Rhodawk Agent
fix(playbook §10): resolve all 12 diagnostic warnings W-001..W-012\n\n W-001 CRITICAL: Add scripts/generate_stubs.sh + Makefile to generate\n openclaude_grpc/openclaude_pb2*.py locally without a full Docker build.\n W-002 HIGH: Delete dead Rhodawk_AI_Pitch_Deck_2026.pptx (operator request).\n W-003 HIGH: Rename mcp_config.json -> mcp_config.ARCHIVE.json with archive notice.\n W-004 HIGH: formal_verifier.py — RHODAWK_Z3_ENABLED defaults to true; loud warning if skipped.\n W-005 MEDIUM: Surface RHODAWK_AUTO_MERGE state in System Status banner.\n W-006 MEDIUM: training_store.PgConn.executescript() splits multi-stmt SQL.\n W-007 MEDIUM: webhook_server returns 403 + JSON when secret unset.\n W-008 MEDIUM: hermes_orchestrator — new HERMES_PROVIDER routing flag.\n W-009 MEDIUM: New night_hunt_lock.py shared mutex across both night-hunt loops.\n W-010 MEDIUM: repo_harvester uses dynamic 30-day rolling pushed window.\n W-011 MEDIUM: lora_scheduler emits Telegram/Slack notification on export.\n W-012 MEDIUM: Live Operations tab shows System Status feature-gate banner.
6ed9a00 | { | |
| "_W003_ARCHIVE_NOTICE": [ | |
| "This file is ARCHIVED and NOT used at runtime.", | |
| "The runtime MCP config is generated by write_mcp_config() in app.py", | |
| "and written to /tmp/mcp_runtime.json at the start of every audit.", | |
| "Removed entries (kept here for historical reference only):", | |
| " - aider-patcher (replaced by OpenClaude)", | |
| " - postgres-intelligence (npm package 404)", | |
| " - atheris-fuzzer (requires Clang+libFuzzer, unavailable on HF Spaces)", | |
| "Resolves W-003 (HIGH) from FOUNDER_PLAYBOOK.md section 10." | |
| ], | |
| "_comment": [ | |
| "TEMPLATE ONLY \u2014 contains NO secrets.", | |
| "Actual runtime config is written to /tmp/mcp_runtime.json at startup.", | |
| "Secrets injected from HF Space env vars \u2014 never committed.", | |
| "FETCH_ALLOWED_DOMAINS prevents SSRF against internal services.", | |
| "Rhodawk AI v6.0 \u2014 37 cybersecurity MCP server suite (12 new in v6 per Masterplan \u00a78)." | |
| ], | |
| "mcpServers": { | |
| "fetch-docs": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-fetch" | |
| ], | |
| "description": "Fetch security docs, CVE advisories, exploit PoCs, and vendor bulletins", | |
| "env": { | |
| "FETCH_ALLOWED_DOMAINS": "docs.python.org,pypi.org,docs.github.com,packaging.python.org,peps.python.org,cwe.mitre.org,nvd.nist.gov,owasp.org,portswigger.net,hackerone.com,bugcrowd.com,cve.org,exploit-db.com,docs.rs,go.dev,nodejs.org,developer.mozilla.org,shodan.io,virustotal.com,osv.dev,snyk.io,vulners.com,seclists.org,packetstormsecurity.com,securityfocus.com,cisa.gov,zerodayinitiative.com,huntr.com,intigriti.com,yeswehack.com,vdp.hackerone.com,api.github.com,raw.githubusercontent.com,archive.org,web.archive.org,semgrep.dev,rules.semgrep.dev,github.com,security.snyk.io,opencve.io,vuldb.com,rapid7.com,metasploit.com,www.rapid7.com" | |
| } | |
| }, | |
| "github-manager": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-github" | |
| ], | |
| "description": "GitHub API: create PRs, open security advisories, manage issues, query commit history", | |
| "env": { | |
| "GITHUB_PERSONAL_ACCESS_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "filesystem-research": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-filesystem", | |
| "/data/repo", | |
| "/tmp/research", | |
| "/tmp/findings" | |
| ], | |
| "description": "Read-only access to cloned repos, research scratch space, and findings output" | |
| }, | |
| "memory-store": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-memory" | |
| ], | |
| "description": "Persistent knowledge graph \u2014 stores exploit chains, CWE patterns, and cross-session vulnerability memory" | |
| }, | |
| "sequential-thinking": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-sequential-thinking" | |
| ], | |
| "description": "Structured chain-of-thought for complex multi-step vulnerability analysis and exploit reasoning" | |
| }, | |
| "web-search": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-brave-search" | |
| ], | |
| "description": "Search CVEs, exploit PoCs, vendor advisories, bug bounty writeups, and security research papers", | |
| "env": { | |
| "BRAVE_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "git-forensics": { | |
| "command": "mcp-server-git", | |
| "args": [ | |
| "--repository", | |
| "/data/repo" | |
| ], | |
| "description": "Deep git history analysis: silent security patches (CAD), blame tracking, commit anomaly detection" | |
| }, | |
| "postgres-intelligence": { | |
| "command": "npx", | |
| "args": [ | |
| "-y", | |
| "@modelcontextprotocol/server-postgres" | |
| ], | |
| "description": "Query findings DB, scan history, and vulnerability intelligence store", | |
| "env": { | |
| "DATABASE_URL": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "sqlite-findings": { | |
| "command": "mcp-server-sqlite", | |
| "args": [ | |
| "--db-path", | |
| "/data/rhodawk_findings.db" | |
| ], | |
| "description": "Local findings store \u2014 fast queries on vulnerability metadata, CVSS scores, and bounty estimates" | |
| }, | |
| "nuclei-scanner": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "nuclei,nuclei-templates" | |
| ], | |
| "description": "Nuclei template-based vulnerability scanner \u2014 DAST, CVE detection, misconfig scanning", | |
| "env": { | |
| "NUCLEI_TEMPLATES_PATH": "/data/nuclei-templates", | |
| "NUCLEI_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "semgrep-sast": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "semgrep" | |
| ], | |
| "description": "Semgrep SAST \u2014 taint analysis, CWE pattern matching, secrets detection across 30+ languages", | |
| "env": { | |
| "SEMGREP_APP_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "trufflehog-secrets": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "trufflehog" | |
| ], | |
| "description": "TruffleHog v3 \u2014 high-signal secret scanning with 700+ detectors across git history" | |
| }, | |
| "bandit-sast": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "bandit" | |
| ], | |
| "description": "Bandit Python SAST \u2014 AST-level detection of dangerous patterns, injection sinks, insecure APIs" | |
| }, | |
| "pip-audit-sca": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "pip-audit,pip" | |
| ], | |
| "description": "pip-audit SCA \u2014 known vulnerabilities in Python dependencies via OSV and PyPI Advisory DB" | |
| }, | |
| "osv-scanner": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "osv-scanner" | |
| ], | |
| "description": "OSV Scanner \u2014 multi-ecosystem SCA using the Open Source Vulnerability database (Google)" | |
| }, | |
| "z3-formal-verifier": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "python3" | |
| ], | |
| "description": "Z3 SMT solver \u2014 formal verification of integer bounds, overflow invariants, protocol properties" | |
| }, | |
| "hypothesis-fuzzer": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "python3,pytest,hypothesis" | |
| ], | |
| "description": "Hypothesis PBT fuzzer \u2014 property-based testing for arithmetic overflow, encoding, aliasing bugs" | |
| }, | |
| "atheris-fuzzer": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "python3,atheris" | |
| ], | |
| "description": "Atheris coverage-guided fuzzer \u2014 libFuzzer-backed Python fuzzing for parser and protocol bugs" | |
| }, | |
| "angr-symbolic": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "python3" | |
| ], | |
| "description": "angr symbolic execution \u2014 binary analysis, path exploration, constraint solving for native exploits" | |
| }, | |
| "radon-complexity": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "radon" | |
| ], | |
| "description": "Radon AST complexity analysis \u2014 cyclomatic complexity, Halstead metrics, attack surface ranking" | |
| }, | |
| "ruff-linter": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "ruff" | |
| ], | |
| "description": "Ruff ultra-fast Python linter \u2014 detects anti-patterns that correlate with security bugs" | |
| }, | |
| "aider-patcher": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "aider" | |
| ], | |
| "description": "Aider AI code editor \u2014 applies LLM-generated patches with diff verification and test re-run", | |
| "env": { | |
| "OPENROUTER_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "cve-intelligence": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-fetch" | |
| ], | |
| "description": "NVD/NIST CVE API \u2014 fetch full CVE details, CVSS vectors, CWE mappings, affected versions", | |
| "env": { | |
| "FETCH_ALLOWED_DOMAINS": "nvd.nist.gov,cve.org,cve.mitre.org,www.cvedetails.com,vulners.com,osv.dev,opencve.io", | |
| "NVD_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "bounty-platform": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-fetch" | |
| ], | |
| "description": "Bug bounty platform APIs \u2014 HackerOne report submission, GitHub Security Advisories, Bugcrowd", | |
| "env": { | |
| "FETCH_ALLOWED_DOMAINS": "api.hackerone.com,api.bugcrowd.com,api.intigriti.com,api.yeswehack.com,api.github.com", | |
| "HACKERONE_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__", | |
| "HACKERONE_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "supply-chain-monitor": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-fetch" | |
| ], | |
| "description": "Supply chain security \u2014 PyPI typosquatting, dependency confusion, malicious package detection", | |
| "env": { | |
| "FETCH_ALLOWED_DOMAINS": "pypi.org,api.pypi.org,registry.npmjs.org,crates.io,deps.dev,socket.dev,api.socket.dev" | |
| } | |
| }, | |
| "reconnaissance-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.reconnaissance_mcp" | |
| ], | |
| "description": "Mythos: language/framework/dependency fingerprinting + attack-surface enumeration" | |
| }, | |
| "static-analysis-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.static_analysis_mcp" | |
| ], | |
| "description": "Mythos: Tree-sitter CPG, Joern, CodeQL, Semgrep \u2014 deep semantic static analysis" | |
| }, | |
| "dynamic-analysis-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.dynamic_analysis_mcp" | |
| ], | |
| "description": "Mythos: AFL++, KLEE, QEMU, Frida, GDB \u2014 coverage-guided + symbolic + instrumented dynamic analysis" | |
| }, | |
| "exploit-generation-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.exploit_generation_mcp" | |
| ], | |
| "description": "Mythos: Pwntools, ROPGadget, heap kit, privesc KB \u2014 autonomous PoC synthesis" | |
| }, | |
| "vulnerability-database-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.vulnerability_database_mcp" | |
| ], | |
| "description": "Mythos: NVD, OSV, Exploit-DB lookup for prior-art correlation" | |
| }, | |
| "web-security-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.web_security_mcp" | |
| ], | |
| "description": "Mythos: OWASP ZAP, nuclei, sqlmap orchestration for web targets" | |
| }, | |
| "browser-agent-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.browser_agent_mcp" | |
| ], | |
| "description": "ARCHITECT: Playwright-driven live browser for web app testing (navigate/click/inject/screenshot)" | |
| }, | |
| "scope-parser-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.scope_parser_mcp" | |
| ], | |
| "description": "ARCHITECT: HackerOne / Bugcrowd / Intigriti scope ingestion for night-mode", | |
| "env": { | |
| "HACKERONE_USERNAME": "__INJECTED_BY_APP_AT_RUNTIME__", | |
| "HACKERONE_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__", | |
| "BUGCROWD_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__", | |
| "INTIGRITI_API_TOKEN": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "subdomain-enum-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.subdomain_enum_mcp" | |
| ], | |
| "description": "ARCHITECT: subfinder + amass + dnsx + crt.sh subdomain enumeration" | |
| }, | |
| "httpx-probe-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.httpx_probe_mcp" | |
| ], | |
| "description": "ARCHITECT: httpx live-host probe + tech fingerprint" | |
| }, | |
| "shodan-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.shodan_mcp" | |
| ], | |
| "description": "ARCHITECT: Shodan internet-exposure lookup", | |
| "env": { | |
| "SHODAN_API_KEY": "__INJECTED_BY_APP_AT_RUNTIME__" | |
| } | |
| }, | |
| "wayback-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.wayback_mcp" | |
| ], | |
| "description": "ARCHITECT: Wayback / CommonCrawl historical URL recall" | |
| }, | |
| "frida-runtime-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.frida_runtime_mcp" | |
| ], | |
| "description": "ARCHITECT: live Frida instrumentation sessions (mobile / native runtime)" | |
| }, | |
| "ghidra-bridge-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.ghidra_bridge_mcp" | |
| ], | |
| "description": "ARCHITECT: headless Ghidra / radare2 binary analysis bridge" | |
| }, | |
| "can-bus-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.can_bus_mcp" | |
| ], | |
| "description": "ARCHITECT: automotive CAN-bus + UDS (ISO 14229) wrapper" | |
| }, | |
| "sdr-analysis-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.sdr_analysis_mcp" | |
| ], | |
| "description": "ARCHITECT: GNU Radio / rtl_sdr scripted RF capture & analysis" | |
| }, | |
| "skill-selector-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.skill_selector_mcp" | |
| ], | |
| "description": "Rhodawk: semantic skill selection (MiniLM) \u2014 brain extension on demand" | |
| }, | |
| "trufflehog-deep-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "trufflehog,git" | |
| ], | |
| "description": "TruffleHog deep scan over full git history (all commit depths)" | |
| }, | |
| "gitleaks-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "gitleaks,git" | |
| ], | |
| "description": "Gitleaks \u2014 complementary secret scanner with custom rules" | |
| }, | |
| "semgrep-pro-patterns-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "semgrep" | |
| ], | |
| "description": "Semgrep with p/security-audit + p/owasp-top-ten + p/cwe-top-25 rulesets", | |
| "env": { | |
| "SEMGREP_RULES": "p/security-audit p/owasp-top-ten p/cwe-top-25 p/r2c-security-audit" | |
| } | |
| }, | |
| "jwt-analyzer-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.jwt_analyzer_mcp" | |
| ], | |
| "description": "JWT alg:none, weak-secret brute, key confusion, missing exp/nbf" | |
| }, | |
| "api-fuzzer-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "restler,dredd,schemathesis" | |
| ], | |
| "description": "Stateful REST/GraphQL API fuzzer (RESTler/Dredd/Schemathesis)" | |
| }, | |
| "solidity-auditor-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "slither,myth,solc" | |
| ], | |
| "description": "Smart-contract static analysis: Slither + Mythril" | |
| }, | |
| "dependency-confusion-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.dep_confusion_mcp" | |
| ], | |
| "description": "Detect dependency-confusion vectors (npm + PyPI manifests)" | |
| }, | |
| "git-forensics-deep-mcp": { | |
| "command": "uvx", | |
| "args": [ | |
| "mcp-server-shell", | |
| "--allow-commands", | |
| "git-dumper,git" | |
| ], | |
| "description": "Exposed .git directories + incomplete .gitignore detection" | |
| }, | |
| "openapi-analyzer-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.openapi_analyzer_mcp" | |
| ], | |
| "description": "Parse OpenAPI/Swagger and enumerate attack surface" | |
| }, | |
| "cors-analyzer-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.cors_analyzer_mcp" | |
| ], | |
| "description": "CORS misconfiguration: origin reflection, null origin, wildcard+credentials" | |
| }, | |
| "prototype-pollution-mcp": { | |
| "command": "python", | |
| "args": [ | |
| "-m", | |
| "mythos.mcp.prototype_pollution_mcp" | |
| ], | |
| "description": "JS prototype-pollution sink scanner (AST-style grep)" | |
| } | |
| } | |
| } |