Enigmatic Red Run it locally

Enigmatic Red — research-lab beta

An agent that scans your estate,
and can prove exactly what it did.

Enigmatic Red runs recon, enumeration and non-destructive verification against infrastructure you can demonstrate you own. Every action passes scope, a signed authorisation, an action guard and a hash-chained audit log before a single packet leaves. Refusals are logged as carefully as successes. It is a beta you host yourself: no account, no API key, nothing to buy.

Run the beta locally See five real runs

How it works

Six phases, each one deliberately narrow

Every domain pack names its work in the same six phases, so what a plan is allowed to reach is comparable across packs without a translation table. The beta reaches all six: what stops a run is the scope, the approval gate and the guard, not an entitlement.

Infrastructure

Open services, versions, misconfigurations, weak TLS, exposed admin planes, and whether default credentials exist — never brute forcing them.

Web application

Content discovery, authentication and session logic, injection classes, access control and IDOR, security headers, CORS.

Cloud security

Public buckets, over-permissive IAM policy documents, exposed managed services and logging gaps — read-only posture checks that never mutate cloud state.

AI security

Prompt injection and jailbreak probing, system-prompt and tool-definition extraction, insecure output handling, excessive agency, retrieval leakage.

Real runs, not mockups

5 runs from one session of the execution layer

Each block below is a real capture against a loopback lab host under a signed demo scope, with one local lab asset listening on 8000 and 8080. The tool call, the output and every audit line are quoted verbatim from web/captures/demo-captures.json. That file is produced by python web/capture_demo.py, which also writes the run’s audit log to web/captures/audit-demo.jsonl (kept out of git, like every audit log). The natural-language line is the operator request each run was made for.

Reconnaissance that runs

allowed

You askScan the web host we have in scope and tell me what is exposed.

tool callreturncode 0
$ nmap -Pn -sV -oX - -p 8000,8080 --max-rate 200 127.0.0.1
portstateserviceproduct
8000/tcpopenhttp-altlab-asset/1.0
8080/tcpopenhttp-proxylab-asset/1.0

1 host up, 2 open services, 2.57 s of scanner time; 6,270 bytes of XML parsed into that table, 2,772 ms wall clock for the process.

Active enumeration with scope, a dated attestation and an audit entry written before the process started.

audit trail2 entries
seq 1  tool.requested  decision=allowed  action_class=active
seq 2  tool.completed  decision=ok  action_class=active  returncode=0
raw audit lines 
{"action":"nmap -Pn -sV -oX - -p 8000,8080 --max-rate 200 127.0.0.1","action_class":"active","actor":"planner","decision":"allowed","detail":{"matched_rules":[],"scan_id":"demo-scan-0001"},"entry_hash":"6759ddbca507875260e1ecea7102096bf06c228d9ba9bf9563b0639fe972fbe6","event":"tool.requested","org":"Enigmatic Red Demo","prev_hash":"0000000000000000000000000000000000000000000000000000000000000000","seq":1,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:45.086953+00:00"}
{"action":"nmap -Pn -sV -oX - -p 8000,8080 --max-rate 200 127.0.0.1","action_class":"active","actor":"planner","decision":"ok","detail":{"duration_ms":2771.6,"elapsed_s":2.57,"hosts":1,"open_services":2,"parse_error":"","returncode":0,"scan_id":"demo-scan-0001","sensitive_services":[],"stderr_bytes":0,"stdout_bytes":6270,"timed_out":false,"tool":"nmap","truncated":false,"up_hosts":1},"entry_hash":"1f4f2c444b06f727545e0e585027083660b8921df3613c96c43c8cbbcffbf32c","event":"tool.completed","org":"Enigmatic Red Demo","prev_hash":"6759ddbca507875260e1ecea7102096bf06c228d9ba9bf9563b0639fe972fbe6","seq":2,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.893477+00:00"}

A scan that gets refused

refused

You askSame scan, but crank the probe rate to 5000 so it finishes faster.

tool callnever reached the runner
$ nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1

refused: this action is in a permanently forbidden class and cannot be approved (nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1): forbidden[dos_flags]: flood or high-rate flags intended to exhaust the target

Flood-class flags are a hard deny: no approval can enable them, and the refusal is recorded like any other decision.

audit trail1 entry
seq 3  tool.refused  decision=refused  action_class=forbidden  matched_rules=['dos_flags']
raw audit lines 
{"action":"nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1","action_class":"forbidden","actor":"planner","decision":"refused","detail":{"matched_rules":["dos_flags"],"reason":"refused: this action is in a permanently forbidden class and cannot be approved (nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1): forbidden[dos_flags]: flood or high-rate flags intended to exhaust the target","scan_id":"demo-scan-0001"},"entry_hash":"24e7db1011145d5196b7d3feaa438f5f103e76961671ea3926710b9911f00483","event":"tool.refused","org":"Enigmatic Red Demo","prev_hash":"1f4f2c444b06f727545e0e585027083660b8921df3613c96c43c8cbbcffbf32c","seq":3,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.895480+00:00"}

An intrusive check that waits for a human

approval required

You askCheck the app for Log4Shell and confirm whether it is reachable.

tool callnever reached the runner
$ nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10

human approval required before running an intrusive action (nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10): tool class intrusive for 'nuclei'

Intrusive tooling runs only against an approval for that exact command line, and the request is logged even while it is held.

audit trail1 entry
seq 4  tool.refused  decision=approval_required  action_class=intrusive
raw audit lines 
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"approval_required","detail":{"matched_rules":[],"reason":"human approval required before running an intrusive action (nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10): tool class intrusive for 'nuclei'","scan_id":"demo-scan-0002"},"entry_hash":"cec57ef38964f054a1af78ba34521b8201888ae93545463e8c1583150fae9bf0","event":"tool.refused","org":"Enigmatic Red Demo","prev_hash":"24e7db1011145d5196b7d3feaa438f5f103e76961671ea3926710b9911f00483","seq":4,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.897478+00:00"}

The same check, after an approval

ran · rc 1

You askApproved: go ahead with the Log4Shell template only.

tool callreturncode 1
$ nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10
process2468.7 ms
returncode 1   stdout 0 B   stderr 60 B

nuclei exited with rc 1 and produced no findings, so the run could not be interpreted; nuclei reports no templates provisioned and this adapter never fetches templates mid-scan (provision them out of band)

The run really did happen and really did fail: this machine has no nuclei template set installed. The layer reports the configuration error instead of reading it as "no findings", and the run is audited at both ends regardless.

audit trail2 entries
seq 5  tool.requested  decision=allowed  action_class=intrusive
seq 6  tool.completed  decision=error  action_class=intrusive  returncode=1  parse_error=<set>
raw audit lines 
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"allowed","detail":{"matched_rules":[],"scan_id":"demo-scan-0002"},"entry_hash":"4ffd148781fec684cb63ec9d99ff5e1746509a02e7efc34275019922bbe1c923","event":"tool.requested","org":"Enigmatic Red Demo","prev_hash":"cec57ef38964f054a1af78ba34521b8201888ae93545463e8c1583150fae9bf0","seq":5,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.899484+00:00"}
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"error","detail":{"duration_ms":2468.7,"parse_error":"nuclei exited with rc 1 and produced no findings, so the run could not be interpreted; nuclei reports no templates provisioned and this adapter never fetches templates mid-scan (provision them out of band)","returncode":1,"scan_id":"demo-scan-0002","stderr_bytes":60,"stdout_bytes":0,"timed_out":false,"tool":"nuclei","truncated":false},"entry_hash":"5e0ff7a6827db81b78f8edec83bea4b9ad9ebe035be022705f5f9a3f02b187a8","event":"tool.completed","org":"Enigmatic Red Demo","prev_hash":"4ffd148781fec684cb63ec9d99ff5e1746509a02e7efc34275019922bbe1c923","seq":6,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:50.404116+00:00"}

A target we were never authorised to touch

refused

You askWhile you are there, scan 8.8.8.8 as well.

tool callnever reached the runner
$ nmap -Pn -sV -oX - -p 80,443 8.8.8.8

refusing nmap: '8.8.8.8' is out of scope: no allow rule matches '8.8.8.8' (scope 'demo-lab' grants 1 host(s), 0 cidr(s))

The guard is not the only gate: a target has to be inside the signed scope, re-checked before any packet leaves this machine.

audit trail1 entry
seq 7  scope.refused  decision=refused
raw audit lines 
{"action":"nmap","action_class":null,"actor":"planner","decision":"refused","detail":{"matched_rule":"","reason":"no allow rule matches '8.8.8.8' (scope 'demo-lab' grants 1 host(s), 0 cidr(s))","scan_id":"demo-scan-0003"},"entry_hash":"369fbcd93a379e2932ee795a336bad248fb055d11028f1dfefa1a0aa9115c0bd","event":"scope.refused","org":"Enigmatic Red Demo","prev_hash":"5e0ff7a6827db81b78f8edec83bea4b9ad9ebe035be022705f5f9a3f02b187a8","seq":7,"target":"8.8.8.8","timestamp":"2026-10-19T14:37:50.406120+00:00"}

Captured 2026-10-19T14:37:50+00:00 on this machine; the audit chain verified intact across all 7 entries afterwards. Regenerate with python web/build_page.py (it touches nothing but 127.0.0.1) and the blocks above are re-rendered from the new capture, quoting and all. Nothing here is hand-written sample data: argv, exit codes, byte counts, timings, refusal strings and audit hashes all come out of that file, and python web/verify_page.py checks that they still match it.

Research-lab beta — runs on your machine

Free to run, and there is nothing to buy yet

Enigmatic Red is a research project right now, not a service. There is no sign-up, no API key issued to anyone and no checkout: you run it locally, against infrastructure you can prove you own, and you read the audit log yourself. If it becomes a product, the Enigmatic Red Subscription will be sold on this page — the pricing, the Stripe configuration and the checkout flow are archived in the repository until then.

What works today

The execution layer, end to end: scope and authorisation intake, the action guard, human approval for intrusive commands, an append-only hash-chained audit log, evidence with its bytes and hash, and a report that keeps a verified finding apart from a lead. The five blocks above are real captures from it, quoted verbatim.

What is not here yet

No hosted service, no accounts, no API keys — and no command-line entry point, so today you drive the agent from Python or run the test suite, which is where the interlock is pinned. Several tool adapters (httpx, subfinder, dnsx, gobuster, ffuf, whatweb) and CVSS 4.0 scoring are still being written.

What a beta tester needs

A machine, a Featherless API key (the only secret the beta has) and a target you can prove you own — a local lab is enough, and is what the captures above used. Expect refusals to outnumber findings: the guard is supposed to say no, and every refusal is logged.

run it locallyno account, no server, no billing
$ python -m venv .venv
$ .venv\Scripts\activate
$ pip install -r requirements.txt
$ copy .env.example .env        # set FEATHERLESS_API_KEY, nothing else
$ python -m pytest -q           # the guard, the audit chain, the report
$ python -m http.server 8000 --directory web   # preview this page locally

Guardrails that apply to every run

  • 25 targets per scan, and 60 minutes of wall clock, maximum.
  • 2,000,000 LLM tokens per scan; 40,000,000 per seat per month. Metric spend is bounded on purpose.
  • 17 capability patterns are permanently forbidden — denial of service, credential brute force, persistence, destructive filesystem and SQL operations, reverse shells and command-and-control, bulk exfiltration, and SSRF toward cloud metadata. No configuration and no approval can enable them.
  • 13 patterns are intrusive — injection and traversal probes, JNDI lookups, exploit tooling, state-changing HTTP verbs, aggressive scans. Each needs a human approval for that exact command line.
  • A binary nobody registered is treated as intrusive, never as active.