Home

RedLog Wiki

Red Team Operation Log — an Electron desktop app that passively records everything during a pentest engagement into a tamper-evident, per-project timeline. Current release: v0.3.0 · Download · Source

The two-plane model

RedLog captures on two planes — keep them straight and nothing gets missed:

• Hooks = data plane (they record). Passive, automatic, fire on every command. This is where logging happens. Install them first and rely on them.
• MCP = control plane (it operates the app). Create markers, check scope, anchor the chain, read history. Use MCP only for what a hook can't do — never re-log over MCP what a hook already captured.

Start here

• Agent Integration — the full surface: terminal hooks, the app-hosted MCP server (18 tools, HTTP + stdio), REST API, shell helpers, Codex schema, the proxied browser, config profiles.

Integrations

• MCP server — RedLog hosts its own MCP endpoint over HTTP, live the moment the app opens (http://127.0.0.1:<port>/mcp); stdio bridge as a fallback. Set up in Settings ▸ Team & Integrations.
• Proxied browser — one-click Chromium through your mitmproxy, CDP enabled, project-local profile.
• Deconfliction webhook — real-time signed feed to the blue team.

Operator identity

• Operators & tokens — per-operator attribution, secondary operators for teammates/agents (the MCP setup mints a dedicated non-rotating mcp-agent token), rotate/revoke lifecycle, threat model.

Evidence & tamper-evidence

• Audit Trail — SHA-256 event chain + hourly OpenTimestamps anchoring + full re-walk verify (with wall-vs-monotonic clock-anomaly detection) + .ots bundle export.
• Event Schema — standard agent_type values and data keys (Ghostwriter-compatible).

Agent skills

• redlog-pentest skill — drop-in Claude Code skill. Copy to ~/.claude/skills/.

Project ops

• Releasing — two-phase cross-platform release via GitHub Actions.
• codex-tools.json — OpenAI function-calling schema (14 functions).

---

This wiki mirrors docs/ in the repo.