Mantishack

---
description: One-shot MAXIMAL autonomous pentest — the full scan+validate pipeline PLUS a parallel red-team agent war-game, adversarially verified and stitched into a kill-chain Red Team Report.
---

# /mantishack — Maximal Autonomous Red-Team Pentest

The single most powerful entrypoint in the framework. **One target in, a kill-chain Red Team
Report out.** It fuses the deterministic `/agentic` + `/validate` pipeline (Semgrep + CodeQL + SCA +
dataflow + Stages 0→F) with a **parallel red-team agent war-game** — seven adversarial personas
spawned via the Task tool, each attacking the target through a different lens — then adversarially
verifies every finding to kill false positives and stitches confirmed bugs into end-to-end attack
chains.

/mantishack <repo-path | git-url | host> [--scope "..."] [--authorized] [--deep] [--relentless] [--rounds N] [--model M ...] [--consensus M] [--judge M] [--binary] [--exploit] [--patch]

> **Load the `redteam-hunting` skill before Phase 1** — it is the continuous-loop engine that drives
> the war-game to *convergence* (keep attacking until consecutive rounds find nothing new AND the
> attack surface is fully covered), so nothing is left on the table.

Nothing is applied to the target — every artifact is generated under `out/`. Exploit PoCs and
patches are only produced with `--exploit` / `--patch`, and exploitation is never *run* without an
explicit confirmation.

---

## ⛔ Authorization gate (MANDATORY — do this first)

This command is offensive. Before Phase 0, confirm authorization **in this conversation**:

- The target must be one the user owns or is explicitly authorized to test (written scope, bug-bounty
  program, internal asset). If `--authorized` is absent and the target is a remote host/URL, **ask
  once** for confirmation and the scope, then proceed.
- Record the scope string in the run header. Treat anything outside it as out-of-bounds and refuse to
  touch it. If the target is a local repo path, authorization is assumed (it's the user's code).

---

## Phase 0 — Recon & seed corpus  *(mechanical, parallel)*

Build the attack-surface map and a high-recall seed-finding corpus that the red-team agents sharpen.

1. **Scan + audit** — run the deterministic pipeline; this owns scanner orchestration and selection:
   ```bash
   libexec/mantishack-agentic --repo "$TARGET" --understand            # Semgrep + CodeQL + auth/logging audit + dedup + prep

--understand makes it emit context-map.json (entry points, trust boundaries, sinks) as a sibling run — both the agentic checklist and the Phase 2 validator pick it up via the bridge. 2. SCA (if a manifest exists): /mantis-sca for vulnerable/compromised dependencies. 3. Web surface (if target is a URL): /mantis-web to crawl links, forms, params, JS endpoints.

Output of Phase 0: autonomous_analysis_report.json (seed findings with code, dataflow, feasibility) + context-map.json (the map). Hand both to every red-team agent below — they are the agents' starting corpus, not their ceiling.

---

Phase 1 — 🐲 RED-TEAM WAR GAME (parallel agent swarm — the core power feature)

Spawn the ten hunting personas concurrently via the Task tool, in a single message (they run in parallel). Each gets: the target path, the Phase 0 seed corpus, and context-map.json. Each is a different attacker mindset and finds the bugs deterministic scanners structurally cannot (logic flaws, broken authorization, trust-assumption breaks, multi-step chains). Skip any whose surface the target lacks (e.g. no CI config → skip supply-chain-saboteur):

Persona (Task subagent)	War-game lens	Primarily surfaces
threat-actor-wargame	"build the cheapest kill chain to the crown jewels"	initial-access → privesc → impact paths
insider-betrayal-sim	"a trusted user / dependency turns hostile"	IDOR / BOLA / BFLA, privesc, supply-chain hooks
single-point-of-compromise	"where does ONE bug = total compromise"	secret stores, auth middleware, deserializers, SSRF egress
threat-landscape-shift	"what emerging attack breaks today's defenses"	desync/smuggling, dep-confusion, prompt-injection & tool-abuse
assumption-pressure-test	"attack every implicit trust assumption"	confused-deputy, parser differentials, mass-assignment, 2nd-order injection
llm-agent-abuse	"coerce the AI/agent surface"	prompt injection (direct + indirect/RAG), tool-call hijack, model-output → eval/SQL/shell, secret leakage
workflow-abuse-economist	"abuse the business logic, not the bug"	price/coupon/quota/refund tampering, free-trial re-abuse, state-machine skips
federated-identity-breaker	"break the SSO handshake, not the JWT"	OAuth redirect_uri/state theft, PKCE downgrade, SAML XSW, account-linking takeover
http-edge-desync	"make two HTTP hops disagree"	request smuggling (CL.TE/TE.CL/CL.0), cache poisoning, cache deception
supply-chain-saboteur	"own the build, own everything"	poisoned-pipeline execution, runner secret exfil, dependency confusion, container escape

Each persona returns findings in the standard block (## [SEVERITY] … Location / Type / Attack vector / Impact / PoC / Reachability / Remediation).

Continuous loop until converged — run by the redteam-hunting skill (load it now). Maintain a coverage ledger under $OUTPUT_DIR/hunt/: every attack-surface unit (source, sink, route, trust-boundary, auth-check, deserializer, secret), seeded from context-map.json, tagged unexplored / explored / finding. Each round:

1. Prioritize unexplored units (crown-jewel-adjacent first) and re-spawn the hunters against them, passing the findings + dead_ends ledgers as exclusion lists (never re-chase a disproven lead, never re-report a dup).
2. **Rotate the