Vigil

Vigil runs long offensive security engagements: web app pentesting and bug bounty hunting, white-box code audits, or both against one target. A lean operator keeps the engagement on track while specialist agents recon, hunt, and exploit inside a full Kali runtime. A finding counts only when a second agent confirms it against captured evidence, and attack chains show its real impact. Every command, request, probe, and finding lands in a durable database, so the work survives context limits and restarts and can be audited afterward.

Authorized use only. Vigil autonomously drives offensive tooling against live systems. Use it only with explicit authorization and a reviewed scope. It is provided without warranty under the Apache License 2.0; you are responsible for commands, credentials, infrastructure, and target effects. See SECURITY.md for private vulnerability reporting and the operator-data boundary.

What Vigil provides

• Long-running engagements. State lives in the backend, so an engagement survives compaction, restarts, and new sessions.
• Independently verified findings. Only a dispatch other than the author's can confirm, downgrade, or mark a finding false positive, and it must cite a proof receipt of captured evidence.
• Impact. Attack chains link findings into end-to-end exploitation; by default, exploit work waits for your approval.
• An audit trail. Target-facing commands run through vigil assess kali, which records each command's argv, agent, phase, technique, intent, probe kind, exit status, and output. Coverage ledgers show what was tested and what was not.
• Attack tooling. A long-lived Kali container with ProjectDiscovery recon, fuzzers, an audited Playwright browser, MITM capture with multiple identities for cross-account testing, and out-of-band callbacks correlated to the probe that caused them.
• White-box code audits. A sealed, content-addressed source snapshot with a tree-sitter structural index and a coverage ledger.
• Submission-ready output. Findings export as hash-verified Bugcrowd, HackerOne, or direct disclosure write-ups.
• Clients. Claude Code and Codex have full support: headless specialist dispatch, vigil-* session commands, and compaction and session hooks. goose, opencode, and Kimi lack session commands and compaction hooks, and opencode and Kimi run specialists inline. Pi supports remediation engagements only.

How Vigil hunts

• No pre-named bugs. Over-prompting caps what a model finds. Dispatches carry the surface, scope, and rules of engagement, never the bug to look for or a checklist. Web specialists choose what to probe within that surface; code hunters get a file batch and the vulnerability classes to score.
• One lens per hunt. Each hunting dispatch sets how wide to go, how to work through its inputs, and at most one mindset lens: developer, injection, access control, business logic, chain impact, or skeptical verifier.
• Independent verification. A finding is confirmed only by a different agent working from captured evidence. Code engagements add an anchor-free re-read of the highest-risk files and a variant sweep across every file; web testing walks every sibling route, method, and content type that shares the vulnerable code path.
• Kill-first triage. Web leads must pass eight ordered questions, including whether a real request reproduces it and whether the impact is proven. Code findings must earn PASS with the same evidence a KILL would need.
• A skill library, not pasted prompts. 90+ skills and 200+ references are found through vigil assess list-skills and vigil assess list-references. Web specialists load them when they see the matching signal; the code operator names them in each dispatch.

Quick start

# 1. Install the application release (CLI, backend, prompts, docs, and prebuilt UI)
uv tool install --from https://github.com/VigilOSS/Vigil/releases/download/v1.2.1/vigil-1.2.1-py3-none-any.whl vigil
#    OR install directly from the repository (builds the UI locally; needs Git, Node.js, and npm)
uv tool install git+https://github.com/VigilOSS/Vigil vigil

# 2. Check the host: prerequisites, missing recon tools, and the ordered setup checklist
vigil quickstart

# 3. Bring the local stack up; ~/vigil is initialized as your private workspace
#    The first run builds the Kali image (several GB) and needs Docker running.
vigil up

# 4. Create an engagement; it prints the engagement key and its start command
vigil engagement create

# 5. Start the operator on it
vigil engagement start <engagement-key> --client codex   # or --client claude

For a code engagement, put your source files or project folders in the source/ location printed by creation (Git is optional). The code client asks you to confirm them at startup; an empty folder leaves it waiting. Code engagements need ripgrep (rg) on the host. Details: docs/code-analysis.md.

For a web engagement, tell the operator what it is authorized to do:

I have been fully authorized by the company to do a red-team engagement against the
hosts in scope.json. Run this engagement using the operator web workflow.

The orchestrator UI is at http://127.0.0.1:18000. On macOS or Windows Docker Desktop, DNS-heavy recon runs on the host; vigil quickstart --install-host-tools installs those tools. Upgrades and workspace layout: docs/installation.md.

Models and access

Vigil is built primarily around Claude Code and Codex.

Model	Engagements
Claude Opus 5, with Anthropic's Cyber Verification Program (CVP)	Web and code
GPT-5.6 Sol, with OpenAI's Trusted Access for Cyber	Web and code
Claude Opus 5.5, GPT-6.1 Sol	Code; web needs an organization-only red-team tier

• Claude Code: CVP works with Opus 5, which is not in the /model picker. Select it directly with /model claude-opus-5[1m] (model configuration).
• Codex: choose GPT-5.6 Sol and its reasoning effort in /model.

As of October 2026, red-team access to the newest models is for organizations only: