RedAmon Files

Added

• Multi-Provider LLM Support — the agent now supports 4 AI providers (OpenAI, Anthropic, OpenRouter, AWS Bedrock) with 400+ selectable models. Models are dynamically fetched from each provider's API and cached for 1 hour. Provider is auto-detected via a prefix convention (openrouter/, bedrock/, claude-*, or plain OpenAI)
• Dynamic Model Selector — replaced the hardcoded 11-model dropdown with a searchable, provider-grouped model picker in Project Settings. Type to filter across all providers instantly; each model shows name, context window, and pricing info
• GET /models API Endpoint — new agent endpoint that fetches available models from all configured providers in parallel. Proxied through the webapp at /api/models
• model_providers.py — new provider discovery module with async fetchers for OpenAI, Anthropic, OpenRouter, and AWS Bedrock APIs, with in-memory caching (1h TTL)
• Stealth Mode — new per-project toggle that forces the entire pipeline to use only passive and low-noise techniques:
• Recon: disables Kiterunner and banner grabbing, switches Naabu to CONNECT scan with rate limiting, throttles httpx/Katana/Nuclei, disables DAST and interactsh callbacks
• Agent: injects stealth rules into the system prompt — only passive/stealthy methods allowed, agent must refuse if stealth is impossible
• GVM scanning disabled in stealth mode (generates ~50K active probes per target)
• Stealth Mode UI — toggle in Target section of Project Settings with description of what it does
• Kali Sandbox Tooling Expansion — 15+ new packages installed in the Kali container: netcat, socat, rlwrap, exploitdb, john, smbclient, sqlmap, jq, gcc, g++, make, perl, go
• kali_shell MCP Tool — direct Kali Linux shell command execution, available in all phases
• execute_code MCP Tool — run custom Python/Bash exploit scripts on the Kali sandbox
• msf_restart MCP Tool — restart Metasploit RPC daemon when it becomes unresponsive
• execute_nmap MCP Tool — deep service analysis, OS fingerprinting, NSE scripts (consolidated from previous naabu-only setup)
• MCP Server Consolidation — merged curl and naabu servers into a unified network_recon_server.py, added dedicated nmap_server.py, fixed tool loading race condition
• Failure Loop Detection — agent detects 3+ consecutive similar failures and injects a pivot warning to break out of unproductive loops
• Prompt Token Optimization — lazy no-module fallback injection (saves ~1.1K tokens), compact formatting for older execution trace steps (full output only for last 5), trimmed rarely-used wordlist tables
• Metasploit Prewarm — pre-initializes Metasploit console on agent startup to reduce first-use latency
• Markdown Report Export — download the full agent conversation as a formatted Markdown file
• Brute Force & CVE Exploit Settings — new Project Settings sections for configuring brute force speed/wordlist limits and CVE exploit attack path parameters
• Node.js Deserialization Guinea Pig — new test environment for CVE-2017-5941 (node-serialize RCE)
• Phase Tools Tooltip — hover on phase badges to see which MCP tools are available in that phase
• GitHub Secrets Suggestion — new suggestion button in AI Assistant to leverage discovered GitHub secrets during exploitation

Changed

• Agent Orchestrator — rewritten _setup_llm() with 4-way provider detection (OpenAI, Anthropic, OpenRouter via ChatOpenAI + custom base_url, Bedrock via ChatBedrockConverse with lazy import)
• Model Display — formatModelDisplay() helper cleans up prefixed model names in the AI Assistant badge and markdown export (e.g., openrouter/meta-llama/llama-4-maverick → llama-4-maverick (OR))
• Prompt Architecture — tool registry extracted into dedicated tool_registry.py, attack path prompts (CVE exploit, brute force, post-exploitation) significantly reworked for better token efficiency and exploitation success rates
• curl-based Exploitation — expanded curl-based vulnerability probing and no-module fallback workflows for when Metasploit modules aren't available
• kali_shell & execute_nuclei — expanded to all phases (previously restricted)
• GVM Button — disabled in stealth mode with tooltip explaining why
• README — extensive updates: 4-provider documentation, AI Model Providers section, Kali sandbox tooling tables, new badges (400+ AI Models, Stealth Mode, Full Kill Chain, 30+ Security Tools, 9000+ Vuln Templates, 170K+ NVTs, 180+ Settings), version bump to v1.3.0