v0.1.0: Initial release — offline methodology engine for authorized pentesting, CTF, security research, and education

Initial release — offline methodology engine for authorized pentesting, CTF, security research, and education

Offline offensive security tool suite for use on authorized targets only. Embeds ATT&CK Enterprise v19.1 and OWASP TG v4.2 data; no external API calls.

Added:

• pentest_guide — methodology playbook for 15 attack vectors; phase filtering; OWASP TG v4.2 test case IDs and ATT&CK IDs cross-referenced; stack/WAF-aware target context
• pentest_analyze_response — structured HTTP response analysis; fingerprinting summary feeds into guide/map tools
• pentest_lookup_technique — ATT&CK lookup by ID or keyword; detection indicators, mitigations, procedure examples
• pentest_map_techniques — target profile → ranked ATT&CK techniques + OWASP test cases; transparent relevance scoring
• pentest_generate_payloads — annotated payload templates; 14 categories, 16 injection contexts, WAF profile variants; each template carries detection + mitigation
• pentest_encode — encoding chain transformer; 10 types, up to 6 chained steps; decode walkthrough + bypass rationale; detection_note in every response
• authorized_use_reminder required field on all methodology/payload tools — rendered as first line of every response
• Detection + mitigation parity — non-optional on every technique, finding, and payload object
• scripts/refresh-attack.ts — fetches latest ATT&CK Enterprise JSON; run quarterly

91 tests pass; bun run devcheck clean.