t3mp3st/FEATURES.md

T3MP3ST Feature Documentation

Comprehensive feature list for the Tactical Execution Multi-agent Platform for Elite Security Testing

Legend:

• Implemented and working
• [~] Partially implemented / stub
• Planned / ideal feature

---

Table of Contents

1. Core Architecture
2. LLM Backbone
3. Operator System (Agents)
4. Mission Control
5. Target Environment
6. Arsenal (Tools)
7. Pliny Specials
8. Evidence Vault
9. OPSEC Layer
10. Communications
11. Analysis & Reporting
12. CLI Interface
13. API Server
14. MCP Server (Agent Integration)
15. Web UI Dashboard
16. Advanced Modules
17. Configuration System
18. Integration & Extensibility

---

1. Core Architecture

TempestCommand Orchestrator

• Central command class extending EventEmitter
• Lifecycle management (start, stop, pause, resume)
• Tick-based execution loop
• Event emission for all major actions
• Status reporting and health checks
• [~] Hooks system for lifecycle events
• Distributed command across multiple nodes
• State persistence and recovery after crash

Factory Functions

• createTempest() - Standard operation
• createTestTempest() - Testing with mock LLM
• createAutoTempest() - Auto-configured with best available LLM
• createStealthOperation() - Silent OPSEC preset
• createAggressiveOperation() - Loud OPSEC preset
• createDistributedTempest() - Multi-node operation
• createCloudTempest() - Cloud-native deployment

Event System

• command:started / command:stopped
• command:paused / command:resumed
• operator:spawned / operator:burned
• finding:discovered
• credential:harvested
• target:owned
• detection:triggered
• mission:phase_changed
• abort:recommended
• chain:completed - Full kill chain success
• exfil:complete - Data exfiltration finished

---

2. LLM Backbone

Provider Support

• OpenRouter - Multi-model gateway (50+ models)
• Anthropic - Direct Claude API
• OpenAI - GPT models
• Mock - Testing without API
• Local - Ollama support
• Azure OpenAI - Enterprise deployment
• AWS Bedrock - Claude via AWS
• Google Vertex AI - Gemini via GCP

Model Registry (50+ models configured)

• Claude Opus 4.5, Sonnet 4.5, Sonnet 4
• GPT-4o, GPT-4 Turbo, o1
• Gemini 3 Pro, Gemini 3 Flash, Gemini 2.5 Flash
• Grok 4, Grok 4 Fast, Grok 4.1 Fast
• DeepSeek R1, DeepSeek V3
• Llama 3.3 70B
• Mistral Large
• GLM 4.7

LLM Features

• Chat completion with retry logic
• Conversation history management
• System prompt configuration
• Streaming responses (OpenRouter)
• Token usage tracking
• Provider validation
• Automatic provider selection
• Function calling / tool use
• Vision/multimodal support
• Embeddings for semantic search
• Fine-tuned model support
• Cost tracking and budgeting

---

3. Operator System (Agents)

8 Operator Archetypes

Archetype	Phase	MITRE Tactics	Status
RECON	Reconnaissance	TA0043	[x] Implemented
SCANNER	Discovery	TA0007	[x] Implemented
EXPLOITER	Initial Access	TA0001, TA0002	[x] Implemented
INFILTRATOR	Lateral Movement	TA0008, TA0004	[x] Implemented
EXFILTRATOR	Exfiltration	TA0009, TA0010	[x] Implemented
GHOST	Persistence	TA0003, TA0005	[x] Implemented
COORDINATOR	C2	TA0011	[x] Implemented
ANALYST	Reporting	-	[x] Implemented

Operator Features

• State management (idle, tasked, executing, cooldown, burned)
• Task assignment and completion tracking
• Detection risk monitoring
• Cooldown management
• Finding and credential recording
• Archetype-specific system prompts
• MITRE ATT&CK technique mapping
• [~] Autonomous decision making via LLM
• Inter-operator coordination
• Learning from past engagements
• Skill leveling system
• Custom archetype creation

Team Factories

• createBalancedTeam() - General purpose
• createStealthTeam() - Minimal detection
• createBreachTeam() - Aggressive initial access
• createAPTTeam() - Advanced persistent threat simulation
• createInsiderTeam() - Insider threat simulation
• createCloudTeam() - Cloud-focused operations

Operator Cell Management

• Spawn/despawn operators
• Status aggregation
• Count by status
• Automatic scaling based on workload
• Operator health monitoring
• Failover and replacement

---

4. Mission Control

Mission Lifecycle

• Create mission with objectives
• Start/pause/resume/complete/abort
• Rules of Engagement (RoE) enforcement
• Phase transitions
• [~] Objective tracking and completion
• Mission templates
• Multi-mission management
• Mission scheduling

Task Queue

• Priority-based task management
• Add/remove tasks
• Get next task (global or by archetype)
• Status updates
• Mission-scoped task queries
• Task dependencies
• Parallel task execution
• Task retry with backoff
• Deadline enforcement

Rules of Engagement

• Scope definition (in-scope targets)
• Forbidden techniques list
• Detection event limits
• createDefaultRoE() preset
• createStrictRoE() preset
• Time-based restrictions
• Geographic restrictions
• Data handling rules
• Escalation procedures

Kill Chain Phases

• RECON - Reconnaissance
• WEAPONIZE - Weaponization
• DELIVER - Delivery
• EXPLOIT - Exploitation
• INSTALL - Installation
• C2 - Command & Control
• ACTIONS_ON_OBJECTIVES - Actions on Objectives
• Phase-to-archetype mapping
• Custom phase definitions
• Phase-specific tooling

---

5. Target Environment

Target Management

• Add/update/remove targets
• Status transitions (discovered → scanning → vulnerable → exploited → owned)
• Zone classification (external, dmz, internal, restricted)
• Type classification (web_app, api, server, network_device, etc.)
• Service and vulnerability tracking
• Statistics aggregation
• Asset discovery automation
• Network topology mapping
• Relationship tracking between targets

Target Factories

• createTargetFromUrl() - Parse URL into target
• createTargetFromIP() - Create from IP address
• createDMZArchitecture() - Sample architecture
• importFromNmap() - Import from Nmap XML
• importFromShodan() - Import from Shodan
• importFromCloud() - Import from AWS/GCP/Azure

Target Types

• web_application
• api
• server
• workstation
• network_device
• database
• cloud_service
• container
• iot_device
• mobile_app

---

6. Arsenal (Tools)

Built-in Tools

• dns_lookup - DNS resolution with multiple record types
• port_scan - Port scanning with service detection
• http_request - Full HTTP client with headers/body
• subdomain_enum - Subdomain enumeration
• dir_bruteforce - Directory bruteforcing with wordlists
• whois_lookup - Domain WHOIS lookup
• header_analysis - Security header analyzer
• technology_detect - Tech stack fingerprinting
• xss_scan - XSS vulnerability testing
• sqli_scan - SQL injection testing
• ssl_scan - TLS/SSL configuration analysis
• password_spray - Common password testing
• hash_crack - Hash identification and cracking
• base64_decode - Base64 decoding utility
• jwt_decode - JWT analysis with security checks
• vuln_scan - Comprehensive vulnerability scanning
• exploit_search - Exploit database search

Tool Management

• Tool registration
• Category-based filtering
• Tool execution with context
• Execution history tracking
• Custom tool support
• Tool chaining
• Tool output parsing
• Tool version management
• Tool health checks

Whitelisted CLI Tools (via API)

• nmap, curl, wget, dig, host, whois
• nikto, gobuster, ffuf, dirb
• sqlmap, wfuzz, hydra
• openssl, base64, xxd, strings
• file, exiftool, binwalk
• nuclei, subfinder, amass
• metasploit integration
• burp suite integration

---

7. Pliny Specials

The Nine Pliny Specials

Tool	Power	Type	Status
LEVIATHAN	99	Kill Chain Orchestrator	[x] MCP + API
SPHINX	88	Vulnerability Validator	[x] MCP + API
GORGON	92	Precision Exploitation	[x] MCP + API
CERBERUS	85	Privilege Escalation	[x] MCP + API
TYPHON	90	Payload Encoding	[x] MCP + API
GRIFFIN	95	Secret Harvesting	[x] MCP + API
SIMURGH	100	Zero-Day Research	[x] MCP + API
HYDRA	85	Multi-Vector Attacks	[x] MCP + API + UI
ARACHNE	87	Exploit Chaining	[x] MCP + API + UI

LEVIATHAN Features

• Engagement planning
• Phase orchestration
• Tool recommendations
• Autonomy levels (FULL, GUIDED, MANUAL)
• Real-time execution
• Progress tracking
• Abort/rollback capability

SPHINX Features

• Finding analysis
• False positive elimination
• PoC generation
• Confidence scoring
• Integration with major scanners
• Automated retesting
• Finding deduplication

GORGON Features

• Payload selection
• Delivery method planning
• Stealth rating calculation
• Mode selection (surgical, aggressive, stealth)
• Actual exploit execution
• Session management
• Post-exploitation hooks

TYPHON Features

• URL encoding (single/double)
• Base64 encoding
• Hex encoding
• Unicode escaping
• HTML entity encoding
• WAF bypass techniques
• Custom encoding chains
• Context-aware encoding
• Encoding detection/decode

GRIFFIN Features

• JWT extraction and decoding
• AWS credential detection
• GitHub token detection
• API key extraction
• Password pattern matching
• Private key detection
• Cloud credential validation
• Token expiry checking
• Credential spraying integration

SIMURGH Features

• Vulnerability class targeting
• Protection analysis
• Attack surface mapping
• Exploitation primitive identification
• Fuzzer integration
• Crash analysis
• Exploit development assistance

CERBERUS Features

• Linux privesc vectors (sudo, SUID, kernel, cron)
• Windows privesc vectors (UAC, services, tokens)
• Confidence scoring
• Recommended execution order
• Automated enumeration
• Exploit suggestion
• Success probability calculation

HYDRA Features

• Multi-vector coordination with 14 attack vectors
• Parallel attack planning with configurable heads
• Vector selection (SQLi, XSS, SSRF, SSTI, LFI, RCE, etc.)
• Priority scoring based on target type
• API integration for enhanced analysis
• Web UI integration with real-time status
• Comprehensive payload databases per vector
• Rate limiting
• Result aggregation
• Attack surface coverage metrics

ARACHNE Features

• Chain building from vulnerabilities
• Objective-based pathfinding (14 attack primitives)
• 8 strategic objectives with MITRE ATT&CK mapping
• 18 known exploit chains with CVE mappings
• Reliability and detection risk scoring
• Playbook generation with phases
• API integration for enhanced chains
• Web UI findChainsEnhanced() method
• Chain length limits
• Multiple chain generation
• Graph-based visualization
• Chain validation

---

8. Evidence Vault

Finding Management

• Create findings with severity
• CVSS score support
• Verification status tracking
• Query by severity/target/operator
• Evidence attachment
• Finding templates
• Duplicate detection
• Finding workflows (triage → verify → report)

Credential Management

• Credential storage
• Type classification (password, hash, token, key, certificate)
• Source tracking
• Query all credentials
• Credential validation
• Password cracking integration
• Credential rotation detection

Evidence Types

• Screenshots
• HTTP requests/responses
• Command output
• Files
• Network captures
• Video recordings
• Memory dumps
• Disk images

Severity Levels

• Critical (score: 10)
• High (score: 7.5)
• Medium (score: 5)
• Low (score: 2.5)
• Info (score: 0)
• CVSS to severity conversion

---

9. OPSEC Layer

OPSEC Levels

• Silent - Maximum stealth, 1 detection limit, 5min cooldown
• Covert - Balanced, 3 detection limit, 1min cooldown
• Loud - Speed priority, 20 detection limit, 2s cooldown

Detection Management

• Detection event recording
• Abort recommendation threshold
• Cooldown enforcement
• IOC (Indicator of Compromise) tracking
• Detection pattern analysis
• Evasion recommendations
• Real-time alert integration

OPSEC Features

• Traffic blending option
• Timing jitter
• Logging sanitization
• Cleanup on complete
• [~] Avoid detection heuristics
• TOR/proxy integration
• Domain fronting
• Traffic encryption
• Decoy traffic generation

OPSEC Presets

• createSilentOpsecConfig()
• createAggressiveOpsecConfig()
• createBalancedOpsecConfig()
• createAPTOpsecConfig()
• createRedTeamOpsecConfig()

---

10. Communications

Channel Types

• Broadcast - All operators
• Direct - One-to-one
• Team - Group channels
• Encrypted channels
• External C2 integration

Message Types

• Intel - Intelligence sharing
• Task - Task assignments
• Alert - Warnings
• Status - Status updates
• Finding - Finding reports
• Coordination - Team coordination
• Heartbeat - Health checks
• Emergency - Critical alerts

Comms Features

• Channel creation/closure
• Subscription management
• Message routing
• Message history
• Priority levels
• Message encryption
• Message acknowledgment
• Offline message queue

---

11. Analysis & Reporting

Report Types

• Executive summary
• Technical findings
• Full report
• Findings only
• Compliance report (PCI, HIPAA, SOC2)
• Remediation report
• Trend analysis

Report Features

• Risk rating calculation
• Attack path inference
• Recommendation generation
• Markdown export
• [~] HTML export
• PDF export
• DOCX export
• JSON/XML export

Analysis Features

• Severity aggregation
• Target coverage analysis
• Finding categorization
• CVSS calculation
• Risk scoring models
• Trend analysis over time
• Comparison with baselines

Executive Summary Includes

• Total findings by severity
• Risk rating (Critical/High/Medium/Low)
• Top recommendations
• Key findings highlights
• Business impact assessment
• Compliance status
• Remediation timeline

---

12. CLI Interface

Commands

• t3mp3st - Interactive mode (default)
• t3mp3st setup - Configuration wizard
• t3mp3st status - Show configuration
• t3mp3st test - Test LLM connection
• t3mp3st models - List available models
• t3mp3st run <mission> - Run mission file
• t3mp3st report <output> - Generate report
• t3mp3st import <file> - Import targets
• t3mp3st export <file> - Export findings

Interactive Mode Features

• Start new operation (4 presets)
• View status (operators, findings, OPSEC)
• Spawn operator (8 archetypes)
• Add target
• Create mission
• Chat with AI
• Generate report
• Stop operation
• Settings management
• Mission templates
• Batch operations
• Scripting support

UI Features

• Colored output (chalk)
• ASCII banner (figlet)
• Gradient text
• Progress spinners (ora)
• Interactive prompts (inquirer)
• Table display (cli-table3)
• Box formatting (boxen)

---

13. API Server

Server Configuration

• Express.js server
• Port 3333 (configurable)
• CORS enabled
• JSON body parsing
• Static file serving for UI

Health Endpoints

• GET /api/health - Server health
• GET /api/llm/status - LLM connection status

Pliny Endpoints

• POST /api/pliny/leviathan/engage - Kill chain orchestration
• POST /api/pliny/sphinx/validate - Vulnerability validation
• POST /api/pliny/gorgon/strike - Precision exploitation
• POST /api/pliny/typhon/inject - Payload encoding
• POST /api/pliny/griffin/harvest - Secret harvesting
• POST /api/pliny/simurgh/hunt - Zero-day research
• POST /api/pliny/cerberus/escalate - Privilege escalation
• POST /api/pliny/hydra/orchestrate - Multi-vector attacks
• POST /api/pliny/arachne/chain - Exploit chaining

Tool Endpoints

• POST /api/tools/execute - Execute whitelisted tool
• POST /api/tools/recon - Quick reconnaissance
• GET /api/tools - List available tools
• GET /api/tools/:id/history - Tool execution history

LLM Endpoints

• POST /api/llm/chat - Chat with LLM
• POST /api/llm/stream - Streaming chat
• GET /api/llm/models - List models

Missing Endpoints (Planned)

• GET /api/operators - List operators
• POST /api/operators - Spawn operator
• DELETE /api/operators/:id - Remove operator
• GET /api/targets - List targets
• POST /api/targets - Add target
• GET /api/findings - List findings
• GET /api/missions - List missions
• POST /api/missions - Create mission
• GET /api/reports - Generate report

---

14. MCP Server (Agent Integration)

MCP Tools Exposed

• pliny_leviathan - Kill chain orchestration
• pliny_sphinx - Vulnerability validation
• pliny_gorgon - Precision exploitation
• pliny_cerberus - Privilege escalation
• pliny_typhon - Payload encoding
• pliny_griffin - Secret harvesting
• pliny_simurgh - Zero-day research
• pliny_hydra - Multi-vector attacks
• pliny_arachne - Exploit chaining
• security_recon - Network reconnaissance

MCP Features

• Tool definitions with JSON Schema
• Tool execution handlers
• Stdio transport
• Error handling
• SSE transport
• WebSocket transport
• Authentication
• Rate limiting
• Usage tracking

Integration Support

• Claude Desktop configuration
• Claude Code integration
• ChatGPT plugin format
• LangChain tools
• AutoGPT plugins

---

15. Web UI Dashboard

Navigation

• Sidebar navigation
• Section collapse/expand
• Mobile responsive toggle
• Active section highlighting
• Badge indicators

Dashboard Page

• Kill chain visualization
• Operator swarm status
• Live intel feed
• Statistics cards
• OPSEC monitor
• Quick actions

Pages Implemented

• Dashboard - Overview
• Operators - Agent management
• Missions - Mission control
• Evidence - Findings vault
• Arsenal - Tool registry
• Terminal - Command execution
• Benchmarks - Performance testing
• Config Library - OPSEC presets
• CTF Range - Practice targets
• Settings - Configuration
• About - Project info

Visual Features

• Dark cyberpunk theme
• Neon color scheme
• Animated elements
• Grid background
• Progress bars
• Status indicators
• Code syntax highlighting

Interactive Features

• Real-time updates
• Filter controls
• Modal dialogs
• Toast notifications
• Keyboard shortcuts
• Copy to clipboard
• View source on GitHub links
• Drag and drop
• Export functionality
• Dark/light theme toggle

Arsenal Features

• Tool cards with stats
• Category filtering
• Search functionality
• Tool info modals
• Code viewer tab
• Stats tab
• Run demo buttons
• Copy code functionality
• View full source links

---

16. Advanced Modules

Module Implementations

Module	Purpose	Status
KnowledgeBase	CVE/MITRE database	[x] Full - 20 CVEs, 40+ MITRE techniques, 15 patterns
EvasionEngine	Encoding & bypass	[x] Full - 10 encoders, obfuscators, WAF bypass
ExploitEngine	Payload generation & delivery	[~] Stub
ScannerOrchestrator	Multi-scanner coordination	[~] Stub
BrowserAutomation	Headless browser control	[~] Stub
BenchmarkRunner	Performance testing	[~] Stub
ReasoningEngine	Chain-of-thought reasoning	[~] Stub
CognitionEngine	Advanced thought patterns	[~] Stub
SwarmController	Multi-agent swarm behavior	[~] Stub
CloudSecurityEngine	Cloud enumeration	[~] Stub
PersistenceController	Implant deployment	[~] Stub
LearningEngine	Experience recording	[~] Stub
ProtocolHandler	Protocol abstraction	[~] Stub
ReportingEngine	Automated reports	[~] Stub
WorkflowOrchestrator	Multi-step automation	[~] Stub

KnowledgeBase Features (NEW)

• 20 critical CVE entries (Log4Shell, Spring4Shell, ProxyLogon, etc.)
• 40+ MITRE ATT&CK techniques across all tactics
• 15 vulnerability patterns for injection detection
• query() - Search CVEs, techniques, patterns
• getCVE() / getTechnique() - Direct lookups
• getTechniquesByTactic() - Filter by MITRE tactic
• getCriticalCVEs() - Filter by CVSS threshold
• matchPatterns() - Detect vulnerabilities in content

EvasionEngine Features (NEW)

• 10 encoding schemes: base64, base64url, hex, unicode, rot13, url, html, octal
• Multi-layer encoding with multiEncode()
• Code obfuscators: string_split, variable_rename, junk_code
• Sandbox detection (VM, timing, CPU, memory checks)
• generatePolymorphic() - Multiple payload variants
• getWAFBypassVariants() - WAF evasion techniques

Planned Advanced Features

Cognition Patterns

• Chain-of-Thought (CoT) reasoning
• ReAct (Reasoning + Acting)
• Tree-of-Thought exploration
• Self-consistency checking
• Debate mode (multiple perspectives)

Swarm Intelligence

• Pheromone-based communication
• Emergent behavior coordination
• Task distribution algorithms
• Collective decision making

Cloud Security

• AWS enumeration & exploitation
• GCP security testing
• Azure penetration testing
• Multi-cloud support
• IAM analysis
• S3/blob storage auditing

Persistence & C2

• Implant generation
• C2 channel establishment
• Beacon management
• Persistence mechanism deployment

Learning & Adaptation

• Experience recording
• Pattern recognition
• Technique effectiveness tracking
• Adaptive strategy selection

---

17. Configuration System

Storage

• Persistent config via Conf library
• Project-scoped storage
• Environment variable loading
• .env file support
• Config file import/export
• Config encryption
• Remote config sync

API Key Management

• Store/retrieve API keys
• Key validation
• Multi-provider support
• Environment variable precedence
• Key rotation
• Key expiry warnings
• Secure key storage (keychain)

Provider Configuration

• Base URL customization
• Default model selection
• Site URL/name for OpenRouter
• Timeout configuration
• Temperature settings
• Max tokens configuration

OPSEC Configuration

• Level presets
• Detection thresholds
• Cooldown settings
• Cleanup preferences

UI Preferences

• Show/hide banner
• Color output toggle
• Verbose logging toggle
• Theme selection
• Custom shortcuts

---

18. Integration & Extensibility

Current Integrations

• OpenRouter API
• Anthropic API
• OpenAI API
• Ollama (local)
• Model Context Protocol (MCP)
• LangChain
• AutoGPT
• BabyAGI

Extensibility Points

• Custom tools via Arsenal.register()
• Custom operators via createOperator()
• Event hooks via EventEmitter
• Custom LLM providers via adapters
• Plugin system
• Webhook notifications
• External C2 integration
• SIEM integration

Export Formats

• JSON (findings, reports)
• Markdown (reports)
• PDF
• HTML
• CSV
• SARIF (Static Analysis Results)
• STIX/TAXII (threat intelligence)

Import Formats

• Nmap XML
• Nessus reports
• Burp XML
• OWASP ZAP
• Nuclei JSON
• Shodan export

---

Feature Roadmap Priority

P0 - Critical (Next Release)

1. Full API endpoint coverage for operators/targets/missions
2. Real exploit execution in Pliny tools
3. PDF report generation
4. Scanner import (Nmap, Nuclei)

P1 - High (Near Term)

1. Cloud security module (AWS/GCP/Azure)
2. Function calling in LLM backbone
3. WebSocket real-time updates
4. Plugin system architecture

P2 - Medium (Mid Term)

1. Cognition patterns (CoT, ReAct)
2. Swarm intelligence
3. Learning engine
4. Distributed operation support

P3 - Low (Long Term)

1. Mobile app
2. SaaS deployment
3. Marketplace for tools/plugins
4. AI-powered remediation suggestions

---

Metrics

Total Features Tracked: ~300

• Implemented: ~150 (50%)
• Partially Implemented: ~30 (10%)
• Planned: ~120 (40%)

---

Last updated: December 2024 Version: 1.0.0