v0.6.3

What's Changed

• Surface kubedagger discovery failures; normalize modem-firmware severities by @yasindce1998 in #18
• Tier 3: live end-to-end test suite — real tools, real middleware, real campaigns by @yasindce1998 in #19
• New tool integrations: searchsploit/CVE enrichment, binwalk firmware, hydra, rubeus, syft+grype SBOM by @yasindce1998 in #20
• Docs release-gate audit: every count, pin, and profile verified against the code by @yasindce1998 in #21
• chore: bump version to 0.6.3 by @yasindce1998 in #22

Full Changelog: v0.6.2...v0.6.3

v0.6.2

What's Changed

• Testing hardening: live CLI-drift suite, golden-output fixtures, and 8 real wrapper bug fixes by @yasindce1998 in #15
• Parallel-step approval: multi-elicitation group pause with per-sub-step replay by @yasindce1998 in #16
• Bump Barzakh pins to v0.7.1; close the manifest_validate known drift by @yasindce1998 in #17

Full Changelog: v0.6.1...v0.6.2

v0.6.1

What's Changed

• v0.6.1 stabilization: modern MCP protocol, streamable HTTP, Tasks extension, and MRTR approvals by @yasindce1998 in #14

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

• Complete offense integration: execution tools for all four research platforms by @yasindce1998 in #9
• Pin aegis-c2 and bump Aegis-Shadow binaries to v0.2.0 (re-create of #10) by @yasindce1998 in #11
• Metasploit toolset and 100% platform coverage by @yasindce1998 in #12
• Release v0.6.0 by @yasindce1998 in #13

Full Changelog: v0.5.1...v0.6.0

v0.5.1

What's Changed

• Pin KubeDagger v0.5.0, unify Barzakh v0.7.0, and refresh all documentation by @yasindce1998 in #6
• Telecom and aegis install profiles with verified release binaries by @yasindce1998 in #7
• Release v0.5.1 by @yasindce1998 in #8

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's Changed

• fix: harden execution policies, transports, and credential storage by @yasindce1998 in #1
• fix: stabilize CLI, execution policies, credentials, and installers by @yasindce1998 in #2
• fix: persist and harden evidence and loot storage by @yasindce1998 in #3
• Multi-stage campaign framework, point-and-shoot playbooks, and full KubeDagger/Barzakh/StaticZero/Aegis-Shadow integration by @yasindce1998 in #4
• Engagement-scoped campaigns, managed server lifecycle, and v0.5.0 by @yasindce1998 in #5

New Contributors

• @yasindce1998 made their first contribution in #1

Full Changelog: v0.4.0...v0.5.0

v0.4.0 — Full Offensive Security Platform

What's New

Full Offensive Security Platform (~35 Features)

Major expansion from a toolset runner into a complete offensive security platform with workflow orchestration, intelligence, collaboration, and reporting.

Workflow Orchestration:

• Parallel, conditional, and resumable execution
• Workflow templates and scheduling

8 New Toolsets:

• BloodHound, Responder, Evil-WinRM, Coercion, Phishing, Wireless, Mobile, Cloud

Intelligence Layer:

• Target database with correlation engine
• Attack graphs with MITRE ATT&CK mapping
• Risk scoring

Collaboration:

• Engagement management
• Credential store and loot tracking
• Webhooks and multi-operator sync

OPSEC Middleware:

• Traffic shaping with jitter
• Source rotation and IOC tracking
• OPSEC profiles

Reporting:

• SARIF, PDF, and executive summary output
• Evidence capture and compliance mapping

Infrastructure:

• Hot-reload plugins
• TCP transport
• Web dashboard and CLI companion
• Dry-run mode

Code Quality

• Fixed ~60 discarded errors across all packages
• Refactored main.go from 601 lines to ~50 via internal packages
• Added comprehensive tests for 6 core packages
• Resolved all golangci-lint, errcheck, and staticcheck issues
• Replaced WriteString(Sprintf) patterns with Fprintf

Install

# Linux/macOS
sudo ./scripts/install-tools.sh

# Windows (Admin PowerShell)
.\scripts\install-tools.ps1

# Docker (everything pre-installed)
docker compose up

v0.3.0 — Barzakh UEFI Toolset

What's New

Barzakh UEFI Bootkit Adversary Simulation (Go toolset)

Replaced the 4 JSON plugins with a proper typed Go package (tools/barzakh/) following the KubeDagger pattern. Now includes the previously-unintegrated barzakh-scanner binary with 43 specialized UEFI bootkit detectors.

New MCP Tools:

• barzakh_list — List available UEFI bootkit payload types
• barzakh_generate — Generate adversary simulation payloads (x86-64, aarch64, riscv64)
• barzakh_corpus — Generate full test corpus of malicious/clean firmware pairs
• barzakh_scan — Scan firmware images for bootkit indicators (trampoline hooks, SPI flash mods, SMM backdoors, ACPI implants, Secure Boot bypasses)

Installation:

• New uefi profile: --profile uefi in install scripts
• Docker image includes both binaries pre-installed
• Windows support via install-tools.ps1 -Profile uefi

Infrastructure

• Added barzakh-scanner to binary allowlist
• Input validation with shell metacharacter rejection
• Structured markdown output for all tools
• check-deps.sh reports Barzakh binary status

Install

# Linux/macOS
sudo ./scripts/install-tools.sh --profile uefi

# Windows (Admin PowerShell)
.\scripts\install-tools.ps1 -Profile uefi

# Docker (everything pre-installed)
docker compose up

v0.2.1 — Non-Docker Installation Infrastructure

What's New

RedHands now supports full native installation without Docker — profile-based tool management, cross-platform scripts, and a one-line installer.

One-Line Install

curl -fsSL https://raw.githubusercontent.com/yasindce1998/redhands/main/scripts/install.sh | bash

With tools:

curl -fsSL https://raw.githubusercontent.com/yasindce1998/redhands/main/scripts/install.sh | bash -s -- --with-tools --profile=web

Installation Profiles

Profile	Tools	Use Case
minimal	nmap, subfinder, httpx, nuclei	Quick recon and scanning
web	minimal + ffuf, katana, nikto, sqlmap, feroxbuster	Web application testing
network	minimal + masscan, rustscan, tshark, chisel, ligolo	Network/infrastructure
ad	minimal + impacket, certipy, crackmapexec, hashcat, john	Active Directory
recon	minimal + amass, gau, waybackurls, arjun, whatweb	Deep reconnaissance
all	Everything	Full offensive toolkit

Platform Support

• Linux: Debian/Ubuntu (apt), Fedora/RHEL (dnf), Arch (pacman)
• macOS: Homebrew
• Windows: Chocolatey + Scoop (scripts/install-tools.ps1)

New Make Targets

make install          # Install binary to /usr/local/bin
make install-tools PROFILE=web   # Install tool dependencies
make check-deps       # Show installed/missing tools with hints

Files Added

• scripts/install.sh — curl-pipeable quick installer
• scripts/install-tools.sh — full Linux/macOS installer with OS detection
• scripts/install-tools.ps1 — Windows PowerShell installer
• scripts/check-deps.sh — dependency checker with color-coded output

v0.1.0 — Full Suite

First public release of RedHands — an enterprise-grade MCP server exposing offensive security tools to AI agents.

Highlights

• 23 tools across 7 toolsets (nmap, scan, recon, web, fuzz, exploit, vuln) + system health check
• MCP protocol — JSON-RPC 2.0 over stdio transport, compatible with Claude Code, Cursor, VS Code
• Secure execution — binary allowlist, shell metacharacter rejection, target validation, output caps, execution timeouts
• Rate limiting — token bucket middleware prevents abuse
• Result caching — LRU cache with configurable TTL
• Audit logging — every tool invocation logged as structured JSONL
• Toolset filtering — enable only the tools you need via REDHANDS_TOOLSETS env var
• Category-based layout — tools organized by domain (scan, recon, web, fuzz, exploit, vuln, system)

Tools Included

Category	Tools
Scan	nmap (4 modes), masscan, rustscan
Recon	subfinder, amass, dns/dig, waybackurls, gau, arjun
Web	httpx, katana, nikto, whatweb, testssl
Fuzz	ffuf, gobuster, feroxbuster
Exploit	sqlmap
Vuln	nuclei
System	health check

Requirements

• Go 1.26+
• Security tools installed on PATH

Install

go install github.com/yasindce1998/redhands/cmd/redhands@v0.1.0