Riciplay

AI-powered bug bounty reconnaissance and penetration testing agent. This npm package is a launcher for the Python implementation (riciplay-cli on PyPI) — postinstall installs it via pip, and the riciplay command behaves identically to a native pip install.

What it does

• Agent sessions — an AI agent that plans and executes full investigations: recon → browsing → interception → findings
• Real browser control — trusted-input mouse/keyboard (hover menus, slider drags, canvas clicks), form-state autosave/restore, Cloudflare handling
• MiniProxy v4 interception — capture with TTFB/total timing, scope guard, Burp-style replay with response diffing, bounded payload sweeps
• Recon pipeline — subdomain/endpoint/tech discovery with durable per-program storage
• Notebook + findings — evidence-linked reporting across sessions

Install

npm install -g riciplay
# or the native Python path:
pip install riciplay-cli

Requires Python 3.10+ (installed automatically when possible). Chrome and mitmproxy integrations are pulled in as Python dependencies.

Usage

riciplay login        # interactive login with key
riciplay chat         # start an agent session

The npm wrapper

bin/riciplay prefers the pip-installed console script on PATH and falls back to invoking riciplay_cli.main:app through python3. scripts/postinstall.js pip-installs riciplay-cli if the module isn't importable — and degrades to a printed manual instruction when it can't (no network, --ignore-scripts, managed Python).

Repository: Zaidux/Riciplay