redteam

Agent-first adversarial software testing with verified, replayable evidence.

The first challenge tests tenant isolation in a disposable HTTP application. A normal user in tenant A tries to read a private document belonging to tenant B. The vulnerable fixture omits an ownership check; the fixed fixture enforces it. An independent verifier compares actual responses with private seeded content.

Try the milestone

From the repository root, with the pinned tools installed:

pnpm install --frozen-lockfile
pnpm build
node packages/redteam/dist/cli.mjs demo

The JSON result has status: "passed" when the vulnerable run captures the flag, the same requests fail to capture it against the fixed fixture, and ordinary tenant A reads still work. Each run uses a fresh loopback server, credentials, and private content. The server is closed after execution, including on errors.

demo uses a deterministic request plan to exercise the full pipeline. An agent runtime is not bundled; the factory's agent can use challenge, construct its own plan, and call run and replay.

Agent workflow

node packages/redteam/dist/cli.mjs challenge
node packages/redteam/dist/cli.mjs run \
  --plan packages/redteam/examples/tenant-isolation/plan.json \
  --version vulnerable > /tmp/redteam-attempt.json
node packages/redteam/dist/cli.mjs replay \
  --result /tmp/redteam-attempt.json \
  --version fixed > /tmp/redteam-replay.json

After installing the package, use the redteam executable instead of the local entry point. All commands except help emit JSON. Errors in arguments or input files emit JSON on stderr.

| Exit code | Meaning | | --------- | ------------------------------------------------------------------------------------------- | | 0 | Attempt completed, or the demo passed; a completed attempt may contain a verified violation | | 1 | Invalid arguments, unreadable input, or malformed plan/artifact | | 2 | Attempt execution failed, or the demo's assertions failed |

Inspect verification.status for the security result. no-violation-observed means only that these requests did not disclose the seeded content. It is not a claim that the application is secure. A failed attempt without verified evidence is inconclusive.

Library

import { replayAttempt, runAttempt } from "redteam"

const result = await runAttempt(
	{
		schemaVersion: 1,
		challengeId: "tenant-isolation",
		requests: [{ method: "GET", path: "/documents/doc-b" }],
	},
	"vulnerable",
)

const replay = await replayAttempt(result, "fixed")

The public entry point also exports getTenantIsolationChallenge, parseAttemptPlan, runMilestone, and the TypeScript contracts. Invalid inputs reject before starting an environment; execution failures return an AttemptResult with status: "failed" and a structured error.

See the challenge guide for the trust boundary, result format, and limitations; the agent playbook for operating instructions; and test contracts for public versus private coverage.