NeuroSploit v4.1.0 — the assurance release

NeuroSploit v4.1.0 — the assurance release

This release turns NeuroSploit from a productive harness into a defensible
one: every high-value decision is now enforced in code and auditable, and a new
optional TypeSafe layer adds calibrated judgment on top.

Authorization & scope

• Target authorization gate (default-deny) — a capability token that doesn't
  cover the target refuses the run before recon and exits non-zero
  (DENY_TARGET_OUTSIDE_GRANT).
• --scope-file <yaml> hard scope + guardrails, and a web Scoping/Guardrails UI.
• Scope-evasion resistance — alt-IP-encoding normalization (0x7f000001,
  2130706433, ::ffff:127.0.0.1 all collapse to dotted-quad), redirect-to-private-IP
  block, and a DNS-rebinding guard.

Evidence & scoring

• Evidence-graded CVSS — the FIRST v3.1 equation, verbatim; each impact metric
  needs a receipt. SQLi with no extraction scores demonstrated 0 / potential 9.8.
• Evidence-integrity checks — cross-target, reused-receipt, foreign-marker and
  orphan-claim rejection.
• Untrusted-output taint — prompt-injection stripping + UNTRUSTED_TOOL_OUTPUT fencing.
• PoC re-validation (--revalidate-poc) — re-run each proof; demote what no longer reproduces.
• 27 deterministic per-CWE validators (up from 19).

Integrity & assurance

• Audit anchoring (neurosploit audit <run> --anchor) — signed checkpoints that
  detect truncation and silent rebuilds.
• Assurance bundle (neurosploit assurance <run>) — P1–P5 in one signed manifest.

Tooling

• Kali sandbox (--sandbox), intercept proxy (--intercept burp|caido|zap|mitmproxy|own),
  compliance mapping (--compliance pci-dss,hipaa,soc2).
• Internal-network / AD attack graph with choke-point analysis.
• Reasoning-budget governor (--budget eco|balanced|aggressive).

TypeSafe System One (new)

• --typesafe on|off|auto — calibrated {confirmed/needs-review/rejected}
  adjudication over evidence, CVSS re-grade, agent pruning, and a code-owned
  confirmation loop. Additive — never resurrects a rejected claim.
• A with/without measurement ships in
  benchmarks/typesafe-2026-09-20/.

Tests: 381 passing · Agents: 446 · License: MIT

🤖 Generated with Claude Code

---

Post-release refinements (folded into this tag)

• Data-type-aware CVSS. A demonstrated credential/PII/payment-data exposure
  keeps its severity even on a thin structured receipt; TypeSafe adds a
  data_sensitivity Score and no longer recalibrates a real critical down just
  because evidence_data was null.
• Evidence back-fill. A proof written as prose is salvaged into the
  structured slot the grader reads (no fabrication).
• CRLF-on-Location + second-order chaining. A param that lands in a Location
  header is also tested for response splitting; a stored payload behind a
  privileged trigger is chained through privesc or reported as a chained lead.
• Session-limit parking. A subscription session limit now pauses the run
  instead of burning agents against a dead session.

---

Also in this tag (later additions)

• MCP server — neurosploit mcp speaks Model Context Protocol over stdio;
  install with claude mcp add neurosploit -- neurosploit mcp. Exposes run,
  findings, report, rebuild, internal, compliance and list_runs as tools.
• Pluggable decision backend — --decision-backend typesafe|laya. Laya is
  a local, open-source System One engine (downloads its model on first use,
  keeps evidence on the box, no API key).
• Tool discovery — the agent researches and provisions the best tool for the
  context (AD: impacket/netexec/bloodhound-python/certipy/kerbrute; web recon;
  cloud; metasploit/msfvenom), not a fixed list.
• CVE -> PoC sourcing — on a fingerprinted version it goes to searchsploit,
  Exploit-DB, GitHub, wpscan; clones, compiles and runs the PoC non-destructively.
• Headless tooling — mobsf (REST/Docker), ghidra analyzeHeadless, jadx,
  radare2; GUI tools driven headless, auto-installed on demand.
• Auto-fetch of the agent library when the binary has no agents_md/ beside it.