Home

RedLog Wiki

Red Team Operation Log — an Electron desktop app that passively records everything during a pentest engagement into a tamper-evident, per-project timeline. Current release: v0.6.77 · Download · Source · Changelog

Dashboard	Attack Timeline
Plugin Marketplace	Cloud share bundle

The two-plane model

RedLog captures on two planes — keep them straight and nothing gets missed:

• Hooks = data plane (they record). Passive, automatic, fire on every command. This is where logging happens. Install them first and rely on them. See Hook Privacy for the exclusion list / recording gate.
• MCP = control plane (it operates the app). Create markers, check scope, anchor the chain, read history. Use MCP only for what a hook can't do — never re-log over MCP what a hook already captured.

Start here

• Agent Integration — the full surface: terminal hooks, the app-hosted MCP server (18 tools, HTTP + stdio), REST API, shell helpers, Codex schema, the proxied browser, config profiles.
• Plugin Development — write your own 🟢 declarative plugin or 🔴 privileged code plugin. Includes a full guide on wrapping a new AI agent.

Integrations

• MCP server — RedLog hosts its own MCP endpoint over HTTP, live the moment the app opens (http://127.0.0.1:<port>/mcp); stdio bridge as a fallback. Set up in Settings ▸ Team & Integrations.
• Proxied browser — one-click Chromium through your mitmproxy, CDP enabled, project-local profile.
• Deconfliction webhook — real-time signed feed to the blue team.

Operator identity

• Operators & tokens — per-operator attribution, secondary operators for teammates/agents (the MCP setup mints a dedicated non-rotating mcp-agent token), rotate/revoke lifecycle, threat model.

Evidence & tamper-evidence

• Audit Trail — SHA-256 event chain + hourly OpenTimestamps anchoring + full re-walk verify (with wall-vs-monotonic clock-anomaly detection) + .ots bundle export.
• Event Schema — standard agent_type values and data keys (Ghostwriter-compatible).

SSH / VPS engagement

• SSH & Session Replay — how RedLog handles jumping to a remote host: interactive-ssh pivot detection, full-session replay from the .cast file, per-command replay drawer.
• VPS Deployment — deploy the shell hook to a remote box via hooks/vps-deploy.sh + reverse-tunnel so remote commands land in the local chain.

Privacy

• Hook Privacy — the two gates the Claude Code hook checks before logging (recording state + cwd exclusion list), managed from Settings ▸ 整合.

Agent skills

• redlog-pentest skill — drop-in Claude Code skill. Copy to ~/.claude/skills/.

Project ops

• Releasing — two-phase cross-platform release via GitHub Actions.
• Release Checklist — the QA passes every tag must run through before push.
• FAQ — common issues: hook not logging, chain verify BROKEN, drift alerts.
• codex-tools.json — OpenAI function-calling schema.

---

This wiki mirrors docs/ in the repo.