/agentic

RAPTOR full autonomous security workflow

Overview

The /agentic command runs RAPTOR’s fully autonomous security testing workflow. It combines scanning, validation, analysis, exploit generation, and patch generation into a single end-to-end pipeline.

This is RAPTOR’s most powerful command. It autonomously performs the entire security research workflow without manual intervention.

Syntax

python3 raptor.py agentic --repo <path> [options]

Parameters

repo · string · required

Absolute path to the code repository to analyze

max-findings · integer

Maximum number of findings to process (default: unlimited)

skip-validation · boolean

Skip Phase 2 exploitability validation (not recommended)

no-exploits · boolean

Skip exploit generation (patch generation only)

no-patches · boolean

Skip patch generation (exploit generation only)

sarif · string

Use existing SARIF file instead of running new scan

Workflow Phases

The agentic workflow executes these phases automatically:

Phase 1: Scanning

• Runs Semgrep and CodeQL static analysis
• Generates SARIF files with findings
• Deduplicates identical vulnerabilities

Phase 2: Validation (NEW)

Phase 2 validation is automatically enabled in agentic mode. It filters out false positives before expensive exploit generation.

• Validates that findings are real and reachable
• Checks exploitability constraints
• Filters out test code and dead code
• See /validate command for details

Phase 3: Analysis

• LLM-based deep analysis of each finding
• Adversarial thinking and attack surface mapping
• Exploitability assessment
• Root cause identification

Phase 4: Exploit Generation

• Generates proof-of-concept exploit code
• Creates working exploits in Python, C, or pwntools
• Validates exploitability constraints
• Saved to out/*/exploits/

Phase 5: Patch Generation

• Generates secure patches for each vulnerability
• Provides fix recommendations
• Creates patch files ready to apply
• Saved to out/*/patches/

Examples

Full Autonomous Workflow

python3 raptor.py agentic --repo /path/to/code

Runs complete workflow: scan → validate → analyze → exploit → patch.

Limited Findings

python3 raptor.py agentic --repo /path/to/code --max-findings 10

Processes only the first 10 findings for quick results.

Exploit Generation Only

python3 raptor.py agentic --repo /path/to/code --no-patches

Generates exploits but skips patch generation.

Patch Generation Only

python3 raptor.py agentic --repo /path/to/code --no-exploits

Generates patches but skips exploit generation.

Using Existing SARIF

python3 raptor.py agentic --repo /path/to/code --sarif findings.sarif --max-findings 5

Analyzes pre-existing scan results without re-scanning.

Skip Validation (Not Recommended)

python3 raptor.py agentic --repo /path/to/code --skip-validation

Bypasses validation phase (may waste time on false positives).

Output Structure

out/agentic_<timestamp>/
├── findings.sarif           # Scan results
├── validation/             # Validation reports
│   ├── findings.json
│   ├── attack-tree.json
│   └── validation-report.md
├── analysis/               # LLM analysis
│   └── analysis-report.md
├── exploits/              # Generated PoCs
│   ├── exploit-001.py
│   ├── exploit-002.c
│   └── README.md
└── patches/               # Secure fixes
    ├── patch-001.diff
    ├── patch-002.diff
    └── README.md

Use Cases

• Comprehensive security audits
• Automated vulnerability discovery and exploitation
• Security research and analysis
• Patch development
• Red team operations
• Bug bounty hunting

Safety Features

Nothing is applied to your code automatically. All exploits and patches are generated in the out/ directory for review.

• Exploits are only generated in the output directory
• Patches are not automatically applied
• All changes require manual review and approval
• No destructive operations on source code

Performance Considerations

• Full workflow can take 30-60 minutes for large codebases
• Use --max-findings to limit processing time
• Phase 2 validation adds 5-10 minutes but prevents wasted effort
• Skip validation only if you trust scanner output completely

Related Commands

/scan

Quick static analysis only

/validate

Standalone validation pipeline

/exploit

Exploit generation only

/patch

Patch generation only

Notes

• Phase 2 validation is enabled by default (use --skip-validation to disable)
• For defensive security research, education, and authorized penetration testing
• Review all generated exploits and patches before use
• Exploits are for educational and research purposes only