR stands for Recursive Autonomous Penetration Testing and Observation Robot. We really wanted to call it RAPTOR.

How it's built

RAPTOR is mostly AI-generated code. The humans set direction, review output, and make design decisions; the AI writes the implementation. Mechanical verification (tests, static analysis, corpus calibration) keeps the quality bar where it needs to be regardless of who — or what — wrote the code.

Start here: Capabilities · Quick start · First run · Security · Documentation

What RAPTOR can do

• Take a codebase from first look to candidate fixes. Map its attack surface, investigate suspicious code, assess scanner findings, test exploitability, and generate PoCs and patches for review. Start with /agentic; use /understand or standalone /audit when you need a focused investigation.
• Check what your software ships with. Inspect application dependencies, container packages, and workflow components; identify advisory and supply-chain risks, produce an SBOM, and plan fixes or upgrades with /sca.
• Investigate an unfamiliar binary or a crash. Recover entry points and parser boundaries, collect runtime evidence, fuzz a target, and investigate the failure with /binary, /fuzz, and /crash-analysis.
• Test running applications. Explore web endpoints with /web and inspect selected runtime behavior with Frida instrumentation through /frida.
• Investigate an open-source project's history. Correlate GitHub activity, archived events, and local git evidence with /oss-forensics.

Maturity varies by workflow. The complete catalogue lists commands and their status; the workflow index helps you choose a starting point.

Why RAPTOR?

• LLM-assisted false-positive filtering. Semgrep, CodeQL, and other tools produce candidate alerts mechanically. RAPTOR examines the surrounding code and data flows to assess whether each alert describes a real bug.
• An audit engine beyond scanner output. Hypothesis-driven investigation uses analysis tools to examine gaps scanners may miss, tracking evidence and coverage. /agentic uses audit capabilities within its workflow; standalone /audit offers a dedicated systematic review. See the audit engine.
• Eight-stage exploitability validation. /validate investigates whether a candidate vulnerability is reachable by an attacker, whether its preconditions can be met, and what mitigations prevent exploitation. Mechanical feasibility checks and self-review support the assessment; dynamic verification depends on available artefacts and execution permissions. See validation.
• Broad software composition analysis. Dependencies, container packages, workflow components, advisories, reachability, and supply-chain signals come together with SBOMs and fix planning. See SCA.
• Connected source and binary evidence. Runtime traces, fuzz witnesses, and optional SMT checks can strengthen findings from source review. Custom detection rules complement upstream scanners.
• A custom, purpose-built sandboxing layer. RAPTOR isolates generated PoCs, target builds, and research tools with policies matched to each tool and execution phase. See the security model below.
• Research that accumulates. Projects retain findings, coverage, annotations, and cross-run comparisons. Threat models, persistent memory, and specialist personas help each investigation build on earlier work.

Security model

The repository being analysed can attack the analyst: through malicious code, repo-controlled configuration, prompt injection, or content rendered in a report. RAPTOR addresses those surfaces with several boundaries: