Reconnaissance, enumeration and non-destructive verification against
infrastructure you can prove you own. Every action clears scope, a signed
authorisation, the action guard and a hash-chained audit log first. Every
refusal is logged as well.
Enigmatic Red is an independent research project, run by one person. It is
not a company: there is no registered company number and no entity behind
it. Nothing is for sale, there is no account to open and no plan to cancel.
Our work is deliberately narrow: one self-hosted assessment agent
(reconnaissance, enumeration and non-destructive verification against
infrastructure you can prove you own), and the research that comes out of
building it. One rule covers a feature and a finding alike: reproduce it,
keep the reproduction, and state plainly where the tool stops. A capability
with no adapter behind it is reported as not tested, never as absent. A lead
is never promoted to a finding without the bytes that prove it. A discipline
this beta does not cover is written down on the
coverage page, not left to be discovered.
The beta runs on your own machine, needs no key of ours and costs nothing:
no accounts, no billing. The one address that reaches a person is
info@enigmaticred.com. Research
questions, security reports and takedowns all go there.
How it works
Six narrow phases
Every domain pack works the same six phases, so plans stay comparable across
packs. All six are open in the beta. What stops a run is the scope, the
approval gate and the guard, never an entitlement.
P0_intakeScope, authorisation and ownership verification. No packets sent.
P1_reconPassive sources first; identify assets, technology and entry points.
P2_enumerateActive, non-intrusive enumeration within rate limits.
Open services and versions, misconfigurations, weak TLS and exposed admin planes. Default credentials are never brute forced.
Web application
Content discovery, auth and session logic, injection classes, access control and IDOR, headers, CORS.
Cloud security
Public buckets, over-permissive policy documents, exposed managed services and logging gaps. Read-only: it never mutates cloud state.
AI security
Prompt injection and jailbreaks, system-prompt and tool-definition extraction, insecure output handling, excessive agency, retrieval leakage.
Real runs, not mockups
5 runs from one session
5 runs from one session against a lab host on this machine,
under a scope signed for the demo. Each one shows the request in plain
words, the command the tool was actually asked to run, and the log entry
it produced. The lab host is one asset of ours, listening on 8000 and 8080 and
all; the session’s own output is what is quoted here, and nothing above
was typed up afterwards.
4 of the 5 captures were refused, and that is deliberate:
a scan that cannot refuse is not one you can hand to a client. The
natural-language line is the operator request each run was made for.
Reconnaissance that runs
allowed
You askScan the web host we have in scope and tell me what is exposed.
port
state
service
product
8000/tcp
open
http-alt
lab-asset/1.0
8080/tcp
open
http-proxy
lab-asset/1.0
1 host up, 2 open services, 2.57 s of scanner time; 6,270 bytes of XML parsed into that table, 2,772 ms wall clock for the process.
Active enumeration with scope, a dated attestation and an audit entry written before the process started.
You askSame scan, but crank the probe rate to 5000 so it finishes faster.
refused: this action is in a permanently forbidden class and cannot be approved (nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1): forbidden[dos_flags]: flood or high-rate flags intended to exhaust the target
Flood-class flags are a hard deny: no approval can enable them, and the refusal is recorded like any other decision.
{"action":"nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1","action_class":"forbidden","actor":"planner","decision":"refused","detail":{"matched_rules":["dos_flags"],"reason":"refused: this action is in a permanently forbidden class and cannot be approved (nmap -Pn -sV -oX - -p 8000 --min-rate 5000 127.0.0.1): forbidden[dos_flags]: flood or high-rate flags intended to exhaust the target","scan_id":"demo-scan-0001"},"entry_hash":"24e7db1011145d5196b7d3feaa438f5f103e76961671ea3926710b9911f00483","event":"tool.refused","org":"Enigmatic Red Demo","prev_hash":"1f4f2c444b06f727545e0e585027083660b8921df3613c96c43c8cbbcffbf32c","seq":3,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.895480+00:00"}
An intrusive check that waits for a human
approval required
You askCheck the app for Log4Shell and confirm whether it is reachable.
human approval required before running an intrusive action (nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10): tool class intrusive for 'nuclei'
Intrusive tooling runs only against an approval for that exact command line, and the request is logged even while it is held.
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"approval_required","detail":{"matched_rules":[],"reason":"human approval required before running an intrusive action (nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10): tool class intrusive for 'nuclei'","scan_id":"demo-scan-0002"},"entry_hash":"cec57ef38964f054a1af78ba34521b8201888ae93545463e8c1583150fae9bf0","event":"tool.refused","org":"Enigmatic Red Demo","prev_hash":"24e7db1011145d5196b7d3feaa438f5f103e76961671ea3926710b9911f00483","seq":4,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.897478+00:00"}
The same check, after an approval
ran · rc 1
You askApproved: go ahead with the Log4Shell template only.
nuclei exited with rc 1 and produced no findings, so the run could not be interpreted; nuclei reports no templates provisioned and this adapter never fetches templates mid-scan (provision them out of band)
The run really did happen and really did fail: this machine has no nuclei template set installed. The layer reports the configuration error instead of reading it as "no findings", and the run is audited at both ends regardless.
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"allowed","detail":{"matched_rules":[],"scan_id":"demo-scan-0002"},"entry_hash":"4ffd148781fec684cb63ec9d99ff5e1746509a02e7efc34275019922bbe1c923","event":"tool.requested","org":"Enigmatic Red Demo","prev_hash":"cec57ef38964f054a1af78ba34521b8201888ae93545463e8c1583150fae9bf0","seq":5,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:47.899484+00:00"}
{"action":"nuclei -target 127.0.0.1 -jsonl -silent -nc -no-interactsh -disable-update-check -t http/cves/2021/CVE-2021-44228.yaml -rate-limit 50 -concurrency 10 -timeout 10","action_class":"intrusive","actor":"planner","decision":"error","detail":{"duration_ms":2468.7,"parse_error":"nuclei exited with rc 1 and produced no findings, so the run could not be interpreted; nuclei reports no templates provisioned and this adapter never fetches templates mid-scan (provision them out of band)","returncode":1,"scan_id":"demo-scan-0002","stderr_bytes":60,"stdout_bytes":0,"timed_out":false,"tool":"nuclei","truncated":false},"entry_hash":"5e0ff7a6827db81b78f8edec83bea4b9ad9ebe035be022705f5f9a3f02b187a8","event":"tool.completed","org":"Enigmatic Red Demo","prev_hash":"4ffd148781fec684cb63ec9d99ff5e1746509a02e7efc34275019922bbe1c923","seq":6,"target":"127.0.0.1","timestamp":"2026-10-19T14:37:50.404116+00:00"}
A target we were never authorised to touch
refused
You askWhile you are there, scan 8.8.8.8 as well.
refusing nmap: '8.8.8.8' is out of scope: no allow rule matches '8.8.8.8' (scope 'demo-lab' grants 1 host(s), 0 cidr(s))
The guard is not the only gate: a target has to be inside the signed scope, re-checked before any packet leaves this machine.
Captured 2026-10-19T14:37:50+00:00 on this machine, and the audit chain
verified intact across all 7 entries afterwards. Every argument, exit
code, byte count, timing, refusal and log hash above is what the run
produced: none of it is hand-written, and the page is checked against the
session’s own record every time it is rebuilt.
Published research — the write-ups
What we found, and how each one was proved
The lab writes up each finding for the reader who will check it: the symptom,
the reproduction against the code as published, the root cause, the smallest
patch that restores the intended behaviour, and the test that fails before it
and passes after. Nothing is written up before it is reproduced, and nothing
is claimed that the reproduction does not show.
Two libraries that broke a guarantee
Epsilon-calibrated noise that silently collapsed to zero in IBM's
diffprivlib, and a corrupted archive that surfaced as a raw codec
exception in CPython's tarfile instead of the one error type it
documents. Both were found by comparing code paths that should have behaved
alike. Both fixes reuse a pattern the codebase already had.
One folder per piece, in the repository and mirrored folder for folder to
GitHub, with a page each here. A piece joins the index only once its
reproduction is recorded. What is published is therefore the part of the
work that survived being checked, including the parts that stay unfixed.
A research project with one hosted convenience: no sign-up, no account, no key of
ours and nothing to buy. The chat lives on
beta.enigmaticred.com and is bring
your own key: it answers questions, and it cannot touch anything. Everything
that can act runs locally, against infrastructure you can prove you own, and
you read the audit log yourself. If it becomes a product, the Enigmatic Red
Subscription is sold here; pricing, Stripe and checkout stay archived until
then.
What works today
Scope and authorisation intake, the action guard, human approval for intrusive commands, a hash-chained audit log, evidence with its bytes and hash, and a report that keeps a verified finding apart from a lead. The five blocks above came out of it.
What is not here yet
No accounts, no key of ours and no hosted planner. The one thing this site does for you is answer questions, in the interface on its own page, with the key you bring, and it runs nothing. The beta that acts is a wheel you install and run on your own machine, driven from a command line that goes through the same scope, guard and audit chain the tests pin. Several tool adapters (subfinder, dnsx, gobuster, ffuf, whatweb) are implemented, gated by the same guard and covered by the same suite. CVSS 4.0 scoring, phase-to-phase orchestration and the evidence store are still being written.
What a beta tester needs
A machine, a model on it, and a target you can prove you own. There is no key to go and get. On Windows, EnigmaticRed-Setup.exe is the whole job in one double-click: it installs the agent and, by default, the newest Llama that fits an ordinary laptop (llama3.2:3b, 2 GB, no GPU), then opens the chat. From a checkout, setup_local_model.cmd does the same on Windows, and setup_local_model.sh on macOS and Linux. Either way the model is open-weight and runs on your machine, so nothing leaves your network. A local lab is enough, and is what the captures above used. Expect refusals to outnumber findings: the guard is supposed to refuse, and it logs every time.
1. downloadOne file per machine, and nothing to configure. No account to make and no key to go and get. On Windows the first button below is the whole beta in one installer, and it carries everything it needs with it. macOS and Linux take the same beta as one wheel — one file between them, and the buttons say which is which.
2. double-clickIt checks whether this machine has Python and installs it if it does not, sets up the agent for you, and puts a model on your own machine to talk to: open-weight, about 2 GB, running on the CPU, so nothing you type leaves your network.
3. chatThe chat opens in the same window. Ask it about a host you can prove you own: scope, the action guard and the audit log are already switched on. It will refuse what it will not do, and it writes that refusal down where you can read it.
macOS and Linux take the same wheel: this beta is one py3-none-any package, so those two buttons download one identical file, and its name is what the digest below is about. It installs the agent and installs no model — setup_local_model.sh from a checkout is what puts a model behind it, which is the half the Windows installer does on its own.
That one file is the whole install: it checks for Python and installs it where the machine has none, installs the agent, sets up a local model to talk to, points the agent at that model, and opens the chat in the same window. Nothing to type, and nothing leaves your network. Nothing here is code-signed yet, so the number underneath is how you check that the file arrived whole.
Windows warned me about this file — or I would rather not run an .exe
The warning is about the file being unsigned, not about anything found in it: Windows shows it for any program downloaded in a browser that has no code-signing certificate behind it, and this one has none yet. There are two ways round it. The first is to check the file against the sha256 below: that number is on this page and in the repository, so a copy that arrived altered cannot match it. The second is to skip the executable altogether: the wheel below is the same release of the same code, packaged rather than run, and nothing warns about a wheel. When this repository's build does sign the file, the signature is checkable on it with Get-AuthenticodeSignature. Until then the sha256 is the whole of the check, which is why the number is printed rather than promised.
The wheel carries the agent alone and installs no model. From a terminal with Python 3.11 or newer on the machine:
A model is then the two steps the installer exists to do for you: setup_local_model from the repository puts Ollama and a 2 GB open-weight model on this machine, or point .env at a model you already run. Nothing above is a second copy of the product: it is the same wheel the installer downloads and checks the digest of itself.
What you downloaded — EnigmaticRed-Setup.exe, 7,703,849 bytes:
sha256 5fdd4aff72f2fbaae37c849d348c4626d4dac8b04ba32efdfa4a7f8db2b935bf
The installer fetches the beta itself from this same folder, and checks it arrived:
enigmatic_red-0.1.0b1-py3-none-any.whl,
306,253 bytes:
sha256 6da1d2d88bf2e6a7d84bfb3646da77bb1ecb7808bbc2b4e5cb2ac378aa7c17a9
On macOS or Linux there is no installer: setup_local_model.sh from a
checkout sets up the same local model, as setup_local_model.cmd does on
Windows — no key and nothing leaving the machine.
Guardrails that apply to every run
25 targets per scan, 60 minutes of wall clock, maximum.
2,000,000 LLM tokens per scan; 40,000,000 per seat per month. Metric spend is bounded on purpose.
17 capability patterns are permanently forbidden — denial of service, credential brute force, persistence, destructive filesystem and SQL operations, reverse shells and command-and-control, bulk exfiltration, SSRF toward cloud metadata. No configuration and no approval can enable them.
13 patterns are intrusive — injection and traversal probes, JNDI lookups, exploit tooling, state-changing verbs, aggressive scans. Each needs a human approval for that exact command line.
A binary nobody registered is treated as intrusive, never as active.
