Skip to content

Project Settings Registry

Jump to bottom
Samuele Giampieri edited this page Sep 17, 2026 · 8 revisions

📖 Canonical version: read this page on the official docs site — https://www.redamon.org/docs/project-settings-registry. The GitHub wiki is a mirror.

Project Settings Registry

Every configurable parameter of a RedAmon project, with what it means, what it accepts and whether an external agent may write it. GENERATED from recon_settings/registry.yaml; a test fails the build when this page and the registry disagree, so it cannot go stale.

There are 714 parameters. 648 are settable over the MCP surface at any time, 19 are fixed when a project is created, and 47 are not pipeline parameters at all. 14 of the settable ones are the engagement's LIMITS - a rate ceiling, an exclusion list, a time window, the agent's denylists - which the form and the MCP surface reach alike and which the pipeline enforces at scan start whatever tuning says.

For the narrative version with screenshots, see Project Settings Reference.

How to read this

  • Accepts is the ENFORCED bound, not a suggestion. A value outside it is refused by name rather than clamped, and one bad key refuses a whole batch.
  • Written vs resolved. Several values are corrected at scan start rather than refused: a rate above the engagement ceiling comes down to the ceiling, a container image outside the shipped set is pinned back to the default, and a wordlist path outside the project directory is dropped. Each is logged with a [guardrail] line.
  • Zero is not always the slowest value. Several rate fields treat 0 as UNLIMITED, which makes it the most aggressive setting available. Those say so.
  • Two levels. scanModules decides which PHASES run; a per-tool *Enabled flag decides which tools run inside a phase. Setting one without the other is a silent no-op.
  • One capability surface. Every settable field has an input in the project form and is writable through update_recon_settings; neither door reaches something the other cannot. The exception is the engagement RECORD, which is deliberately UI-only.

Contents

Agent

standalone · active traffic at the target

Field Accepts Default MCP Meaning
agentActivatePostExplPhase true / false true settable Whether the post-exploitation phase is available to the agent at all.
agentBindPortOnTarget 1–65535 count — settable Leave empty if unsure (agent will ask)
agentBruteForceMaxWordlistAttempts 0–1000 count 3 settable The attempt ceiling for one credential attack, which is what keeps it from running a whole wordlist against a live account.
agentBruteforceSpeed 0–10 count 5 settable How aggressively the agent's credential attacks run, which trades attempts per second against lockout risk.
agentChiselTunnelEnabled true / false false settable Whether the agent may stand up a chisel tunnel, which gives it network reach beyond its own container.
agentCreateGraphImageOnInit true / false false settable Renders a picture of the graph when a session starts, so the agent begins with a view of the estate.
agentCypherMaxRetries 0–10 count 3 settable How many times agent retries a failed request before giving up on it.
agentExecutionTraceMemorySteps 1–10000 count 100 settable Past steps kept in context
agentExplSystemPrompt free_text (empty) settable Injected during the exploitation phase. Leave empty for default.
agentGuardrailEnabled true / false true settable The agent's own scope guardrail, which refuses a tool call aimed outside the project's targets.
agentInformationalSystemPrompt free_text (empty) settable Injected during the informational phase. Leave empty for default.
agentKaliInstallAllowedPackages free_text (empty) settable Comma-separated whitelist. If non-empty, ONLY these packages can be installed.
agentKaliInstallEnabled true / false false settable Whether the agent may install additional packages inside its Kali sandbox.
agentKaliInstallForbiddenPackages free_text (empty) settable Comma-separated blacklist. These packages must NEVER be installed.
agentLatsBranching 2–10 count 6 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsEnabled true / false false settable Whether agent runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
agentLatsMaxDepth 2–10 depth 6 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsMaxRollouts 4–300 count 50 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsMaxTreeNodes 10–1000 count 120 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsMinHypotheses 2–4 count 2 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsPhaseExploitation true / false true settable Whether the LATS search runs during the exploitation phase as well as reconnaissance.
agentLatsPhasePostExpl true / false false settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsPruneFloor 0–1 ratio 0.15 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLatsShadowMode true / false false settable Runs the LATS search without acting on its choices, so its behaviour can be observed before it is trusted.
agentLatsUctC 0–10 ratio 1.4 settable Part of the agent's LATS search configuration, which is how it explores several candidate actions before committing to one.
agentLhost free_text (empty) settable Your host machine's LAN IP that the target can reach (not the container's 172.x address). Leave empty for bind mode.
agentLlmParseMaxRetries 0–20 count 3 settable How many times agent retries a failed request before giving up on it.
agentLogBackupCount 0–100 count 5 settable Rotated backups to keep
agentLogMaxMb 1–1024 count 10 settable The size at which the agent's log file rolls, in megabytes.
agentLport 1–65535 port — settable Leave empty for bind mode
agentMaxIterations 1–1000 count 100 settable LLM reasoning iterations limit
agentNgrokTunnelEnabled true / false false settable Whether the agent may expose a local listener through ngrok, which makes it reachable from the public internet.
agentOpenaiModel free_text claude-opus-4-6 settable Model used by the agent. Configure providers in Global Settings.
agentPayloadUseHttps true / false false settable Whether a generated payload calls back over HTTPS rather than plain HTTP.
agentPlanMaxParallelTools 1–50 count 10 settable Concurrent tools per plan wave (root + fireteam); extras queue
agentPostExplPhaseType free_text statefull settable Stateful keeps Meterpreter/shell sessions between turns
agentPostExplSystemPrompt free_text (empty) settable Injected during the post-exploitation phase. Leave empty for default.
agentRequireApprovalForExploitation true / false true settable Whether the agent must be approved before it moves from reconnaissance into exploitation.
agentRequireApprovalForPostExploitation true / false true settable Whether the agent must be approved before it acts on a host it has already compromised.
agentRequireToolConfirmation true / false true settable Whether every agent tool call waits for a human to approve it.
agentToolOutputMaxChars 1000–100000 count 40000 settable Truncation limit for tool output
agentToolPhaseMap json_object {"query_graph":["informational","exploitation","post_exploitation"],"proxy_brain settable Per-project overrides for which engagement phase each agent tool belongs to.
attackSkillConfig json_object {"builtIn":{"cve_exploit":true,"brute_force_credential_guess":true,"phishing_soc settable Per-project enable state for the built-in attack skills. Rewritten across every project when a user deletes one of their own skills.
triageReviewBudget 0–10000 count 150 settable How many findings one triage job may review before it stops and reports what it got through.

AI attack-surface recon

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
aiSurfaceReconCacheEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconChatShapeProbeEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconJuliusProbePackEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconLatencyBaselineEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconMaxWorkers 1–500 threads 5 settable How many AI attack-surface recon operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 2.
aiSurfaceReconMcpHandshakeEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconMcpListToolsEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
aiSurfaceReconMcpYaraEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconModelListEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconOpenapiDiscoveryEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
aiSurfaceReconProbePackVersion free_text latest settable Pinned probe-pack identifier recorded on every annotation (default "latest").
aiSurfaceReconTimeout 1–86400 seconds 10 settable How long AI attack-surface recon may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
aiSurfaceReconUserAgent free_text RedAmon-AISurfaceRecon/1.0 settable User-Agent sent on every probe.
aiSurfaceReconVectorDbReadEnabled true / false true settable Whether AI attack-surface recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.

AlienVault OTX

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
otxEnabled true / false true settable Whether otx runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
otxWorkers 1–20 threads 5 settable How many otx operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

Amass

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
amassActive true / false false settable Amass active probing mode In stealth mode this is forced to false.
amassBrute true / false false settable Amass DNS brute-force In stealth mode this is forced to false.
amassBruteWordlists json_object ["default"] settable Wordlists amass brute-forces with. Only the shipped list names are accepted.
amassDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest caffix/amass:latest settable The container image spawned for amass. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
amassEnabled true / false false settable Whether amass runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
amassMaxResults 1–50000 count 50000 settable Maximum subdomains taken from an amass run. In stealth mode this is lowered to at most 100; a quieter value is kept.
amassTimeout 1–120 minutes 10 settable How long amass may run, in MINUTES rather than seconds. The name reads like every other timeout in the model and the unit does not match it.

Arjun

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
arjunChunkSize 10–5000 count 500 settable Parameters tested per request batch. Lower = more requests, higher accuracy
arjunCustomHeaders http_header (empty) settable Add auth tokens or custom headers for authenticated parameter testing
arjunDisableRedirects true / false false settable Disable following redirects
arjunEnabled true / false true settable Whether arjun runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
arjunMaxEndpoints 1–50000 count 50000 settable The most results arjun accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
arjunMethods free_text ["GET","POST"] settable HTTP methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
arjunPassive true / false false settable Passive mode (no requests) In stealth mode this is forced to true.
arjunRateLimit 0–100000 rps 0 settable Requests per second arjun sends while probing for parameters. ZERO MEANS UNLIMITED, so 0 is the most aggressive value available and not the safest. Under an engagement ceiling a 0 here is rewritten to the ceiling at scan start. 0 means UNLIMITED here, so it is the fastest value and not the safest. Capped to the engagement rate ceiling at scan start.
arjunScanTimeout 60–86400 seconds 600 settable How long arjun may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
arjunStable true / false false settable Stability mode (slower but more reliable)
arjunThreads 1–20 threads 2 settable How many arjun operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
arjunTimeout 1–86400 seconds 15 settable How long arjun may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

BadDNS

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
baddnsDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest redamon-baddns:latest settable The container image spawned for baddns. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
baddnsEnabled true / false false settable Whether baddns runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
baddnsModules free_text ["cname","ns","mx","txt","spf"] settable Subset of BadDNS modules to run. Valid: cname, ns, mx, txt, spf, dmarc, wildcard, nsec, references, zonetransfer. (MTA-STS exists in baddns 2.1.0 but is not CLI-addressable due to an upstream validator regex bug -- omit.) Default: ["cname","ns","mx","txt","spf"]
baddnsNameservers free_text (empty) settable Optional custom DNS resolvers (e.g. ["1.1.1.1","8.8.8.8"]). Empty = system resolvers.
baddnsRunTimeout 1–86400 seconds 1800 settable How long baddns may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Banner grab

phase port_scan · active traffic at the target

Field Accepts Default MCP Meaning
bannerGrabEnabled true / false true settable Whether Banner grab runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
bannerGrabMaxLength 100–5000 bytes 1000 settable Truncate banners longer than this (chars)
bannerGrabThreads 1–500 threads 20 settable How many Banner grab operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
bannerGrabTimeout 1–86400 seconds 5 settable How long Banner grab may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Capture proxy

standalone · active traffic at the target

Field Accepts Default MCP Meaning
captureProxyEnabled true / false false settable Whether the HTTP capture proxy records the scan's traffic. Capture runs off the scan's critical path, so a capture failure never fails the scan.

Censys

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
censysEnabled true / false false settable Whether censys runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
censysWorkers 1–20 threads 5 settable How many censys operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

CriminalIP

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
criminalIpEnabled true / false false settable Whether CriminalIP runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
criminalIpWorkers 1–20 threads 5 settable How many CriminalIP operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

crt.sh

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
crtshEnabled true / false true settable Whether crtsh runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
crtshMaxResults 1–50000 count 5000 settable Maximum certificate-transparency records read from crt.sh in one pass. In stealth mode this is lowered to at most 100; a quieter value is kept.

CVE lookup

phase vuln_scan · passive traffic

Field Accepts Default MCP Meaning
cveLookupEnabled true / false true settable Whether CVE lookup runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
cveLookupMaxCves 1–100 count 20 settable Maximum CVEs attached to one service before enrichment stops adding more.
cveLookupMinCvss 0–10 ratio 0 settable Minimum CVSS score (0-10)
cveLookupSource free_text nvd settable Which vulnerability database CVE enrichment queries.

CypherFix

standalone · sends no traffic

Field Accepts Default MCP Meaning
cypherfixBranchPrefix free_text cypherfix/ settable Prefix for fix branch names (e.g., cypherfix/rem-abc123).
cypherfixDefaultBranch free_text main settable Base branch for creating fix branches (default: main).
cypherfixDefaultRepo free_text (empty) settable GitHub repository to fix (owner/repo format). Can be overridden per remediation.
cypherfixGithubToken free_text (empty) closed Personal access token with Withheld from every read on the MCP surface.
cypherfixLlmModel free_text (empty) settable Override the LLM model for CypherFix agents, including the Priority Board pass that explains and groups the top-ranked findings. Leave empty to use the model selected in Agent Behaviour.
cypherfixRequireApproval true / false true settable Whether a CypherFix patch must be approved by a human before it is pushed.

Denial of service

standalone · active traffic at the target

Field Accepts Default MCP Meaning
dosAssessmentOnly true / false false settable Only check for availability vulnerabilities (nmap scripts, nuclei) without active testing.
dosConcurrentConnections 10–10000 threads 1000 settable How many dos operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
dosMaxAttempts 1–10 count 3 settable Max different vectors to try before reporting service is resilient.
dosMaxDuration 10–300 seconds 60 settable The longest one denial-of-service attempt may run, in seconds. It is only reachable at all when roeAllowDos permits the technique.

DNS

phase domain_discovery · active traffic at the target

Field Accepts Default MCP Meaning
dnsEnabled true / false true settable Whether dns runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
dnsMaxRetries 1–10 count 3 settable How many times dns retries a failed request before giving up on it.
dnsMaxWorkers 1–200 threads 80 settable How many dns operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 5.
dnsRecordParallelism true / false true settable How many dns operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to false.

Domain recon AI hints

phase domain_discovery · sends no traffic

Field Accepts Default MCP Meaning
domainReconAiNsHintEnabled true / false true settable Whether Domain recon AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
domainReconAiTxtHintEnabled true / false true settable Whether Domain recon AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Engagement

standalone · sends no traffic

Field Accepts Default MCP Meaning
engagementIdentityHeader http_header (empty) settable A header every request carries so the target's operators can attribute the traffic to this engagement, for example 'X-Bug-Bounty: your-handle'. Empty sends none. Many programs require one, and it is the difference between a scan that gets a question and one that gets a block. Validated like any other header: no CR or LF, and not Host, Authorization, Cookie or Proxy-*.
engagementKind internal, third_party internal create-only Who the target belongs to, and therefore what has to be true before a scan may start. 'internal' is your own estate. 'third_party' is somebody else's, and such a project MUST carry a non-zero rate ceiling and an authorization record or start_recon refuses it. Set at creation and immutable afterwards: converting a project after the fact would either claim an authority nobody granted or drop a ceiling a human put there. Every project created before this field existed reads as 'internal', so an old project with no ceiling is flagged rather than blocked. Fixed at project creation; refused on an existing project.

ffuf

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
ffufAiExtensions true / false false settable When true, FFuf file extensions are picked per-target by AI from response headers (requires aiInPipeline=true). The static ffufExtensions list is ignored.
ffufAutoCalibrate true / false true settable Learns what a 'not found' response looks like on this target before filtering, which removes most soft-404 noise.
ffufCustomHeaders http_header (empty) settable One header per line. Sent with every request
ffufEnabled true / false false settable Whether ffuf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
ffufExtensions free_text (empty) settable File extensions to fuzz, e.g. [".php", ".asp"]
ffufFilterCodes status_codes (empty) settable HTTP status codes to filter out
ffufFilterSize free_text (empty) settable Filter responses by size
ffufFollowRedirects true / false false settable Follows a redirect rather than recording it, which can turn one request into several.
ffufMatchCodes status_codes [200,201,204,301,302,307,308,401,403,405] settable HTTP status codes to match, e.g. [200, 301, 403]
ffufMaxTime 60–86400 seconds 1800 settable Max total time in seconds
ffufParallelism 1–50 threads 20 settable How many ffuf operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
ffufRate 0–100000 rps 0 settable Requests per second ffuf sends. ZERO MEANS UNLIMITED, so 0 is the most aggressive value available and not the safest, and it is also the shipped default. Under an engagement ceiling a 0 here is rewritten to the ceiling at scan start. 0 means UNLIMITED here, so it is the fastest value and not the safest. Capped to the engagement rate ceiling at scan start.
ffufRecursion true / false false settable Follows a discovered directory down into its own contents, which multiplies the request count.
ffufRecursionDepth 1–5 depth 2 settable How many directories deep recursion goes before it stops.
ffufSmartFuzz true / false true settable Picks extensions and wordlist entries from what the target has already revealed rather than fuzzing blind.
ffufThreads 1–200 threads 40 settable How many ffuf operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
ffufTimeout 1–86400 seconds 10 settable How long ffuf may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
ffufWordlist project_file /usr/share/seclists/Discovery/Web-Content/common.txt settable Path to wordlist file

Fireteam

standalone · active traffic at the target

Field Accepts Default MCP Meaning
fireteamAllowedPhases free_text ["informational","exploitation","post_exploitation"] settable Engagement phases in which the fireteam may operate.
fireteamConfirmationTimeoutSec 0–86400 count 600 settable How long a fireteam member waits for confirmation before giving up on a step.
fireteamEnabled true / false true settable Whether the agent may split work across a fireteam of sub-agents.
fireteamMaxConcurrent 1–8 count 5 settable 1-8. Upper limit on members in-flight at once.
fireteamMaxMembers 2–8 count 5 settable 2-8. Hard cap on fireteam size the LLM can request.
fireteamMemberMaxIterations 5–50 count 10 settable 5-50. Each member's ReAct budget before it exits.
fireteamPropensity 0–10 count 3 settable How strongly the agent leans toward deploying a fireteam over single-agent or plan_tools. Injected into the system prompt as a directive the LLM must follow.
fireteamTimeoutSec 60–7200 count 3600 settable 60-7200. Hard wall-clock ceiling for the whole fireteam.

FOFA

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
fofaEnabled true / false false settable Whether fofa runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
fofaMaxResults 1–10000 count 1000 settable The most results fofa accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here. An empty value is replaced by the default rather than honoured.
fofaWorkers 1–20 threads 5 settable How many fofa operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

gau

phase resource_enum · passive traffic

Field Accepts Default MCP Meaning
gauBlacklistExtensions free_text (empty) settable File extensions to skip, e.g. [".jpg", ".css"]
gauDetectMethods true / false true settable Detect allowed HTTP methods
gauDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest sxcurity/gau:latest settable The container image spawned for gau. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
gauEnabled true / false false settable Whether gau runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to true.
gauFilterDeadEndpoints true / false true settable Drops archived URLs that no longer respond, so the result reflects the live surface.
gauMaxUrls 1–100000 count 50000 settable The most results gau accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
gauMethodDetectRateLimit 1–100000 rps 50 settable Requests per second the gau method-detection pass sends to the target. Active traffic despite gau's passive reputation, so the engagement ceiling caps it. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 2.
gauMethodDetectThreads 1–500 threads 25 settable How many gau operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
gauMethodDetectTimeout 1–86400 seconds 5 settable How long gau may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
gauProviders free_text ["wayback","commoncrawl","otx","urlscan"] settable Sources: "wayback", "commoncrawl", "otx", "urlscan"
gauThreads 1–20 threads 5 settable How many gau operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
gauTimeout 10–86400 seconds 60 settable How long gau may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
gauVerbose true / false false settable Emits per-URL progress, which is useful while debugging and noisy otherwise.
gauVerifyAcceptStatus status_codes [200,201,301,302,307,308,401,403] settable Status codes that indicate a live URL. Include 401/403 for auth-protected endpoints
gauVerifyDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/httpx:latest settable The container image spawned for gau. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
gauVerifyRateLimit 1–100000 rps 100 settable Requests per second the gau verification pass sends. gau itself only reads public archives, but verification dials the target, so this is active traffic and the engagement ceiling caps it. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 2.
gauVerifyThreads 1–100 threads 50 settable How many gau operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
gauVerifyTimeout 1–86400 seconds 5 settable How long gau may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
gauVerifyUrls true / false true settable Verify discovered URLs are alive
gauWorkers 1–20 threads 10 settable How many gau operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
gauYearRange free_text (empty) settable Filter Wayback Machine by year (e.g., 2020, 2024)

GitHub secret hunt

standalone · passive traffic

Field Accepts Default MCP Meaning
githubMaxCommits 1–1000 count 100 settable The most results github accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
githubOutputJson true / false true settable Emits machine-readable output alongside the human-readable report.
githubScanCommits true / false true settable Walks commit history as well as the working tree, which is where most leaked secrets actually live.
githubScanGists true / false true settable Includes the organisation members' public gists in the hunt.
githubScanMembers true / false false settable Includes the organisation members' own repositories in the hunt.
githubTargetOrg free_text (empty) create-only The GitHub organisation the secret hunt scans. It points a scanner at someone else's assets, so it is scope by another name: settable when the project is created and immutable afterwards. Fixed at project creation; refused on an existing project.
githubTargetRepos free_text (empty) create-only Comma-separated list. Leave empty to scan all repositories. Fixed at project creation; refused on an existing project.

GraphQL Cop

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
graphqlCopDebug true / false false settable -d flag: adds X-GraphQL-Cop-Test header per request
graphqlCopDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest dolevf/graphql-cop:1.14 settable The container image spawned for GraphQL Cop. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
graphqlCopEnabled true / false false settable Whether GraphQL Cop runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
graphqlCopForceScan true / false false settable -f flag: scan even if endpoint doesn't look GraphQL-like
graphqlCopTestAliasOverloading true / false true settable HIGH DoS, 101-alias rate-limit bypass (default true, disabled in stealth) In stealth mode this is forced to false.
graphqlCopTestBatchQuery true / false true settable HIGH DoS, array-based batch queries (default true, disabled in stealth) In stealth mode this is forced to false.
graphqlCopTestCircularIntrospection true / false true settable HIGH DoS, deep nested introspection (default true, disabled in stealth) In stealth mode this is forced to false.
graphqlCopTestDirectiveOverloading true / false true settable HIGH DoS (default true, disabled in stealth) In stealth mode this is forced to false.
graphqlCopTestFieldSuggestions true / false true settable LOW info-leak check (default true)
graphqlCopTestGetMethod true / false true settable MEDIUM CSRF, GET-method queries allowed (default true)
graphqlCopTestGetMutation true / false true settable MEDIUM CSRF, GET-based mutations (default true)
graphqlCopTestGraphiql true / false true settable LOW info-leak, detects GraphiQL/Playground UI (default true)
graphqlCopTestIntrospection true / false false settable HIGH info-leak check (default false, dedupes with native scanner)
graphqlCopTestPostCsrf true / false true settable MEDIUM CSRF, url-encoded POST (default true)
graphqlCopTestTraceMode true / false true settable INFO, Apollo tracing extension disclosure (default true)
graphqlCopTestUnhandledError true / false true settable INFO info-leak, exception stack traces (default true)
graphqlCopTimeout 10–600 seconds 120 settable How long GraphQL Cop may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

GraphQL security

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
graphqlAuthHeader free_text (empty) settable Header name when graphqlAuthType = "custom"
graphqlAuthType free_text (empty) settable "", "bearer", "basic", "cookie", "custom"
graphqlAuthValue free_text (empty) settable Auth credential (token / user:pass / cookie string) Withheld from every read on the MCP surface.
graphqlConcurrency 1–20 threads 5 settable How many graphql operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
graphqlDepthLimit 1–50 depth 10 settable Max introspection query nesting depth (default 10)
graphqlEndpoints free_text (empty) settable Comma-separated custom GraphQL endpoints (empty = auto-discover)
graphqlIntrospectionTest true / false true settable Probe __schema to detect exposed introspection (default true) In stealth mode this is forced to true.
graphqlRateLimit 0–100 rps 10 settable Requests per second graphql sends. Capped to the engagement ceiling at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 2.
graphqlRetryBackoff 0–60 ratio 2 settable Exponential backoff base seconds between retries (default 2.0)
graphqlRetryCount 0–10 count 3 settable How many times graphql retries a failed request before giving up on it.
graphqlSecurityEnabled true / false false settable Whether graphql runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to true.
graphqlTimeout 1–600 seconds 30 settable How long graphql may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan. In stealth mode this is forced to 60.
graphqlVerifySsl true / false true settable Reject invalid / self-signed TLS certs (default true)

GVM vulnerability scan

standalone · active traffic at the target

Field Accepts Default MCP Meaning
gvmCleanupAfterScan true / false true settable Removes the GVM task and its target after the scan, which keeps the appliance from accumulating state.
gvmPollInterval 5–300 count 30 settable Seconds between scan status checks. Lower values give faster log updates.
gvmPortList free_text All TCP and Nmap top 100 UDP settable Which ports GVM probes on every target. The full IANA UDP range is the single biggest driver of scan time: closed UDP ports answer with silence and must each be timed out, and GVM reports no progress percentage until that finishes.
gvmScanConfig free_text Full and fast settable GVM scan configuration preset. “Full and fast” is recommended for most targets.
gvmScanTargets free_text both create-only Which targets from recon data to scan. “Both” provides the most thorough coverage. Fixed at project creation; refused on an existing project.
gvmTaskTimeout 0–86400 seconds 14400 settable How long gvm may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

HackerTarget

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
hackerTargetEnabled true / false true settable Whether hackertarget runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
hackerTargetMaxResults 1–50000 count 5000 settable Maximum subdomains taken from the HackerTarget API in one pass. In stealth mode this is lowered to at most 100; a quieter value is kept.

hakrawler

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
hakrawlerCustomHeaders http_header (empty) settable One header per line (e.g., Cookie: value). Sent with every request
hakrawlerDepth 1–10 depth 2 settable How many links deep to follow
hakrawlerDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest jauderho/hakrawler:latest settable The container image spawned for hakrawler. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
hakrawlerEnabled true / false true settable Whether hakrawler runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
hakrawlerIncludeSubs true / false true settable Follows links onto subdomains of the target rather than staying on one host.
hakrawlerInsecure true / false true settable Skip TLS verification
hakrawlerMaxUrls 1–100000 count 50000 settable The most results hakrawler accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
hakrawlerParallelism 1–10 threads 5 settable How many hakrawler operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
hakrawlerThreads 1–20 threads 5 settable How many hakrawler operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. Capped to the engagement rate ceiling at scan start.
hakrawlerTimeout 5–86400 seconds 30 settable How long hakrawler may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

HTTP probe AI hints

phase http_probe · sends no traffic

Field Accepts Default MCP Meaning
httpProbeAiFaviconHashEnabled true / false true settable Whether HTTP probe AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
httpProbeAiHeaderScanEnabled true / false true settable Whether HTTP probe AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
httpProbeAiTitleDetectionEnabled true / false true settable Whether HTTP probe AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
httpProbeAiWappalyzerEnabled true / false true settable Whether HTTP probe AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

httpx

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
httpxCustomHeaders http_header (empty) settable Extra headers sent with every httpx request. Validated: a header may not contain CR or LF, and Host, Authorization, Cookie and Proxy-* are refused, because each would change where the request goes or what it carries rather than annotating it.
httpxDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/httpx:latest settable The container image spawned for httpx. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
httpxEnabled true / false true settable Whether httpx runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
httpxFilterCodes status_codes (empty) settable Hide responses with these status codes
httpxFollowRedirects true / false true settable Follows a redirect to its destination rather than recording the redirect itself.
httpxIncludeResponse true / false true settable Store full response body
httpxIncludeResponseHeaders true / false true settable Records the full response headers, which later checks read and which make the output much larger.
httpxMatchCodes status_codes (empty) settable Only show responses with these status codes
httpxMaxRedirects 1–50 count 10 settable Maximum redirect chain depth to prevent loops
httpxPaths free_text (empty) settable Additional URL paths to probe
httpxProbeAsn true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeCdn true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeCname true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeContentLength true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeContentType true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeFavicon true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is. In stealth mode this is forced to false.
httpxProbeHash free_text sha256 settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeIp true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeJarm true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is. In stealth mode this is forced to false.
httpxProbeLineCount true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeResponseTime true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeServer true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeStatusCode true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeTechDetect true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeTitle true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeTlsGrab true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeTlsInfo true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxProbeWordCount true / false true settable Whether httpx records this attribute while probing. Each probe adds work per host, and several add requests beyond the first, so the set of probes decides both how much the scan learns and how loud it is.
httpxRateLimit 1–100000 rps 50 settable Requests per second httpx sends while probing. Capped by the engagement ceiling at scan start. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 2.
httpxRetries 0–10 count 2 settable How many times httpx retries a failed request before giving up on it.
httpxThreads 1–200 threads 50 settable How many httpx operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
httpxTimeout 1–86400 seconds 10 settable How long httpx may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Hydra

standalone · active traffic at the target

Field Accepts Default MCP Meaning
hydraConnectionTimeout 5–120 seconds 32 settable How long hydra may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
hydraEnabled true / false true settable Whether hydra runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
hydraExtraChecks free_text nsr settable Additional protocol-specific checks run alongside the credential attempts.
hydraMaxWordlistAttempts 1–10 count 3 settable How many wordlist strategies to try before giving up.
hydraStopOnFirstFound true / false true settable Stop immediately when valid credentials are found.
hydraThreads 1–64 threads 16 settable How many hydra operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
hydraVerbose true / false true settable Show each login attempt in output for progress tracking.
hydraWaitBetweenConnections 0–300 threads 0 settable How many hydra operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.

JS recon

phase js_recon · active traffic at the target

Field Accepts Default MCP Meaning
jsReconAiSdkDetectionEnabled true / false true settable Whether JS recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
jsReconConcurrency 1–30 threads 10 settable How many JS recon operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
jsReconCustomEndpointKeywords free_text (empty) closed The uploaded custom endpoint-keyword list. Written only by the custom-files endpoint.
jsReconCustomFrameworks free_text (empty) closed The uploaded custom framework-signature list. Written only by the custom-files endpoint.
jsReconCustomPackages free_text (empty) closed The uploaded custom package list. Written only by the custom-files endpoint.
jsReconCustomPatterns free_text (empty) closed The uploaded custom secret-pattern file. Written only by the custom-files endpoint, which also places it on disk.
jsReconCustomSourcemapPaths free_text (empty) closed The uploaded custom source-map path list. Written only by the custom-files endpoint.
jsReconDependencyCheck true / false true settable Checks the packages a bundle names against known-vulnerable versions.
jsReconDevComments true / false true settable Extract developer comments
jsReconDomSinks true / false true settable Detect DOM XSS sinks
jsReconEnabled true / false false settable Whether JS recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
jsReconEndpointAcceptStatus status_codes [200,201,204,301,302,307,308,401,403,405] settable HTTP status codes treated as live during endpoint verification An empty value is replaced by the default rather than honoured.
jsReconEndpointConcurrency 1–20 threads 10 settable How many JS recon operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
jsReconEndpointCustomHeaders http_header (empty) settable Header lines used when verifying extracted endpoints
jsReconExtractEndpoints true / false true settable Extracts API endpoints referenced in JavaScript, which is the main reason to read it at all.
jsReconFrameworkDetect true / false true settable Identifies the framework a bundle was built with, which decides which later checks apply.
jsReconIncludeArchivedJs true / false true settable Includes JavaScript recovered from web archives, which can reveal endpoints the live site no longer exposes.
jsReconIncludeChunks true / false true settable Includes lazily-loaded chunks, which multiplies the file count on a modern bundler's output. In stealth mode this is forced to false.
jsReconIncludeFrameworkJs true / false true settable Includes framework bundles, which are large, mostly third-party, and occasionally where a key is embedded. In stealth mode this is forced to false.
jsReconMaxFiles 10–10000 count 10000 settable The most results JS recon accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here. In stealth mode this is forced to 50.
jsReconMinConfidence free_text low settable "low", "medium", "high"
jsReconRegexPatterns true / false true settable Additional regular expressions applied to retrieved JavaScript, on top of the shipped set.
jsReconSourceMaps true / false true settable Retrieves source maps when they are published, which recovers the original source rather than the bundle.
jsReconStandaloneCrawlDepth 0–50 depth 3 settable How many links deep a standalone JS recon run crawls from its seed.
jsReconStandaloneCrawlScope free_text subdomain settable How far a standalone JS recon run may crawl from its seed: same host, same domain, or anywhere.
jsReconTimeout 60–86400 seconds 900 settable How long JS recon may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
jsReconUploadedFiles free_text (empty) closed JavaScript files uploaded for analysis rather than fetched from the target. Written only by the upload endpoint, which also places each file on disk.
jsReconValidateEndpoints true / false false settable Probe extracted endpoints and drop confirmed-dead ones before graph ingestion (default off)
jsReconValidateKeys true / false true settable Validate discovered API keys In stealth mode this is forced to false.
jsReconValidationTimeout 1–30 seconds 5 settable How long JS recon may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

jsluice

phase js_recon · active traffic at the target

Field Accepts Default MCP Meaning
jsluiceConcurrency 1–20 threads 5 settable How many jsluice operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
jsluiceEnabled true / false true settable Whether jsluice runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
jsluiceExcludePatterns free_text (empty) settable Deny-list patterns. Extensions like ".js" match the path suffix only; everything else is a substring match against the URL path and query. An empty value is replaced by the default rather than honoured.
jsluiceExtractSecrets true / false true settable Whether jsluice reports secret-shaped strings it finds in JavaScript. A feature toggle, not a credential: it decides what the tool looks for, and any secret found belongs to the target.
jsluiceExtractUrls true / false true settable Extracts URLs jsluice finds in JavaScript.
jsluiceMaxFiles 1–10000 count 10000 settable The most results jsluice accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here. In stealth mode this is forced to 20.
jsluiceParallelism 1–10 threads 5 settable How many jsluice operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
jsluiceTimeout 30–86400 seconds 300 settable How long jsluice may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
jsluiceVerifyAcceptStatus status_codes [200,201,301,302,307,308,401,403] settable HTTP status codes treated as "live" by the verifier An empty value is replaced by the default rather than honoured.
jsluiceVerifyDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/httpx:latest settable The container image spawned for jsluice. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
jsluiceVerifyRateLimit 1–1000 rps 50 settable Requests per second jsluice sends. Capped to the engagement ceiling at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start.
jsluiceVerifyThreads 1–500 threads 50 settable How many jsluice operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
jsluiceVerifyTimeout 1–60 seconds 5 settable How long jsluice may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
jsluiceVerifyUrls true / false true settable After extraction, run extracted URLs through httpx and a deny-list filter so only live, non-asset URLs reach the graph. Disable to keep all extracted URLs (legacy behavior).

Katana

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
katanaConcurrency 1–50 threads 15 settable How many katana operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
katanaCustomHeaders http_header (empty) settable Custom HTTP headers for crawler
katanaDepth 1–10 depth 2 settable How many links deep the crawl goes from each seed URL. In stealth mode this is forced to 1.
katanaDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/katana:latest settable The container image spawned for katana. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
katanaEnabled true / false true settable Whether katana runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
katanaExcludePatterns free_text (empty) settable Regex patterns to exclude from crawling
katanaJsCrawl true / false true settable Renders JavaScript with a headless browser, which finds routes a static crawl cannot and costs far more per page. In stealth mode this is forced to false.
katanaMaxUrls 1–1000000 count 300000 settable The crawl stops after this many URLs, which is what bounds a crawl on a large site. In stealth mode this is forced to 50.
katanaParallelism 1–50 threads 8 settable How many katana operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
katanaParamsOnly true / false false settable Only extract parameterized URLs
katanaRateLimit 1–100000 rps 50 settable Requests per second katana sends. Capped to the engagement ceiling at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 2.
katanaScope free_text dn settable Scope filter: "dn" (domain), "rdn" (root domain), etc.
katanaTimeout 60–86400 seconds 3600 settable How long katana may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Kiterunner

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
kiterunnerBruteforceMethods free_text ["POST","PUT","DELETE","PATCH"] settable ["GET", "POST", "PUT", "DELETE", "PATCH"]
kiterunnerConnections 1–500 threads 100 settable How many kiterunner operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
kiterunnerDetectMethods true / false true settable Establishes which HTTP methods each discovered route accepts, at the cost of extra requests per route.
kiterunnerEnabled true / false false settable Whether kiterunner runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
kiterunnerHeaders http_header (empty) settable Add auth tokens for authenticated API scanning
kiterunnerIgnoreStatus free_text (empty) settable Blacklist: filter out noise from common errors
kiterunnerMatchStatus free_text [200,201,204,301,302,401,403,405] settable Whitelist: only show endpoints with these status codes (includes auth-protected)
kiterunnerMethodDetectionMode free_text bruteforce settable How kiterunner establishes which HTTP methods a discovered route accepts.
kiterunnerMethodDetectRateLimit 1–100000 rps 50 settable Requests per second the kiterunner method-detection pass sends. Capped by the engagement ceiling at scan start. Capped to the engagement rate ceiling at scan start.
kiterunnerMethodDetectThreads 1–500 threads 25 settable How many kiterunner operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
kiterunnerMethodDetectTimeout 1–86400 seconds 5 settable How long kiterunner may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
kiterunnerMinContentLength 0–100000 count 0 settable Ignore responses smaller than this (bytes)
kiterunnerParallelism 1–5 threads 3 settable How many kiterunner operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
kiterunnerRateLimit 1–100000 rps 100 settable Requests per second kiterunner sends. Capped to the engagement ceiling at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start.
kiterunnerScanTimeout 60–86400 seconds 1000 settable How long kiterunner may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
kiterunnerThreads 1–500 threads 50 settable How many kiterunner operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
kiterunnerTimeout 1–86400 seconds 10 settable How long kiterunner may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
kiterunnerWordlists free_text ["routes-large"] settable Wordlists: "routes-small", "routes-large"

knockpy

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
knockpyReconEnabled true / false true settable Whether knockpy runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
knockpyReconMaxResults 1–50000 count 5000 settable Maximum subdomains taken from a knockpy run. In stealth mode this is lowered to at most 100; a quieter value is kept.

masscan

phase port_scan · active traffic at the target

Field Accepts Default MCP Meaning
masscanAiPortCatalogEnabled true / false true settable Whether masscan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
masscanBanners true / false false settable Whether masscan grabs a service banner as well as recording the open port, which turns a SYN scan into a connecting one.
masscanCustomPorts free_text (empty) settable Overrides Top Ports if set. Use ranges: 8080-8090
masscanEnabled true / false true settable Whether masscan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
masscanExcludeTargets free_text (empty) settable Comma-separated targets to exclude
masscanRate 1–100000 rps 1000 settable Packets per second masscan sends. Masscan is the fastest port scanner here and the one most likely to be noticed; the engagement ceiling caps it at scan start. Capped to the engagement rate ceiling at scan start.
masscanRetries 0–10 count 1 settable How many times masscan retries a failed request before giving up on it.
masscanTopPorts free_text 1000 settable Use “100”, “1000”, or “full” for all 65535 ports
masscanWait 0–86400 seconds 10 settable Wait time in seconds

MITRE ATT&CK enrichment

phase vuln_scan · sends no traffic

Field Accepts Default MCP Meaning
mitreAutoUpdateDb true / false true settable Whether the MITRE dataset is refreshed before enrichment runs.
mitreCacheTtlHours 1–168 count 24 settable Part of MITRE ATT&CK enrichment, which annotates findings with the technique they correspond to. Enrichment reads existing findings and sends no traffic.
mitreEnabled true / false true settable Whether mitre runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
mitreEnrichGvm true / false true settable Attaches MITRE ATT&CK technique references to GVM findings.
mitreEnrichRecon true / false true settable Attaches MITRE ATT&CK technique references to recon findings.
mitreIncludeCapec true / false true settable Includes the CAPEC attack-pattern reference alongside each technique.
mitreIncludeCwe true / false true settable Includes the CWE weakness reference alongside each technique.

naabu

phase port_scan · active traffic at the target

Field Accepts Default MCP Meaning
naabuCustomPorts free_text (empty) settable Custom port list, e.g. "80,443,8080"
naabuDisplayCdn true / false true settable Reports CDN-fronted hosts rather than dropping them silently, so the operator can see what was skipped.
naabuDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/naabu:latest settable The container image spawned for naabu. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
naabuEnabled true / false true settable Whether naabu runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
naabuExcludeCdn true / false false settable Skips hosts that resolve to a CDN, where a port result describes the CDN rather than the target.
naabuPassiveMode true / false false settable Use Shodan InternetDB instead of active scan In stealth mode this is forced to true.
naabuRateLimit 1–100000 rps 1000 settable Packets per second naabu sends, across all hosts combined. The engagement ceiling caps it at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 10.
naabuRetries 0–10 count 1 settable How many times naabu retries a failed request before giving up on it.
naabuScanType free_text s settable "s" (SYN) or "c" (connect) In stealth mode this is forced to "c".
naabuSkipHostDiscovery true / false true settable Skips the ping sweep and scans every listed host directly, which is slower but finds hosts that do not answer ICMP. In stealth mode this is forced to true.
naabuThreads 1–100 threads 25 settable How many naabu operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
naabuTimeout 1000–3600000 milliseconds 10000 settable How long naabu waits for a port to answer, in MILLISECONDS. At the default of 10000 a full sweep of an unresponsive host is slow; below about 1000 a distant host starts reading as closed.
naabuTopPorts free_text 1000 settable Top N ports, e.g. "1000"
naabuVerifyPorts true / false true settable Re-probes each discovered port before reporting it, which removes the false positives a fast SYN scan produces.

Netlas

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
netlasEnabled true / false false settable Whether netlas runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
netlasWorkers 1–20 threads 5 settable How many netlas operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

Nmap

phase port_scan · active traffic at the target

Field Accepts Default MCP Meaning
nmapAiVersionRegexEnabled true / false true settable Whether nmap runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
nmapEnabled true / false true settable Whether nmap runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
nmapHostTimeout 30–86400 seconds 300 settable How long nmap may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
nmapParallelism 1–10 threads 5 settable How many nmap operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.
nmapScriptScan true / false true settable Run NSE vuln scripts In stealth mode this is forced to false.
nmapTimeout 60–86400 seconds 600 settable How long nmap may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
nmapTimingTemplate free_text T3 settable Nmap's timing template, T0 to T5. Higher is faster and noisier; the stealth pass forces T2. Not a wordlist despite once being classified with them. In stealth mode this is forced to "T2".
nmapVersionDetection true / false true settable Detect service versions

Nuclei

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
nucleiAiResponseFilter true / false false settable Use AI to classify Nuclei response bodies as WAF/rate-limit block pages when the static keyword list misses (requires aiInPipeline=true). Augments is_false_positive(); kicks in only on suspicious status codes (403/406/418/429/503) so cost stays bounded. Default false.
nucleiAiTags true / false false settable Use AI to prune the Nuclei tag list based on detected tech stack (requires aiInPipeline=true). Replaces the static nucleiTags list with a tech-aware subset chosen by the LLM at scan time. Default false.
nucleiAutoUpdateTemplates true / false true settable Whether nuclei refreshes its template set before scanning. It fetches from the public template repository, so it is an egress decision as well as a freshness one.
nucleiBulkSize 1–500 threads 25 settable Number of hosts to process in parallel In stealth mode this is forced to 5.
nucleiConcurrency 1–500 threads 25 settable How many nuclei operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 2.
nucleiCustomTemplates project_file (empty) settable Custom template paths
nucleiDastMode true / false false settable Dynamic testing mode In stealth mode this is forced to false.
nucleiDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/nuclei:latest settable The container image spawned for nuclei. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
nucleiEnabled true / false true settable Whether nuclei runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
nucleiExcludeTags free_text ["dos","fuzz"] settable Template tags to exclude, e.g. ["dos", "fuzz"]
nucleiExcludeTemplates free_text (empty) settable Template paths to exclude
nucleiFollowRedirects true / false true settable Follows a redirect while running a template rather than matching on the redirect itself. A template that expects its payload to land on the final page needs this; one matching a redirect header does not.
nucleiHeadless true / false false settable Browser-based testing In stealth mode this is forced to false.
nucleiInteractsh true / false true settable Out-of-band interaction detection In stealth mode this is forced to false.
nucleiMaxRedirects 0–50 count 10 settable Maximum redirect chain to follow
nucleiNewTemplatesOnly true / false false settable Restricts the run to templates added since the last template update, for a fast re-check.
nucleiRateLimit 1–100000 rps 100 settable Requests per second nuclei sends, across all templates and all targets combined rather than per template. Capped by the engagement ceiling at scan start. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 5.
nucleiRetries 0–10 count 1 settable How many times nuclei retries a failed request before giving up on it.
nucleiScanAllIps true / false false settable Scans every IP a host resolves to rather than the first, which matters behind round-robin DNS.
nucleiSelectedCustomTemplates project_file_name (empty) settable Which of this project's uploaded custom templates to run. Each entry is a path a scan container opens, so it is validated against the project's own upload directory.
nucleiSeverity info, low, medium, high, critical, unknown ["critical","high","medium","low"] settable Severity filter: "critical", "high", "medium", "low"
nucleiSystemResolvers true / false true settable Uses the container's own DNS resolvers rather than nuclei's defaults.
nucleiTags free_text ["cve","xss","sqli","rce","lfi","ssrf","xxe","ssti"] settable Template tags to include
nucleiTakeoverRunTimeout 1–86400 seconds 1800 settable How long nuclei may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
nucleiTakeoversEnabled true / false true settable Whether nuclei runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
nucleiTemplates free_text (empty) settable Specific template paths to include
nucleiTimeout 1–86400 seconds 10 settable How long nuclei may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Origin discovery

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
originDiscoveryEnabled true / false false settable Whether Origin discovery runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
originDiscoveryKeyless true / false true settable Non-CDN subdomains + SPF/MX + crt.sh (no key needed)
originDiscoveryMaxCandidates 1–200 count 25 settable The most results Origin discovery accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
originDiscoveryMaxSearchCalls 0–500 count 50 settable Per-scan budget of keyed scanner-search calls
originDiscoveryPassiveDns true / false true settable SecurityTrails + ViewDNS DNS history
originDiscoveryScanners true / false true settable Favicon/cert pivots via Shodan/Censys/FOFA/ZoomEye/OTX/VirusTotal (each uses its own key) In stealth mode this is forced to false.
originDiscoveryThreshold 0–100 percent 60 settable Weighted-similarity confidence (0-100) needed to confirm an origin
originDiscoveryTimeout 1–60 seconds 10 settable How long Origin discovery may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
originDiscoveryWorkers 1–30 threads 10 settable How many Origin discovery operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

OSINT enrichment

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
osintEnrichmentEnabled true / false false settable Whether OSINT enrichment runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

ParamSpider

phase resource_enum · passive traffic

Field Accepts Default MCP Meaning
paramspiderEnabled true / false false settable Whether paramspider runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to true.
paramspiderPlaceholder free_text FUZZ settable Replacement value for parameter values (e.g., FUZZ for fuzzing tools)
paramspiderTimeout 10–86400 seconds 120 settable How long paramspider may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
paramspiderWorkers 1–10 threads 8 settable How many paramspider operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

Path traversal

standalone · active traffic at the target

Field Accepts Default MCP Meaning
pathTraversalArchiveExtractionEnabled true / false false settable Whether Path traversal runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
pathTraversalOobCallbackEnabled true / false true settable Whether Path traversal runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
pathTraversalOobProvider free_text oast.fun settable interactsh-client server. Use a self-hosted instance if oast.fun is blocked. Only used when the OOB callback workflow is enabled.
pathTraversalPayloadReferenceEnabled true / false true settable Whether Path traversal runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
pathTraversalPhpWrappersEnabled true / false true settable Whether Path traversal runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
pathTraversalRequestTimeout 1–120 seconds 10 settable How long Path traversal may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Phishing

standalone · active traffic at the target

Field Accepts Default MCP Meaning
phishingSmtpConfig free_text (empty) settable Free-text SMTP settings injected into the agent prompt for social engineering email delivery. The agent reads this as-is when the social engineering simulation skill is active. Withheld from every read on the MCP surface.

Pipeline

standalone · sends no traffic

Field Accepts Default MCP Meaning
scanModules domain_discovery, port_scan, http_probe, resource_enum, vuln_scan, js_recon ["domain_discovery","port_scan","http_probe","resource_enum","vuln_scan"] settable Pipeline phases to run. Values: "domain_discovery", "port_scan", "http_probe", "resource_enum", "vuln_scan", "js_recon"
stealthMode true / false false settable The engagement's PASSIVE switch. On, every recon tool is forced to its passive, low-noise profile and the noisiest ones are switched off outright (apply_stealth_overrides in recon/project_settings.py, driven by the registry's own stealth profile). This is the setting a rule of engagement means by "passive only", "no active scanning", "observation only" or "do not send probes to the target": it is one switch rather than the dozens of per-tool flags such a rule would otherwise have to name.
updateGraphDb true / false true closed Whether results are stored in the graph database. Off, the scan still runs and still reaches the target, and writes nothing, so every later read reports "nothing found" where the truth is "nothing was written". That is the scanned-and-clean versus never-scanned confusion, so it is a debug switch rather than a pipeline parameter.
useBruteforceForSubdomains true / false false settable Enable DNS brute-force for subdomain discovery In stealth mode this is forced to false.

Pipeline AI master switch

standalone · sends no traffic

Field Accepts Default MCP Meaning
aiInPipeline true / false false settable Master toggle that enables AI-powered enhancements across all recon modules that support them. Cascades on/off to per-tool AI flags (ffufAiExtensions, nucleiAiTags, wafAiClassifier, nucleiAiResponseFilter, takeoverAiClassifier).
aiPipelineModel free_text claude-opus-4-6 settable Model identifier for the AI hooks in recon (e.g. "claude-opus-4-6", "claude-haiku-4-5-20251001"). Independent of agentOpenaiModel.

Port scan AI catalog

phase port_scan · sends no traffic

Field Accepts Default MCP Meaning
portScanAiPortCatalogEnabled true / false true settable Whether Port scan AI catalog runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Project identity

standalone · sends no traffic

Field Accepts Default MCP Meaning
activationStartedAt free_text — closed When the current version activation took the lock. Used to detect a stale lock left by a crashed activation.
activationState free_text idle closed The version-activation lock. Taken while a saved scan version rewrites the graph and released afterwards; it is a lock flag the application owns, not a setting.
activationVersionId free_text — closed The scan version currently being activated. Written by the activation state machine.
createdAt free_text null closed When the project row was created. Written by the database.
createdById free_text — closed The user who created the project. Populated going forward only; may be null on older rows.
description free_text — settable Free-text notes about the engagement, shown beside the project name.
id free_text null closed The project's primary key. Row identity, not configuration.
mcpKaliExecEnabled true / false false closed Whether MCP tokens on this project may run shell commands in the Kali sandbox. It decides what a credential can do rather than how the pipeline scans, so it is closed on the MCP surface: a token that could set it would be granting itself shell access.
name free_text — settable The project's display name. Ordinary metadata, shown in every list and header.
reconPresetId free_text — closed The preset last applied to this project, recorded so the UI can show which one it came from. Written by the apply path, not configured directly.
updatedAt free_text — closed When the project row last changed. Written by the database on every update.
updatedById free_text — closed The user who last updated the project. Populated going forward only; may be null on older rows.
userId free_text — closed The owning user. Writing it reassigns the project to someone else and configures nothing, which is why it is closed on every surface. Withheld from every read on the MCP surface.

puredns

phase domain_discovery · active traffic at the target

Field Accepts Default MCP Meaning
purednsDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest frost19k/puredns:latest settable The container image spawned for puredns. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
purednsEnabled true / false true settable Whether puredns runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
purednsRateLimit 0–100000 rps 0 settable DNS queries per second puredns sends to its resolvers. ZERO MEANS UNLIMITED, so 0 is the most aggressive value available and not the safest. Under an engagement ceiling a 0 here is rewritten to the ceiling at scan start. 0 means UNLIMITED here, so it is the fastest value and not the safest. Capped to the engagement rate ceiling at scan start.
purednsSkipValidation true / false false settable Skips the wildcard-validation pass, which is much faster and lets wildcard DNS flood the results.
purednsThreads 0–1000 threads 0 settable How many puredns operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
purednsWildcardBatch 0–100000 count 0 settable Wildcard filtering batch size

Remote code execution

standalone · active traffic at the target

Field Accepts Default MCP Meaning
rceAggressivePayloads true / false false settable Whether the RCE technique uses payloads that can leave a running process or a changed file behind, rather than proof-of-concept ones that only echo.
rceDeserializationEnabled true / false true settable Whether rce runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
rceOobCallbackEnabled true / false true settable Whether rce runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Resource enum AI hints

phase resource_enum · sends no traffic

Field Accepts Default MCP Meaning
resourceEnumAiClassifierEnabled true / false true settable Whether Resource enum AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
resourceEnumAiParamInjectableFlagEnabled true / false true settable Whether Resource enum AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
resourceEnumAiPathClassifierEnabled true / false true settable Whether Resource enum AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
resourceEnumAiRagPathFlagEnabled true / false true settable Whether Resource enum AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
resourceEnumAiToolArgPathEnabled true / false true settable Whether Resource enum AI hints runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Rules of Engagement

standalone · sends no traffic

Field Accepts Default MCP Meaning
roeAllowAccountLockout true / false false settable Whether a technique that can lock a real account out is permitted. Off keeps credential attacks to a single attempt per account and withholds the lockout-capable skills from the agent's options. An engagement LIMIT: enforced at scan start whatever tuning says.
roeAllowDataExfiltration true / false false closed Whether a finding may be proven by moving data off the target. Part of the engagement RECORD: it is injected into the agent's prompt and read by a model, and no code refuses an exfiltration path on it. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeAllowDos true / false false settable Whether denial-of-service techniques are permitted. Off means the DoS path is refused before it runs and the DoS skill is withheld from the agent's options, whatever their own toggles say. An engagement LIMIT: enforced at scan start whatever tuning says.
roeAllowPhysicalAccess true / false false closed Whether the engagement covers physical access. Recorded for the report; the pipeline has no physical capability. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeAllowProductionTesting true / false true closed Whether production systems are in scope. Off is a statement the operator makes about the estate, not something the scanner can verify, so it constrains what an agent may choose rather than what a tool can reach. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeAllowSocialEngineering true / false false settable Whether techniques aimed at people rather than systems are permitted. Off withholds the social-engineering skills from the agent's options. An engagement LIMIT: enforced at scan start whatever tuning says.
roeClientContactEmail free_text (empty) closed Where to reach the client contact by email. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeClientContactName free_text (empty) closed The named client contact for this engagement. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeClientContactPhone free_text (empty) closed Where to reach the client contact by phone. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeClientName free_text (empty) closed The client the engagement is for, as it should appear in the report. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeComplianceFrameworks PCI-DSS, HIPAA, SOC2, GDPR, ISO27001 (empty) closed Compliance frameworks the engagement is conducted under, recorded for the report. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeCriticalFindingNotify true / false true closed Whether a critical finding triggers an immediate notification rather than waiting for the report. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeDataRetentionDays 0–3650 count 90 closed How many days findings and captured data may be kept after the engagement ends. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeDocumentData free_text — closed The uploaded Rules of Engagement document itself, stored so the engagement carries its own authority. A Bytes column written only by the project create and import endpoints, which receive the file. The MCP surface records the document's SHA-256 through attach_engagement_authorization instead; it never carries the bytes. Withheld from every read on the MCP surface.
roeDocumentMimeType free_text (empty) closed The media type of the uploaded Rules of Engagement document. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeDocumentName free_text (empty) closed The filename of the uploaded Rules of Engagement document. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeEmergencyContact free_text (empty) closed Who to reach out of hours if a scan causes an incident. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeEnabled true / false false closed DERIVED, never written. Engagement limits apply when there is a limit to apply: a non-zero roeGlobalMaxRps, OR a non-empty roeExcludedHosts, OR roeTimeWindowEnabled. The column is kept so old rows and old exports still load, and every service computes the value through recon_settings.engagement.derive_roe_enabled instead of reading it. A writable master switch would be a bypass shipped as a checkbox: one write of false and the ceiling, the exclusions and the window all stop applying at once while every other field still shows its configured value. An engagement LIMIT: enforced at scan start whatever tuning says. DERIVED, never written.
roeEngagementEndDate free_text (empty) closed The last date the engagement authorises any activity. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeEngagementStartDate free_text (empty) closed The first date the engagement authorises any activity. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeEngagementType external, internal, web_app, api, mobile, physical, social_engineering, red_team external closed How the engagement is classified in the report: pentest, bug bounty, red team and so on. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeExcludedHostReasons free_text (empty) settable Why each excluded host is excluded, parallel to roeExcludedHosts. Read by the report; it does not itself exclude anything. An engagement LIMIT: enforced at scan start whatever tuning says.
roeExcludedHosts free_text (empty) settable Hosts that must never be touched even though they fall inside the target scope. Enforced in three places in recon/main.py: expanded IPs, discovered subdomains and the target domain itself. A non-empty list is one of the three things that make the engagement limits live at all. An engagement LIMIT: enforced at scan start whatever tuning says.
roeForbiddenCategories brute_force, dos, social_engineering, physical, exploitation (empty) settable Technique categories the agent may not run on this engagement. Each token is expanded to the tools that perform it and refused before the tool executes (CATEGORY_TOOL_MAP in agentic/orchestrator_helpers/nodes/execute_plan_node.py), and the list is also withheld from the classifier's options. What each token covers: brute_force is any credential guessing, including brute forcing, password spraying and credential stuffing; dos is anything aimed at availability, including denial of service, resource exhaustion and volumetric or high-volume testing; social_engineering is anything aimed at a person rather than a system, including phishing, vishing, smishing and pretexting; physical is physical premises, hardware or tailgating; exploitation is taking a confirmed finding further than proving it. The vocabulary is closed because the gate matches these tokens EXACTLY: a free-text category such as "Denial of Service" reaches the agent's prompt as advice and never reaches the gate, so the refusal the UI promises silently does not happen. An engagement LIMIT: enforced at scan start whatever tuning says.
roeForbiddenTools cve_intel, execute_amass, execute_arjun, execute_code, execute_curl, execute_ffuf, execute_gau, execute_guarddog, execute_httpx, execute_hydra, execute_jsluice, execute_katana, execute_naabu, execute_nmap, execute_nuclei, execute_osv_scanner, execute_playwright, execute_subfinder, execute_wpscan, google_dork, kali_shell, metasploit_console, msf_restart, proxy_brain, query_graph, shodan, tradecraft_lookup, web_search (empty) settable Tools the agent may not run on this engagement, by name, whatever their own enable flag says. Refused before the tool executes, in agentic/orchestrator_helpers/nodes/execute_plan_node.py. The vocabulary is closed to the agent's real tool names because that gate is an exact string match: a near-miss like "hydra" for execute_hydra never matches, and the tool runs with the ban recorded and unenforced. An engagement LIMIT: enforced at scan start whatever tuning says.
roeGlobalMaxRps 0–10000 count 0 settable The engagement's request-rate ceiling, in requests per second. Every per-tool rate is capped to it at scan start, including the ones whose own value means 'unlimited'. ZERO MEANS NO CEILING, so this at 0 is not a slow engagement, it is an unlimited one. A non-zero value is also one of the three things that make the engagement limits live at all. An engagement LIMIT: enforced at scan start whatever tuning says.
roeIncidentProcedure free_text (empty) closed What to do if the engagement causes an outage or a security incident. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeMaxSeverityPhase informational, exploitation, post_exploitation post_exploitation settable The most severe phase the engagement permits, which bounds how far an attack chain may be taken: informational, exploitation or post_exploitation. An engagement LIMIT: enforced at scan start whatever tuning says.
roeNotes free_text (empty) closed Free-text engagement notes that did not fit another field. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeParsedJson json_object — closed The structured form extracted from the uploaded document, which populated the fields above. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeRawText free_text (empty) closed The Rules of Engagement document as plain text, kept so the report can quote it. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it. Withheld from every read on the MCP surface.
roeRequireDataEncryption true / false true closed Whether engagement data must be encrypted at rest. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeSensitiveDataHandling no_access, prove_access_only, limited_collection, full_access no_access closed The agreed handling rule for sensitive data encountered during the engagement. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeStatusUpdateFrequency daily, weekly, on_finding, none daily closed How often the client expects a progress update during the engagement. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeThirdPartyProviders free_text (empty) closed Third-party providers hosting in-scope assets, who may need their own notification. Part of the engagement RECORD. A person writes it, a model reads it, nothing enforces it; the MCP surface never touches it.
roeTimeWindowDays free_text ["monday","tuesday","wednesday","thursday","friday"] settable Days of the week on which scanning is permitted, lower-case English names. Empty means every day, once the window is switched on. An engagement LIMIT: enforced at scan start whatever tuning says.
roeTimeWindowEnabled true / false false settable Whether scanning is restricted to an agreed time window. The recon pipeline and the orchestrator both enforce it, and the orchestrator refuses a scan start outside the window with HTTP 403 rather than queueing it. Switching it on is one of the three things that make the engagement limits live at all. An engagement LIMIT: enforced at scan start whatever tuning says.
roeTimeWindowEndTime free_text 18:00 settable Local end of the permitted scanning window, as HH:MM. An end before the start is read as a window that crosses midnight. An engagement LIMIT: enforced at scan start whatever tuning says.
roeTimeWindowStartTime free_text 09:00 settable Local start of the permitted scanning window, as HH:MM. An engagement LIMIT: enforced at scan start whatever tuning says.
roeTimeWindowTimezone free_text UTC settable The IANA timezone the scanning window's times are read in. An engagement LIMIT: enforced at scan start whatever tuning says.

Security checks

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
securityCheckAdminPortExposed true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckBasicAuthNoTls true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckCacheControlMissing true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckCspUnsafeInline true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckDatabaseExposed true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckDirectIpHttp true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckDirectIpHttps true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckDmarcMissing true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckDnssecMissing true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckEnabled true / false true settable Whether Security checks runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
securityCheckInsecureFormAction true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckIpApiExposed true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckKubernetesApiExposed true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckLoginNoHttps true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckMaxWorkers 1–50 threads 10 settable How many security checks run concurrently.
securityCheckMissingCoep true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckMissingCoop true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckMissingCorp true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckMissingPermissionsPolicy true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckMissingReferrerPolicy true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckNoRateLimiting true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckRedisNoAuth true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckSessionNoHttponly true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckSessionNoSecure true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckSmtpOpenRelay true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckSpfMissing true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTimeout 1–86400 seconds 10 settable How long Security checks may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
securityCheckTlsExpired true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsExpiringSoon true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsExpiryDays 1–365 count 30 settable How many days before expiry a certificate starts being reported as expiring soon.
securityCheckTlsHostnameMismatch true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsSelfSigned true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsWeakCipher true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsWeakVersion true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckTlsWildcardOverbroad true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest.
securityCheckWafBypass true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.
securityCheckZoneTransfer true / false true settable Whether this individual check runs during the security-check pass. Each check is one condition tested against what the earlier phases already found; turning it off removes that finding class without affecting the rest. In stealth mode this is forced to false.

Server-side request forgery

standalone · active traffic at the target

Field Accepts Default MCP Meaning
ssrfCloudMetadataEnabled true / false true settable Whether ssrf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
ssrfCloudProviders free_text aws,gcp,azure,digitalocean,alibaba settable Comma-separated cloud providers to include in the metadata-pivots section. Filters which provider endpoint tables ship in the prompt. Ignored when cloud metadata is disabled.
ssrfCustomInternalTargets free_text (empty) settable One hostname or IP[:port] per line. Injected into the prompt so the agent prioritizes these alongside the generic loopback / RFC1918 sweep.
ssrfDnsRebindingEnabled true / false true settable Whether ssrf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
ssrfGopherEnabled true / false true settable Whether ssrf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
ssrfInternalRanges free_text 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 settable Comma-separated CIDR blocks the agent treats as internal. Adjust for orgs using non-standard internal addressing (e.g., 100.64.0.0/10 carrier-grade NAT).
ssrfOobCallbackEnabled true / false true settable Whether ssrf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
ssrfOobProvider free_text oast.fun settable interactsh-client server. Use a self-hosted instance if oast.fun is blocked.
ssrfPayloadReferenceEnabled true / false true settable Whether ssrf runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
ssrfPortScanPorts free_text 22,80,443,2375,3306,5432,6379,8080,8500,9200,27017 settable Comma-separated ports to probe via SSRF. Trim for quieter scans, extend for thorough coverage.
ssrfRequestTimeout 1–120 seconds 10 settable How long ssrf may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Shodan

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
shodanDomainDns true / false false settable Pulls Shodan's own DNS record set for the domain.
shodanEnabled true / false true settable Whether shodan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
shodanHostLookup true / false true settable Looks each discovered IP up in Shodan, which costs one API credit per host.
shodanPassiveCves true / false true settable Passive CVE lookup via Shodan
shodanReverseDns true / false true settable Asks Shodan for the names an IP is known by, which often reveals hosts DNS enumeration missed.
shodanWorkers 1–20 threads 5 settable How many shodan operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

SQL injection

standalone · active traffic at the target

Field Accepts Default MCP Meaning
sqliLevel 1–5 count 1 settable Higher levels test more injection points (headers, cookies). Default: 1.
sqliRisk 1–3 count 1 settable Higher risk uses more aggressive payloads (e.g., OR-based). Default: 1.
sqliTamperScripts free_text (empty) settable Comma-separated SQLMap tamper scripts for WAF bypass. Leave empty for auto-detection.

Subdomain discovery

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
subdomainDiscoveryEnabled true / false true settable Whether Subdomain discovery runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Subdomain takeover

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
subdomainTakeoverEnabled true / false false settable Whether takeover runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
takeoverAiClassifier true / false false settable Use AI to disambiguate takeover findings from WAF "no host" block pages that match the same static fingerprint (requires aiInPipeline=true). For each finding the scanner probes the host, short-circuits on third-party vendor tokens, and otherwise asks the LLM to classify the body. AI-flagged collisions get score -40 (lands in manual_review). Default false.
takeoverCertValidationEnabled true / false true settable Whether takeover runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
takeoverConfidenceThreshold 0–100 percent 60 settable 0..100. Findings >= threshold+10 are confirmed, >= threshold are likely, otherwise manual_review
takeoverManualReviewAutoPublish true / false false settable Publish manual_review findings into the main Vulnerability stream (default false)
takeoverRateLimit 1–500 rps 50 settable Requests per second takeover sends. Capped to the engagement ceiling at scan start, so a value above the ceiling is rewritten rather than refused. Capped to the engagement rate ceiling at scan start. In stealth mode this is forced to 10.
takeoverSeverity info, low, medium, high, critical, unknown ["critical","high","medium"] settable Severity filter for Nuclei takeover templates (e.g. ["critical","high","medium"])

subfinder

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
subfinderDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/subfinder:latest settable The container image spawned for subfinder. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
subfinderEnabled true / false true settable Whether subfinder runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
subfinderMaxResults 1–50000 count 5000 settable Maximum subdomains taken from a subfinder run. In stealth mode this is lowered to at most 100; a quieter value is kept.

subjack

phase vuln_scan · active traffic at the target

Field Accepts Default MCP Meaning
subjackAll true / false false settable Test every URL, not just identified CNAMEs - slower (default false) In stealth mode this is forced to false.
subjackCheckAr true / false false settable Detect stale A records pointing to dead cloud IPs (manual review)
subjackCheckMail true / false false settable Check SPF include + MX takeovers In stealth mode this is forced to true.
subjackCheckNs true / false false settable Detect NS takeovers (expired nameservers / dangling cloud DNS delegations) In stealth mode this is forced to true.
subjackEnabled true / false true settable Whether subjack runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
subjackRunTimeout 1–86400 seconds 900 settable How long subjack may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
subjackSsl true / false true settable Force HTTPS probing for higher accuracy (default true)
subjackThreads 1–100 threads 10 settable How many subjack operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 3.
subjackTimeout 1–86400 seconds 30 settable How long subjack may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.

Supply chain recon

standalone · passive traffic

Field Accepts Default MCP Meaning
supplyChainReconDeepAnalysisEnabled true / false false settable Whether Supply chain recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
supplyChainReconEcosystems free_text npm settable Comma-separated OSV ecosystems to report (default "npm"). Matched EXACTLY against the harvested package ecosystem, so use these names verbatim, case included: npm, PyPI, Go, Maven, crates.io, Packagist, RubyGems, NuGet. Empty string means no filter (report every ecosystem)
supplyChainReconEnabled true / false false settable Whether Supply chain recon runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Supply chain scan

standalone · passive traffic

Field Accepts Default MCP Meaning
scaIntelCorrelationEnabled true / false true create-only Whether supply-chain findings are correlated against the wider intelligence set. It reaches beyond this project's own assets, so it moves with the scope. Fixed at project creation; refused on an existing project.
supplyChainDeepAnalysisEnabled true / false false settable Whether Supply chain scan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
supplyChainEcosystems free_text npm,PyPI,Go,Maven,crates.io,Packagist,RubyGems,NuGet settable Package ecosystems the supply-chain scan analyses, such as npm, pypi or go.
supplyChainInputMode upload, github, org upload settable Whether the supply-chain scan reads an uploaded SBOM, a repository, or an organisation.
supplyChainOrgDeepAnalysisEnabled true / false false settable Whether Supply chain scan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
supplyChainOrgIncludeArchived true / false false settable Whether archived repositories are included when scanning an organisation.
supplyChainOrgIncludeForks true / false false settable Whether forked repositories are included when scanning an organisation.
supplyChainOrgMaxRepos 0–10000 count 50 settable Maximum repositories walked when scanning an organisation.
supplyChainOrgName free_text (empty) create-only The GitHub organisation whose repositories the supply-chain scan walks. Points the scanner at someone else's assets, so it is write-once. Fixed at project creation; refused on an existing project.
supplyChainOrgRef free_text (empty) settable The git ref checked out in each organisation repository, when one is pinned.
supplyChainRepoRef free_text (empty) create-only The git ref checked out in the scanned repository. Write-once with the repository it belongs to. Fixed at project creation; refused on an existing project.
supplyChainRepoScope free_text (empty) create-only Which parts of the repository the scan reads. Write-once with the repository it belongs to. Fixed at project creation; refused on an existing project.
supplyChainRepoUrl free_text (empty) create-only The repository the supply-chain scan clones. It becomes a git clone argument against a third party's infrastructure, so it is write-once like the scope. Fixed at project creation; refused on an existing project.
supplyChainSbomFile free_text (empty) closed The uploaded SBOM this project analyses. Written only by the upload endpoint, which also places the file on disk; a second writer could name a file the project never uploaded.
supplyChainTyposquatEnabled true / false false settable Whether Supply chain scan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.

Targeting and scope

standalone · sends no traffic

Field Accepts Default MCP Meaning
domainBatchGroups json_object — closed Groups derived from the list at save time: [{ rootDomain, prefixes[], hosts[] }]. Persisted rather than re-derived so the grouping rule has exactly ONE implementation, and so what the operator approved in the preview is literally what the pipeline runs. Always recomputed server-side; never trusted from a body.
domainBatchHosts free_text (empty) create-only Raw hostname list as entered or uploaded. What the operator edits. Fixed at project creation; refused on an existing project.
domainBatchMode true / false false create-only Domain batch: the third targeting mode. Mutually exclusive with ipMode. One full recon walks the derived groups in order, appending to one graph. Fixed at project creation; refused on an existing project.
ipMode true / false false create-only Switches targeting from a domain to the explicit IP list. Mutually exclusive with domainBatchMode, and part of the scope, so it is write-once. Fixed at project creation; refused on an existing project.
ownershipToken free_text your-secret-token-here create-only The secret published in the ownership TXT record. Compared against what DNS returns, so it proves the scope rather than configuring a tool. Fixed at project creation; refused on an existing project. Withheld from every read on the MCP surface.
ownershipTxtPrefix free_text _redamon-verify create-only The label the ownership TXT record is looked up under, prepended to the target domain. Moves with the scope. Fixed at project creation; refused on an existing project.
subdomainList free_text (empty) create-only Hosts seeded into the scan in addition to whatever discovery finds. Part of the engagement scope, so it is write-once. Empty entries are dropped and every entry is whitespace-stripped at load. Fixed at project creation; refused on an existing project.
targetDomain free_text (empty) create-only The single root domain this engagement covers. THE scope column: every phase derives its hosts from it and the target guardrail measures against it. Set once at creation and immutable afterwards, because changing it on an existing project turns a rescan credential into one aimed at a third party. Leading and trailing whitespace is stripped at load. Fixed at project creation; refused on an existing project.
targetGuardrailEnabled true / false true create-only The hard guardrail that refuses to scan a host outside the declared scope. Turning it off removes the control that keeps the pipeline inside its engagement, which is why it moves with the scope and cannot change on an existing project. Fixed at project creation; refused on an existing project.
targetIps free_text (empty) create-only The IP addresses or CIDR ranges scanned when ipMode is on. Part of the engagement scope, so it is write-once. Empty entries are dropped and every entry is stripped at load. Fixed at project creation; refused on an existing project.
verifyDomainOwnership true / false false create-only Requires a DNS TXT record proving control of the target before any active phase runs. Part of the scope's proof, so it is write-once. Fixed at project creation; refused on an existing project.

tlsx

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
tlsxCipherConcurrency 1–500 threads 10 settable How many tlsx operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
tlsxCipherEnum true / false false settable Enumerate weak supported ciphers (extra connections per target). Default false. In stealth mode this is forced to false.
tlsxConcurrency 1–300 threads 50 settable How many tlsx operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 5.
tlsxDelay free_text (empty) settable Optional -delay between connections (e.g. "200ms"); stealth only. Default "".
tlsxDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/tlsx:latest settable The container image spawned for tlsx. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
tlsxEnabled true / false true settable Whether tlsx runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
tlsxIncludeHttpPorts true / false false settable Also grab certs on HTTP/HTTPS ports httpx already covers (duplicate handshakes). Default false.
tlsxInjectHostnames true / false true settable Merge in-scope certificate SAN hostnames into dns.subdomains as new probe targets. Default true.
tlsxMaxHostnamesPerIp 0–1000 count 1 settable When one IP serves several known hostnames, how many to scan (each may present a different cert). Default 1.
tlsxMaxInjectedHostnames 0–10000 count 200 settable Cap on in-scope certificate SAN hostnames merged back into dns.subdomains as scan targets. Default 200.
tlsxMaxTargets 1–100000 count 2000 settable Hard cap on ip:port pairs tlsx scans. Default 2000.
tlsxProbeJarm true / false false settable Compute JARM + JA3 fingerprints (~10 extra handshakes per target, loud). Default false. In stealth mode this is forced to false.
tlsxRetries 0–10 count 1 settable How many times tlsx retries a failed request before giving up on it.
tlsxRevPtrSni true / false false settable Reverse-PTR to derive an SNI for bare IPs (extra DNS lookups). Default false.
tlsxRunTimeout 1–86400 seconds 900 settable How long tlsx may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
tlsxScanMode free_text auto settable TLS stack: ctls|ztls|openssl|auto. Default auto.
tlsxTimeout 1–60 seconds 5 settable How long tlsx may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
tlsxVersionEnum true / false false settable Enumerate every supported TLS version (extra connections per target). Default false. In stealth mode this is forced to false.

TruffleHog

standalone · passive traffic

Field Accepts Default MCP Meaning
trufflehogAllowVerificationOverlap true / false false settable Whether several detectors may verify the same candidate, which costs requests but catches more.
trufflehogArchiveMaxDepth 0–50 depth 0 settable How many nested archives are extracted before the scan stops descending.
trufflehogArchiveMaxSize free_text (empty) settable The largest archive extracted, in bytes. A larger one is skipped rather than exhausting the container.
trufflehogArchiveTimeout free_text (empty) settable Seconds one archive extraction may take before it is abandoned.
trufflehogConcurrency 1–500 threads 8 settable How many sources trufflehog scans at once.
trufflehogDetectorTimeout free_text (empty) settable Seconds one detector may spend verifying a candidate before it is abandoned.
trufflehogDropUnverifiedJwt true / false false settable Discards JWTs that could not be verified, which are the bulk of the false positives in this class.
trufflehogEnabled true / false false settable Whether trufflehog runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
trufflehogExcludeDetectors free_text (empty) settable Detectors that never run, whatever the include list says.
trufflehogFilterEntropy free_text (empty) settable The Shannon entropy below which a candidate string is discarded before detection runs.
trufflehogForceSkipArchives true / false false settable Skips archives entirely rather than extracting them, which is faster and misses anything inside.
trufflehogForceSkipBinaries true / false false settable Skips binary files rather than scanning them for embedded strings.
trufflehogIncludeDetectors free_text (empty) settable Restricts the run to these detectors. Empty means every detector runs.
trufflehogMaxDecodeDepth 0–50 depth 5 settable How many nested encodings are unwrapped before giving up on a candidate.
trufflehogNoVerification true / false false settable Skip live verification entirely. When set, every finding lands unverified (never checked), which is NOT the same as "not live".
trufflehogResultTypes free_text verified,unverified,unknown settable Which result statuses to report: a comma-separated subset of verified,unverified,unknown,filtered_unverified. Replaces the old trufflehogOnlyVerified boolean, which combined with trufflehogNoVerification asked TruffleHog to report only verified results while forbidding it to verify — zero findings, no error.

uncover

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
uncoverDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest projectdiscovery/uncover:latest settable The container image spawned for uncover. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
uncoverEnabled true / false false settable Whether uncover runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
uncoverMaxResults 1–50000 count 50000 settable The most results uncover accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here. An empty value is replaced by the default rather than honoured.

urlscan.io

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
urlscanEnabled true / false true settable Whether urlscan runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
urlscanMaxResults 1–50000 count 50000 settable The most results urlscan accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here. In stealth mode this is lowered to at most 100; a quieter value is kept.

Vhost / SNI enumeration

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
vhostSniBaselineSizeTolerance 0–10000 bytes 50 settable Body size deltas within this many bytes are not flagged (suppresses Set-Cookie / timestamp jitter). Default 50.
vhostSniConcurrency 1–100 threads 20 settable How many Vhost / SNI enumeration operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
vhostSniCustomWordlist project_file (empty) settable Optional newline-separated custom prefixes/hostnames (per-project file/text). Bare prefixes expand as {prefix}.{target_apex}; full hostnames are used as-is. Default "".
vhostSniEnabled true / false false settable Whether Vhost / SNI enumeration runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
vhostSniInjectDiscovered true / false true settable When a hidden vhost is confirmed, create a BaseURL node so a follow-up partial recon (Katana, Nuclei) can scan it. Default true.
vhostSniMaxCandidatesPerIp 10–50000 count 2000 settable Hard cap on candidates per IP to bound run time. Default 2000.
vhostSniTestL4 true / false true settable Run the TLS SNI trick via curl --resolve (catches modern reverse proxies, k8s ingress, Cloudflare). Default true.
vhostSniTestL7 true / false true settable Run the HTTP Host header trick (catches classic Apache/Nginx vhosts). Default true.
vhostSniTimeout 1–30 seconds 3 settable How long Vhost / SNI enumeration may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
vhostSniUseDefaultWordlist true / false true settable Use the bundled vhost-common.txt wordlist (~2,300 admin/dev/staging/internal/modern-stack prefixes, expanded as {prefix}.{target_apex}). Default true.
vhostSniUseGraphCandidates true / false true settable Pull hostnames from existing Subdomain, ExternalDomain, TLS SAN list, CNAME targets and reverse-DNS PTR records resolving to each target IP. Highest signal source. Default true.

VirusTotal

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
virusTotalEnabled true / false false settable Whether virustotal runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
virusTotalWorkers 1–10 threads 3 settable How many virustotal operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

WAF detection

phase http_probe · sends no traffic

Field Accepts Default MCP Meaning
wafAiClassifier true / false false settable Use AI to classify WAF/CDN presence from response headers/body/latency when the static check misses (requires aiInPipeline=true). Augments _has_cdn_markers and check_waf_bypass; AI-detected bypasses are tagged detection_method=ai_classifier. Default false.

Wappalyzer

phase http_probe · active traffic at the target

Field Accepts Default MCP Meaning
wappalyzerAutoUpdate true / false true settable Wappalyzer package version for tech database
wappalyzerCacheTtlHours 1–8760 count 24 settable How long to cache tech database (0 = always fresh)
wappalyzerEnabled true / false true settable Whether wappalyzer runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
wappalyzerMinConfidence 0–100 percent 50 settable The confidence percentage below which a Wappalyzer technology match is discarded.
wappalyzerNpmVersion free_text 6.10.56 settable The npm version of Wappalyzer the scan container installs at run time. It is fetched from the public registry during the scan, so it decides what code runs inside the container.
wappalyzerRequireHtml true / false true settable Whether a technology match requires an HTML response, which suppresses matches on JSON and binary endpoints.

Web cache poisoning

standalone · active traffic at the target

Field Accepts Default MCP Meaning
webCachePoisonAllowCpdos true / false false settable Cache-poisoned DoS tests (oversized/meta-char). Only honored in research profile. Default false. In stealth mode this is forced to false.
webCachePoisonAllowDeception true / false true settable Web cache deception (path-confusion .css tricks). Default true.
webCachePoisonAllowFrameworkPacks true / false true settable Fire Next.js/Nuxt/Remix-specific vectors only when the tech fingerprint matches. Default true.
webCachePoisonBehavioralDelay 1–10 seconds 1.1 settable Seconds to wait between the two frozen-Date probes. Larger = more reliable on slow origins, but adds latency per silent URL. Default 1.1.
webCachePoisonBehavioralOracle true / false true settable Detect silent caches (no cache-status headers, common with default Varnish/nginx or hardened CDNs) via a frozen-Date probe: fetch twice across a short delay; a frozen Date header + identical body implies a cache. Catches caches header detection alone would miss. Default true.
webCachePoisonCacheBusterParam free_text rdmncb settable Query param name used to isolate every test into its own cache slot. Default "rdmncb".
webCachePoisonCacheHeader free_text (empty) settable Override the cache hit/miss header if the target uses a non-standard one. Default "".
webCachePoisonConcurrency 1–50 threads 10 settable How many Web cache poisoning operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
webCachePoisonConfirmWorkers 1–16 threads 6 settable How many Web cache poisoning operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
webCachePoisonCrossVantage true / false false settable Re-confirm from a second network vantage (requires extra egress infra). Default false.
webCachePoisonDifferential true / false true settable Non-reflective detection. Beyond looking for a benign canary echoed back, also flag a poison that changes the response behaviour (a persisted status code / Location redirect / body) with no echoed marker, guarded against false positives by requiring the affected response dimension to be stable across two clean baselines. Catches CPDoS-style status flips, scheme/redirect poisoning, and cache-key confusion. Adds one extra baseline request per vector. Default true.
webCachePoisonDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest redamon-wcvs:latest settable The container image spawned for Web cache poisoning. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
webCachePoisonEnabled true / false false settable Whether Web cache poisoning runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
webCachePoisonMaxRpsPerHost 0–1000 rps 0 settable Requests per second the web-cache-poisoning scan sends to any ONE host. ZERO MEANS UNLIMITED, so 0 is the most aggressive value available and not the safest. Under an engagement ceiling a 0 here is rewritten to the ceiling at scan start. 0 means UNLIMITED here, so it is the fastest value and not the safest. Capped to the engagement rate ceiling at scan start.
webCachePoisonMinConfidence 0–1 ratio 0.8 settable Only findings scoring at or above this (0-1) become Vulnerability nodes. 0.8 keeps Confirmed + Strong. Default 0.8.
webCachePoisonScanProfile free_text safe-confirm settable "safe-confirm" (production, benign canaries, always isolated), "extended" (owned test targets), or "research" (lab only, enables CPDoS if allowed). Default "safe-confirm".
webCachePoisonTimeout 1–86400 seconds 1800 settable How long Web cache poisoning may spend before it is abandoned, in seconds. A run that hits it contributes whatever it found so far rather than failing the scan.
webCachePoisonTimeoutPerReq 1–86400 seconds 10 settable Native confirmation per-request timeout in seconds. Default 10.
webCachePoisonVerifySsl true / false true settable Verify TLS certificates during native confirmation. Default true.

WHOIS

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
whoisEnabled true / false true settable Whether whois runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
whoisMaxRetries 1–20 count 6 settable How many times whois retries a failed request before giving up on it.

ZAP Ajax Spider

phase resource_enum · active traffic at the target

Field Accepts Default MCP Meaning
zapAjaxSpiderBrowserId free_text firefox-headless settable ZAP browser id, such as "firefox-headless"
zapAjaxSpiderClickDefaultElems true / false true settable Click default clickable elements
zapAjaxSpiderClickElemsOnce true / false true settable Click each element only once
zapAjaxSpiderCustomHeaders http_header (empty) settable Header/cookie lines for authenticated crawling
zapAjaxSpiderDockerImage caffix/amass:latest, dolevf/graphql-cop:1.14, frost19k/puredns:latest, ghcr.io/zaproxy/zaproxy:stable, jauderho/hakrawler:latest, projectdiscovery/httpx:latest, projectdiscovery/katana:latest, projectdiscovery/naabu:latest, projectdiscovery/nuclei:latest, projectdiscovery/subfinder:latest, projectdiscovery/tlsx:latest, projectdiscovery/uncover:latest, redamon-baddns:latest, redamon-wcvs:latest, sxcurity/gau:latest ghcr.io/zaproxy/zaproxy:stable settable The container image spawned for zap. Any value outside the shipped allowlist is silently pinned back to the default at scan start, with a [guardrail] line recording it, so the field is open and the runtime is the control.
zapAjaxSpiderEnabled true / false false settable Whether zap runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op. In stealth mode this is forced to false.
zapAjaxSpiderEventWait 0–3600000 milliseconds 1000 settable How long the Ajax Spider waits after firing a DOM event, in MILLISECONDS. Too low and a single-page app has not rendered its new state before the crawler reads it.
zapAjaxSpiderExcludePatterns free_text (empty) settable Regex patterns to exclude from Ajax crawling
zapAjaxSpiderLogoutAvoidance true / false true settable Avoid actions likely to log out
zapAjaxSpiderMaxCrawlDepth 1–50 depth 5 settable Max crawl depth per seed
zapAjaxSpiderMaxCrawlStates 0–100000 count 0 settable Max crawl states, or 0 for unlimited
zapAjaxSpiderMaxDuration 1–1440 minutes 10 settable How long the ZAP Ajax Spider may crawl one seed, in MINUTES rather than seconds.
zapAjaxSpiderMaxUrls 1–100000 count 1000 settable The most results zap accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
zapAjaxSpiderNumberOfBrowsers 1–10 threads 1 settable Browser instances used by Ajax Spider
zapAjaxSpiderParallelism 1–10 threads 3 settable How many zap operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here.
zapAjaxSpiderRandomInputs true / false false settable Fill inputs with random values
zapAjaxSpiderReloadWait 0–3600000 milliseconds 1000 settable How long the Ajax Spider waits after a page reload, in MILLISECONDS.
zapAjaxSpiderScopeCheck free_text Strict settable Ajax Spider scope check mode
zapAjaxSpiderSeedMode free_text base_urls settable "base_urls" or "base_urls_and_endpoints" seed selection

ZoomEye

phase domain_discovery · passive traffic

Field Accepts Default MCP Meaning
zoomEyeEnabled true / false false settable Whether ZoomEye runs. Configuration is two levels: this flag decides whether the tool runs INSIDE its phase, and scanModules decides whether the phase runs at all. Setting one without the other is a silent no-op.
zoomEyeMaxResults 1–10000 count 1000 settable The most results ZoomEye accumulates in one pass. The memory governor budgets it against available RAM, so the effective value can be below what is written here.
zoomEyeWorkers 1–20 threads 5 settable How many ZoomEye operations run at once. The memory governor scales it down when the host is short of RAM, so the effective value can be below what is written here. In stealth mode this is forced to 1.

RedAmon GitHub Repository | Report an Issue | Back to Home

Home

Getting Started

Core Workflow

Scanning & OSINT

AI & Automation

HackLab

Analysis & Reporting

Contributing

Reference & Help

Clone this wiki locally