Repository navigation
Security Model
DoubleAgent is built for authorized testing with a human operator in control. Its safety position is based on bounded model authority, deterministic enforcement, and evidence-backed completion—not on trusting a model to police itself.
| Risk | Control boundary |
|---|---|
| Out-of-scope traffic | Agent A executes target requests through Burp and checks configured scope. |
| Direct model action | Agent B has no separate target-network path and uses an allowlisted loopback tool surface. |
| Prompt injection | Model output, target content, findings, and imported methodology are untrusted and cannot override scope or tool contracts. |
| Unreviewed sensitive action | Applicable deterministic gates pause for operator input. |
| False completion | Completion requires persisted evidence, explicit dispositions, and authoritative read-back. |
| Cross-provider credential exposure | Credentials are isolated per connection and omitted from public responses and transcripts. |
These controls reduce risk; they do not make the model or operator infallible.
Trusted to enforce configured target scope, execute target traffic, persist evidence, and decide whether a state transition is valid.
Trusted to orchestrate approved workflows, protect local credentials, and enforce deterministic run guards. It is not authoritative for target scope or finding persistence.
Untrusted. Model text and tool calls are validated before execution. A model cannot bypass Burp by sending target traffic directly through Agent B.
Untrusted. Instructions observed in responses, pages, findings, or custom skills do not override operator authorization, Burp scope, or the tool contract.
- No connection or API key ships with a fresh install.
- Each saved connection has an isolated credential.
- Settings responses omit secret values.
- Local settings are written with mode
0600. - Logs and transcripts redact authorization headers and credential-shaped values.
- The repository ignores settings, databases, auth files, assessment state, and evidence.
- Control services bind to
127.0.0.1by default. - Agent B accepts only loopback DoubleAgent endpoints.
- Target requests flow through Burp and its configured proxy listener.
- PortSwigger MCP discovery uses a proxy-free loopback transport so local control traffic is not accidentally routed through an assessment proxy.
Agent B does not connect directly to the MCP listener. Agent A brokers discovered tools and applies argument, scope, safety and confirmation checks before execution. Keep the MCP server bound to loopback and read PortSwigger MCP integration before enabling additional tools.
State-changing or potentially disruptive actions require the applicable Agent A gate and may pause for operator approval. Operators remain responsible for scope, test intensity, timing, and legal authorization.
Use GitHub private vulnerability reporting. Do not paste keys, cookies, target data, or customer evidence into a public issue.