sapper-v2

Overview

sapper-v2 is a multi-agent orchestration harness for autonomous penetration testing, not a single agent. It lets an AI commander read the board, decide, and dispatch while general, scout, and soldier agents work in parallel in tmux sessions, with a zero-strategy watchdog keeping the run alive. Knowledge is written to a layered fact-intent graph that survives individual agent sessions. The README says agents and models can be swapped behind each role and that the project was designed for competition scenarios.

Key Features

• Commander, general, scout, and soldier division of labor, with a watchdog process for keep-alive and a commander that does not execute attacks itself.
• Layered fact-intent graph with title, summary, and evidence-document layers for shared memory and context control.
• Create, Language, and History capabilities: spawn new AI sessions via tmux, type into each other's input boxes, and persist knowledge in the graph.
• Model tiering: commander and generals on GLM-5.3, soldiers and scouts on DeepSeek V4.1 Flash.
• Swappable agent CLI and model per role, with role composition defined in the doctrine.
• Emergent roles and practices reported by the project, including a signalman, performance reviews, and inherited lessons.

Use Cases

• Competition CTF scenarios such as the Tencent Intelligent Attack-Defense Challenge.
• Authorized penetration-testing campaigns where a commander coordinates parallel agents against a target.
• Forking and replacing the competition doctrine for other long-horizon cooperative work such as office, research, or engineering.
• Building on the nvwabase foundation for general-purpose multi-agent work with Create, Language, and History.

Getting Started

• Run bash install.sh to symlink the sapper CLI; the install is stdlib-only with zero dependencies.
• Run sapper setup with a goal and --agents to initialize the board and ready-to-work frontier.
• Run sapper status to view the board and frontier.
• For the full legion, build with docker build -f docker/Dockerfile.commander -t sapper:latest . or load the pre-built image from the v18-champion release.

Deployment & Requirements

• The full legion requires Docker; options are building from docker/Dockerfile.commander or loading the pre-built image (~1.2GB, full Kali toolchain plus sapper and offline KB).
• Configure model gateways, key pool, and budget through environment variables as documented in docker/ENV.md.
• The sapper CLI install is stdlib-only with zero dependencies.
• tmux is used to run AI sessions in panes.

Before You Adopt

• License: MIT. Review its terms before using, modifying, or distributing the project.
• Use is restricted to authorized security testing.
• The project is explicitly designed for competition scenarios.
• The README offers forking the project as an option for using the mechanism outside its competition design.