VIPERCLAW

v1.2.0 · Zero Dependencies

The Universal AI Offensive Security Harness, Swarm Graph & Proof Oracle

▸ Antigravity Ready

▸ Claude Code & Codex

▸ No Receipt, No Report

▸ Stigmergic Swarm Graph

ViperClaw (viperclaw / vclaw) upgrades Google Antigravity, Claude Code, OpenAI Codex, and Cursor into a methodology-driven offensive security & bug bounty platform—combining 12 offensive skills, an 8-tool Phase-Gated MCP server, a Stigmergic SQLite Attack Graph, multi-language SAST/DAST analyzers, and a deterministic Wire-Check Proof Oracle with zero third-party runtime dependencies.

⚡ Core Offensive Subsystems

🕸️ Stigmergic Attack Graph

core/graph.py — Zero-setup SQLite graph with pheromone priority scoring, evaporation decay, and Mermaid topology export.

🧩 JS Chunk Harvester

analyzers/js_harvester.py — Reconstructs unloaded Webpack, Vite & Next.js lazy chunks, hidden admin routes, IDOR/SSRF params & secrets.

🔬 Polyglot Taint SAST

analyzers/taint.py — Multi-hop source-to-sink taint tracking across Python, TS/JS, Go & PHP with context-aware sanitizer de-tainting.

🌐 Live Wire Exploiter

analyzers/live_scanner.py — Stateful cookie/CSRF handling and 14 wire-verified exploit probes (RCE, SQLi, LFI, Upload, XSS, CSRF, Logic).

🕵️ HAR Fingerprinter

analyzers/proxy_fingerprint.py — Infers backend stacks (FastAPI, NestJS, Spring, Laravel, Rails) and sibling APIs from Caido / Burp HAR traffic.

🛡️ 7-Gate Proof Oracle

core/oracle.py — Filters Cloudflare/Akamai/Imperva Soft-200 blocks, diffs BOLA JSON keys, scores CVSS 3.1 & exports H1 MD + SARIF 2.1.0.

🚀 Quickstart & CLI

Clone, Install Package & Load All 12 Agent Skills (<2s, Zero Deps)

git clone https://github.com/zahidoverflow/viperclaw.git
cd viperclaw
pip install -e .

# Install all 12 offensive skills into Antigravity, Claude Code, Codex & Cursor
viperclaw skills install --target all

🔌 Connect Phase-Gated MCP Server (mcp_config.json / Claude Code / Cursor)

mcp_config.json / .mcp.json (or run: claude mcp add viperclaw -- viperclaw mcp)

{
  "mcpServers": {
    "viperclaw": {
      "command": "viperclaw",
      "args": ["mcp"]
    }
  }
}

💻 View Standalone CLI Workflows (viperclaw / vclaw)

Live DAST, White-Box Taint SAST, SPA Lazy-Chunk Recon & HAR Fingerprinting

# 1. Stateful live web scan & wire-verified exploit suite
viperclaw scan http://127.0.0.1:4280 --db .viperclaw/graph.db --report-md bounty_report.md --report-sarif findings.sarif

# 2. Multi-language source-to-sink taint SAST (Python, TS/JS, Go, PHP)
viperclaw taint ./target-repo --db .viperclaw/graph.db --output taint_flows.json

# 3. Reconstruct hidden Webpack / Vite / Next.js lazy chunks & API leads
viperclaw harvest-js ./bundles --base-url https://app.target.tld/ --db .viperclaw/graph.db --output js_recon.json

# 4. Fingerprint backend stacks from Caido / Burp HAR traffic & view top leads
viperclaw fingerprint ./traffic.har --domain target.tld --output tech_stack.json
viperclaw graph --db .viperclaw/graph.db --top-leads 10 --mermaid

🧬 4-Layer Architecture

Layer 1 · AI Coding Harness

▸ Antigravity (agy) ▸ Claude Code ▸ OpenAI Codex ▸ Cursor / Windsurf

▼ SKILL.md Playbooks + JSON-RPC 2.0 stdio ▼

Layer 2A & 2B · 12 Skills + 8-Tool MCP Server

12 Offensive SKILL.md Playbooks viperclaw mcp (8 Phase-Gated Tools)

▼ Pure-Python 3.10+ Execution ▼

Layer 3 · Core Offensive Analyzers (Zero Deps)

[01] Live HTTP Scanner [02] Polyglot Taint SAST [03] JS Harvester [04] HAR Fingerprinter [05] SQLite Swarm Graph

▼ Raw Wire Proof Receipts ▼

Layer 4 · 7-Gate Proof Oracle ("No Receipt, No Report")

WAF Soft-200 & BOLA Diff 7-Gate Triage + CVSS 3.1 H1 MD + SARIF 2.1.0

🎯 12 Offensive Skills & 8 Phase-Gated MCP Tools

🧭 Orchestration & Proof QA

viper-orchestrator & viper-proof-judge drive the 5-phase Stigmergic Attack Graph and enforce the 7-Question Triage Gate.

🔭 Recon & Polyglot SAST

viper-js-harvester, viper-proxy-fingerprint & viper-taint-sast map lazy SPA chunks, HAR stacks, and multi-hop code taint.

⚔️ Web, API, Cloud & AI

viper-bola-idor, viper-injection-oracle, viper-ssrf-cloud, viper-auth-oauth-jwt, viper-graphql-ws, viper-race-logic & viper-ai-llm-redteam.

📚 View All 12 Methodology-Driven Skill Playbooks (skills/*/SKILL.md)

#	Skill	Focus Area & Offensive Methodology
`01`	`viper-orchestrator`	Master 5-Phase Orchestrator: Stigmergic Attack Graph prioritization, hypothesis decomposition & 7-Gate QA.
`02`	`viper-js-harvester`	Deep JS & Lazy-Chunk Harvester: Unloaded Webpack/Vite/Next.js chunk manifests, hidden admin routes & secrets.
`03`	`viper-proxy-fingerprint`	HTTP & Proxy Fingerprinter: Sibling API hosts, framework error envelopes (FastAPI, NestJS, Spring, Laravel) & WAF traps.
`04`	`viper-bola-idor`	Cross-Tenant BOLA / IDOR / BFLA: Multi-role auth matrix, ID mutation & structural JSON key diff verification.
`05`	`viper-injection-oracle`	Precision Injection Oracle: True/false differential pairs for SQLi, NoSQLi, SSTI, and OS Command Injection.
`06`	`viper-ssrf-cloud`	SSRF & Cloud Metadata: URL parser differentials, redirect chains, AWS/GCP/Azure IMDSv1/v2 & K8s discovery.
`07`	`viper-auth-oauth-jwt`	Auth, OAuth 2.0 / OIDC & JWT: `redirect_uri` bypasses, pre-ATO collisions, JWT `RS256`→`HS256` confusion & `kid` injection.
`08`	`viper-graphql-ws`	GraphQL & WebSocket Auditor: Introspection bypass, field suggestion clairvoyance, nested edge BOLA & CSWSH.
`09`	`viper-race-logic`	Race Condition & Business Logic: Single-packet HTTP/2 bursts, TOCTOU quota overruns & workflow step skipping.
`10`	`viper-taint-sast`	White-Box Source-to-Sink Taint SAST: Multi-hop taint tracking across Python, TS/JS, Go & PHP with PoC synthesis.
`11`	`viper-ai-llm-redteam`	Agentic AI, LLM & MCP Red-Team: Indirect prompt injection, tool-call argument hijacking & RAG vector bleed.
`12`	`viper-proof-judge`	Zero-Context Adversarial QA Judge: Enforces "No Receipt, No Report", 7-Question Gate, CVSS 3.1 & H1/SARIF reports.

🔌 View All 8 Phase-Gated MCP Server Tools (viperclaw mcp)

MCP Tool	Phase	Description
`viper_live_scan`	Exploit / DAST	Execute a stateful, authenticated HTTP dynamic scan against a live web target, proving exploits over the wire.
`viper_taint_scan`	White-Box SAST	Run multi-language source-to-sink taint analysis across Python, TypeScript/JavaScript, Go, and PHP.
`viper_harvest_js`	Recon / SPA	Reconstruct Webpack/Vite/Next.js lazy chunks and extract endpoints, IDOR/SSRF candidates, GraphQL ops & secrets.
`viper_fingerprint_traffic`	Recon / HAR	Fingerprint backend frameworks, WAFs, sibling API hosts, and error envelopes from `.har` captures or headers.
`viper_graph_upsert`	Swarm Graph	Upsert hosts, endpoints, lazy chunks, taint sinks, or findings into the Stigmergic SQLite Attack Graph.
`viper_graph_leads`	Swarm Graph	Query top pheromone-ranked attack leads and export a live Mermaid topology diagram.
`viper_diff_oracle`	Verification	Compare baseline vs. mutated/cross-tenant HTTP responses to confirm BOLA/IDOR and filter WAF Soft-200 blocks.
`viper_verify_and_report`	Reporting	Run the 7-Question Triage Gate, calculate exact CVSS v3.1 scores, and generate HackerOne/Bugcrowd Markdown.

🏆 Validated DVWA Benchmark Scorecard

19 / 19 (100%)

White-Box Taint SAST

viperclaw taint detects all 19 vulnerable modules with 0 False Positives on hardened impossible.php targets.

14 / 14 (100%)

Black-Box Live Exploitation

viperclaw scan exploits and verifies all 14 live HTTP vulnerability modules in <5 seconds with raw wire receipts.

0 External Deps

Pure Python 3.10+ Engine

Installs in <2 seconds using 100% standard library modules—zero Docker containers or third-party pip bloat.

🔬 View All 14 Wire-Verified DVWA Exploitation Proofs & CVSS v3.1 Vectors

ID	Severity (CVSS)	Vulnerability Module	Verified Wire Proof / Exploit Vector
`VC-LIVE-001`	HIGH (8.8)	OS Command Injection	`ip=127.0.0.1;id` → Verified `uid=33(www-data)` execution
`VC-LIVE-002`	HIGH (8.1)	UNION SQL Injection	`' UNION SELECT user,password FROM users#` → Credential hash dump
`VC-LIVE-003`	MED (6.5)	Boolean Blind SQLi	True (`1' AND 1=1#`) vs. False (`1' AND 1=2#`) differential oracle
`VC-LIVE-004`	HIGH (8.1)	SQLi Auth Bypass	`username=admin' OR '1'='1' LIMIT 1#` → Authenticated admin session
`VC-LIVE-005`	HIGH (7.1)	Local File Inclusion	`?page=/etc/passwd` → Verified `root:x:0:0:root:/root:/bin/bash`
`VC-LIVE-006`	CRIT (9.9)	Unrestricted Upload RCE	Multipart PHP upload → Verified RCE at `/hackable/uploads/viperclaw_poc.php`
`VC-LIVE-007`	MED (6.1)	Reflected XSS	Unescaped HTML payload reflection verified in DOM response
`VC-LIVE-008`	MED (5.4)	Stored XSS (Guestbook)	Persistent payload stored in `mtxMessage` and rendered to viewers
`VC-LIVE-009`	HIGH (8.2)	Predictable Session ID	Sequential `dvwaSession` +1 increment proven across consecutive requests
`VC-LIVE-010`	HIGH (8.8)	CSRF Password Reset	State-changing `GET` password reset verified without anti-CSRF token
`VC-LIVE-011`	MED (6.5)	CAPTCHA Workflow Bypass	Direct `step=2` state-machine jump verified via auth oracle & restored
`VC-LIVE-012`	MED (5.4)	CSP Bypass & Injection	External script injection via permissive `Content-Security-Policy` & `include`
`VC-LIVE-013`	MED (6.5)	JS Token Reversal	Reversed `md5(rot13("success"))` client-side token & verified acceptance
`VC-LIVE-014`	MED (6.1)	DOM-Based XSS	Unescaped `location.href` sink into `document.write()` verified in browser