aisec-cli 0.1.0 → 0.2.0

package/bin/aisec.mjs

@@ -16,12 +16,16 @@ program
   .option("--stealth", "Stealth profile — slower, WAF evasion")
   .option("--aggressive", "Aggressive — full port scan, brute force, sqlmap")
   .option("--full", "Full — aggressive + subdomain scope + 50 iterations")
+  .option("--bounty", "Bug bounty — high-impact vulns, skip noise, PoC-ready output")
+  .option("--scan-type <type>", "Scan type: web, network, crypto", "web")
   .option("-e, --engine <engine>", "AI engine: claude or ollama", "claude")
   .option("-m, --model <model>", "Model name")
+  .option("--review-model <model>", "Review model (default: claude-sonnet-4-6)")
   .option("--temperature <temp>", "AI temperature 0.0-1.0", parseFloat)
   .option("-n, --max-iterations <n>", "Max AI iterations", parseInt)
   .option("--scope <scope>", "Scan scope: target, domain, subdomain")
   .option("-t, --timeout <minutes>", "Timeout in minutes, 0=unlimited", parseInt)
+  .option("--cost-cap <credits>", "Max credits to spend (0=no limit)", parseFloat)
   .option("--skip-recon", "Skip infrastructure recon")
   .option("--skip-browser", "Skip browser-based recon")
   .option("-u, --username <user>", "Username for auth scanning")
@@ -29,6 +33,14 @@ program
   .option("--cookies <json>", "Session cookies as JSON or @file")
   .option("--proxy <url>", "Proxy URL")
   .option("--headers <headers>", "Custom headers: 'Key:Val,Key2:Val2' or @file")
+  .option("--localstorage <json>", "Browser localStorage as JSON or @file")
+  .option("--custom-instructions <text>", "Free-text guidance for the AI agent (max 500 chars)")
+  .option("--disable-tools <tools>", "Comma-separated tools to disable (e.g. sqlmap,hydra,nikto)")
+  .option("--disable-enrichments <list>", "Comma-separated enrichments to disable (e.g. leak_check,shodan)")
+  .option("--out-of-scope <list>", "Comma-separated domains/paths to exclude")
+  .option("--wordlist <name>", "Wordlist: common, big, api-endpoints")
+  .option("--auto-compact", "Auto-compact context for long scans (saves credits)")
+  .option("--project-id <id>", "Assign scan to a project")
   .option("--fail-on <severity>", "Exit 1 if findings at this severity or above (critical, high, medium, low)")
   .option("--source <source>", "Scan source identifier (cli, ci, api)", "cli")
   .option("--token <token>", "API token (or AISEC_TOKEN env)")

package/lib/scan.mjs

@@ -6,6 +6,7 @@ import { request, healthCheck } from "./api.mjs";
 
 function resolveProfile(opts) {
   if (opts.full) return "full";
+  if (opts.bounty) return "bounty";
   if (opts.aggressive) return "aggressive";
   if (opts.stealth) return "stealth";
   return undefined;
@@ -32,6 +33,19 @@ function parseCookies(raw) {
   return raw;
 }
 
+function parseFileOrString(raw) {
+  if (!raw) return undefined;
+  if (raw.startsWith("@")) {
+    return readFileSync(raw.slice(1), "utf-8").trim();
+  }
+  return raw;
+}
+
+function parseCommaSeparated(raw) {
+  if (!raw) return undefined;
+  return raw.split(",").map(s => s.trim()).filter(Boolean);
+}
+
 function buildBody(target, opts) {
   const body = { target, source: opts.source || "cli" };
   const profile = resolveProfile(opts);
@@ -47,10 +61,25 @@ function buildBody(target, opts) {
   if (opts.username) body.username = opts.username;
   if (opts.password) body.password = opts.password;
   if (opts.proxy) body.proxy = opts.proxy;
+  if (opts.costCap != null) body.cost_cap = opts.costCap;
+  if (opts.reviewModel) body.review_model = opts.reviewModel;
+  if (opts.scanType && opts.scanType !== "web") body.scan_type = opts.scanType;
   const cookies = parseCookies(opts.cookies);
   if (cookies) body.cookies_json = cookies;
   const headers = parseHeaders(opts.headers);
   if (headers) body.custom_headers = headers;
+  const ls = parseFileOrString(opts.localstorage);
+  if (ls) body.localstorage_json = ls;
+  if (opts.customInstructions) body.custom_instructions = opts.customInstructions;
+  const disabledTools = parseCommaSeparated(opts.disableTools);
+  if (disabledTools) body.disabled_tools = disabledTools;
+  const disabledEnrichments = parseCommaSeparated(opts.disableEnrichments);
+  if (disabledEnrichments) body.disabled_enrichments = disabledEnrichments;
+  const outOfScope = parseCommaSeparated(opts.outOfScope);
+  if (outOfScope) body.out_of_scope = outOfScope;
+  if (opts.wordlist) body.wordlist = opts.wordlist;
+  if (opts.autoCompact) body.auto_compact = true;
+  if (opts.projectId) body.project_id = opts.projectId;
   return body;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aisec-cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "CLI for aisec — AI-powered web security scanner",
   "type": "module",
   "bin": {
@@ -26,8 +26,8 @@
     "url": "https://github.com/aisec-foundation/cli-node.git"
   },
   "dependencies": {
-    "commander": "^12.1.0",
     "chalk": "^5.3.0",
+    "commander": "^12.1.0",
     "ws": "^8.18.0"
   }
 }