farai 0.2.4 → 0.2.6

package/docker/kali/Dockerfile

@@ -27,13 +27,13 @@ FROM kalilinux/kali-rolling
 ENV DEBIAN_FRONTEND=noninteractive
 
 ARG TARGETARCH
-ARG NAABU_VERSION=2.6.1
 ARG INTERACTSH_VERSION=1.3.1
 ARG TYPESCRIPT_VERSION=5.9.3
 ARG TYPESCRIPT_LANGUAGE_SERVER_VERSION=4.3.4
 ARG PYRIGHT_VERSION=1.1.408
+ARG KALI_CONTRACT=curated-security-runtime-2026-09
 
-LABEL org.farai.kali.contract="curated-security-runtime"
+LABEL org.farai.kali.contract="${KALI_CONTRACT}"
 
 COPY farai-tool-manifest.json /usr/local/share/farai/farai-tool-manifest.json
 
@@ -46,28 +46,45 @@ RUN apt-get update \
 RUN set -eux; \
   case "${TARGETARCH:-amd64}" in \
     amd64) \
-      naabu_arch=amd64; naabu_sha=018c4c9884dea971eda860435ede3021d1150732f34cfd245498c6726d8cab90; \
+      pd_arch=amd64; \
       interactsh_arch=amd64; interactsh_sha=d553fb3dd4c2684c953aedeb555f13f0d1ca94bd75112c949a5fd975d385a903 ;; \
     arm64) \
-      naabu_arch=arm64; naabu_sha=3adc2bb2395c3efff89623499b20eea66ef54924c485d3ae86762393a31736ea; \
+      pd_arch=arm64; \
       interactsh_arch=arm64; interactsh_sha=475aa78c59afad115149a5b0d6d9c99d2410a4f12d0c6f5a24c32e7338fc6adb ;; \
     *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
   esac; \
-  curl -fsSL "https://github.com/projectdiscovery/naabu/releases/download/v${NAABU_VERSION}/naabu_${NAABU_VERSION}_linux_${naabu_arch}.zip" -o /tmp/naabu.zip; \
-  echo "${naabu_sha}  /tmp/naabu.zip" | sha256sum -c -; \
-  unzip -q /tmp/naabu.zip -d /tmp/naabu; \
-  install -m 0755 /tmp/naabu/naabu /usr/local/bin/naabu; \
+  install_pd() { \
+    tool="$1"; \
+    version="$(python3 -c 'import json,sys; print(json.load(open("/usr/local/share/farai/farai-tool-manifest.json", encoding="utf-8"))["pinnedTools"][sys.argv[1]]["version"])' "${tool}")"; \
+    checksum="$(python3 -c 'import json,sys; print(json.load(open("/usr/local/share/farai/farai-tool-manifest.json", encoding="utf-8"))["pinnedTools"][sys.argv[1]]["sha256"][sys.argv[2]])' "${tool}" "${pd_arch}")"; \
+    archive="/tmp/${tool}.zip"; \
+    directory="/tmp/${tool}"; \
+    curl -fsSL "https://github.com/projectdiscovery/${tool}/releases/download/v${version}/${tool}_${version}_linux_${pd_arch}.zip" -o "${archive}"; \
+    echo "${checksum}  ${archive}" | sha256sum -c -; \
+    mkdir -p "${directory}"; \
+    unzip -q "${archive}" -d "${directory}"; \
+    install -m 0755 "${directory}/${tool}" "/usr/local/bin/${tool}"; \
+  }; \
+  for tool in dnsx httpx katana naabu nuclei subfinder tlsx urlfinder vulnx; do install_pd "${tool}"; done; \
   curl -fsSL "https://github.com/projectdiscovery/interactsh/releases/download/v${INTERACTSH_VERSION}/interactsh-client_${INTERACTSH_VERSION}_linux_${interactsh_arch}.zip" -o /tmp/interactsh.zip; \
   echo "${interactsh_sha}  /tmp/interactsh.zip" | sha256sum -c -; \
   unzip -q /tmp/interactsh.zip -d /tmp/interactsh; \
   install -m 0755 /tmp/interactsh/interactsh-client /usr/local/bin/interactsh-client; \
-  rm -rf /tmp/naabu /tmp/interactsh /tmp/naabu.zip /tmp/interactsh.zip
+  templates_version="$(python3 -c 'import json; print(json.load(open("/usr/local/share/farai/farai-tool-manifest.json", encoding="utf-8"))["pinnedAssets"]["nuclei-templates"]["version"])')"; \
+  templates_checksum="$(python3 -c 'import json; print(json.load(open("/usr/local/share/farai/farai-tool-manifest.json", encoding="utf-8"))["pinnedAssets"]["nuclei-templates"]["sha256"])')"; \
+  curl -fsSL "https://github.com/projectdiscovery/nuclei-templates/archive/refs/tags/v${templates_version}.zip" -o /tmp/nuclei-templates.zip; \
+  echo "${templates_checksum}  /tmp/nuclei-templates.zip" | sha256sum -c -; \
+  unzip -q /tmp/nuclei-templates.zip -d /tmp/nuclei-templates; \
+  mkdir -p /usr/local/share/farai/nuclei-templates; \
+  cp -a "/tmp/nuclei-templates/nuclei-templates-${templates_version}/." /usr/local/share/farai/nuclei-templates/; \
+  rm -rf /tmp/dnsx /tmp/httpx /tmp/katana /tmp/naabu /tmp/nuclei /tmp/subfinder /tmp/tlsx /tmp/urlfinder /tmp/vulnx /tmp/interactsh /tmp/nuclei-templates \
+    /tmp/dnsx.zip /tmp/httpx.zip /tmp/katana.zip /tmp/naabu.zip /tmp/nuclei.zip /tmp/subfinder.zip /tmp/tlsx.zip /tmp/urlfinder.zip /tmp/vulnx.zip /tmp/interactsh.zip /tmp/nuclei-templates.zip
 
 RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
   && ln -sf /root/.local/bin/uv /usr/local/bin/uv \
   && ln -sf /root/.local/bin/uvx /usr/local/bin/uvx
 
-RUN UV_TOOL_DIR=/opt/uv/tools UV_TOOL_BIN_DIR=/opt/uv/bin uv tool install --with fastmcp mitmproxy-mcp==0.6.1 \
+RUN UV_TOOL_DIR=/opt/uv/tools UV_TOOL_BIN_DIR=/opt/uv/bin uv tool install --with 'mcp>=1.25.0,<2' mitmproxy-mcp==0.6.1 \
   && chmod -R a+rX /opt/uv \
   && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install -g \
     @playwright/mcp@latest \

package/docker/kali/farai-image-doctor.py

@@ -24,6 +24,8 @@ MANIFEST = json.loads(MANIFEST_PATH.read_text(encoding="utf-8"))
 CONTRACT = MANIFEST["contract"]
 APT_PACKAGES = tuple(MANIFEST["aptPackages"])
 WORKFLOWS = MANIFEST["workflows"]
+PINNED_TOOLS = MANIFEST["pinnedTools"]
+PINNED_ASSETS = MANIFEST["pinnedAssets"]
 REQUIRED = tuple(dict.fromkeys(command for commands in WORKFLOWS.values() for command in commands))
 
 
@@ -61,6 +63,7 @@ def missing_packages():
 commands = installed_commands()
 missing = [name for name in REQUIRED if name not in commands]
 missing_apt_packages = missing_packages()
+missing_assets = [name for name, asset in PINNED_ASSETS.items() if not Path(asset["path"]).exists()]
 payload = {
     "contract": CONTRACT,
     "manifest": str(MANIFEST_PATH),
@@ -69,6 +72,9 @@ payload = {
     "requiredCount": len(REQUIRED),
     "missing": missing,
     "missingPackages": missing_apt_packages,
+    "missingAssets": missing_assets,
+    "pinnedTools": PINNED_TOOLS,
+    "pinnedAssets": PINNED_ASSETS,
     "workflows": WORKFLOWS,
 }
 
@@ -80,4 +86,4 @@ if len(sys.argv) == 3 and sys.argv[1] == "--write":
 else:
     print(json.dumps(payload, ensure_ascii=True, separators=(",", ":")))
 
-raise SystemExit(0 if not missing and not missing_apt_packages else 1)
+raise SystemExit(0 if not missing and not missing_apt_packages and not missing_assets else 1)

package/docker/kali/farai-tool-manifest.json

@@ -1,5 +1,5 @@
 {
-  "contract": "curated-security-runtime",
+  "contract": "curated-security-runtime-2026-09",
   "aptPackages": [
     "amass",
     "arjun",
@@ -16,7 +16,6 @@
     "dirsearch",
     "dnsenum",
     "dnsrecon",
-    "dnsx",
     "enum4linux-ng",
     "evil-winrm",
     "exploitdb",
@@ -54,7 +53,6 @@
     "nmap",
     "nodejs",
     "npm",
-    "nuclei",
     "openssh-client",
     "openssl",
     "poppler-utils",
@@ -75,7 +73,6 @@
     "sslscan",
     "sslyze",
     "steghide",
-    "subfinder",
     "tcpdump",
     "tesseract-ocr",
     "testssl.sh",
@@ -96,6 +93,78 @@
     "yara",
     "zip"
   ],
+  "pinnedTools": {
+    "dnsx": {
+      "version": "1.3.1",
+      "sha256": {
+        "amd64": "438b964653056dd51dcfe614b1a16f8bced3cc48a1d27bc07cc6fdf2ef2a9533",
+        "arm64": "dd657dd1ccee5e137eca2dbad0e97dbd067555f744adb97efcda774f1b2fbde1"
+      }
+    },
+    "httpx": {
+      "version": "1.11.0",
+      "sha256": {
+        "amd64": "5dce96e7315cff24be7aab3b032f23f7a71b7711a17f8189ebe601f2588f2f87",
+        "arm64": "2b5d9ec3d3750df41e04e4216b1400d2ad862d1cb9ebe68ae501b2299cb5b3a5"
+      }
+    },
+    "katana": {
+      "version": "1.7.0",
+      "sha256": {
+        "amd64": "fe1142d92f418549338ea46d67a472124878482e225d279e9a42700c75d76a4d",
+        "arm64": "9a6885fe9fda850129b110e0f079d42529b0693dd81b59c316f04084935300f0"
+      }
+    },
+    "naabu": {
+      "version": "2.6.1",
+      "sha256": {
+        "amd64": "018c4c9884dea971eda860435ede3021d1150732f34cfd245498c6726d8cab90",
+        "arm64": "3adc2bb2395c3efff89623499b20eea66ef54924c485d3ae86762393a31736ea"
+      }
+    },
+    "nuclei": {
+      "version": "3.11.1",
+      "sha256": {
+        "amd64": "ea63d4ae232808cd7c6bc00d0142428e231fab59dae01042246097d195835ab6",
+        "arm64": "8044e3d9768ba0a744b2872c1a87e813006f013da97ca9f50f7661a4203bec07"
+      }
+    },
+    "subfinder": {
+      "version": "2.16.0",
+      "sha256": {
+        "amd64": "1b7f9c608e9a5bd59e609a5e09710d63c5485e92d3d49dc2c16eb4fdbe10cb60",
+        "arm64": "c81d49559c0f630177be9e347e502e7a3d474aacc6ff78291ffcb4964367d63d"
+      }
+    },
+    "tlsx": {
+      "version": "1.3.0",
+      "sha256": {
+        "amd64": "d982c55da676d7f6bfe588550ed19946e3c73234b4a3a11caf105f3ab98564bf",
+        "arm64": "70a65a286eaeb336d04c06fd1783541096f7b06c5c2e7a22467406ea2c323449"
+      }
+    },
+    "urlfinder": {
+      "version": "0.0.3",
+      "sha256": {
+        "amd64": "655ea7378a0555149831dcc4c3f6aef34f3ce27eda0ce2f2721e2ca5526015d4",
+        "arm64": "6af33108d6b76bbd261fa696c69dccf44b9eb5a68dc47b4c41df5cf32f8b8281"
+      }
+    },
+    "vulnx": {
+      "version": "2.0.2",
+      "sha256": {
+        "amd64": "387abd1c42b0357e1d4257b54528fc38e1d0357b12f05ab12117a4c628a5aaf8",
+        "arm64": "13c5888dde027b84bd3b6cf69c36c87e1e7aad7e7159bdeeb576f4962dcc1d06"
+      }
+    }
+  },
+  "pinnedAssets": {
+    "nuclei-templates": {
+      "version": "10.4.8",
+      "path": "/usr/local/share/farai/nuclei-templates",
+      "sha256": "cb4f88504ebf9d462c2db4c8d2bdf6cb94ecc7b7f4ed09b7f4fd20ceb6bc8002"
+    }
+  },
   "workflows": {
     "shell-and-network-utilities": [
       "curl",
@@ -136,9 +205,11 @@
       "theHarvester"
     ],
     "service-discovery": [
+      "httpx",
       "masscan",
       "naabu",
-      "nmap"
+      "nmap",
+      "tlsx"
     ],
     "callback-verification": [
       "interactsh-client",
@@ -150,7 +221,9 @@
       "dirsearch",
       "feroxbuster",
       "ffuf",
-      "gobuster"
+      "gobuster",
+      "katana",
+      "urlfinder"
     ],
     "web-assessment": [
       "commix",
@@ -166,6 +239,9 @@
       "whatweb",
       "wpscan"
     ],
+    "vulnerability-intelligence": [
+      "vulnx"
+    ],
     "credential-access": [
       "hashcat",
       "hydra",

package/docker/kali/farai_mitmproxy_mcp.py

@@ -17,6 +17,7 @@ from mitmproxy_mcp.core import server
 
 
 UPSTREAM_TRAFFIC_RECORDER = server.TrafficRecorder
+UPSTREAM_MITM_CONTROLLER = server.MitmController
 
 
 def env_int(name: str, default: int, minimum: int, maximum: int) -> int:
@@ -33,6 +34,84 @@ MAX_MESSAGES = env_int("FARAI_PROXY_MAX_MESSAGES", 200, 1, 1000)
 REPLAY_CORRELATION_HEADER = "X-Farai-Replay-Correlation"
 
 
+def env_json_strings(name: str) -> list[str]:
+    try:
+        value = json.loads(os.environ.get(name, "[]"))
+    except json.JSONDecodeError:
+        return []
+    if not isinstance(value, list):
+        return []
+    return normalize_pass_through_hosts(value)
+
+
+def normalize_pass_through_hosts(values: Any) -> list[str]:
+    if not isinstance(values, list):
+        raise ValueError("pass_through_hosts must be a list")
+    hosts: list[str] = []
+    for value in values:
+        if not isinstance(value, str):
+            raise ValueError("pass_through_hosts must contain strings")
+        host = value.strip().lower()
+        if not host or any(char in host for char in "\r\n\0"):
+            raise ValueError("pass_through_hosts contains an invalid host")
+        if host not in hosts:
+            hosts.append(host)
+    return hosts
+
+
+def pass_through_pattern(host: str) -> str:
+    if host.startswith("*."):
+        return rf"^(?:[^:]+\.)?{re.escape(host[2:])}(?::\d+)?$"
+    return rf"^{re.escape(host)}(?::\d+)?$"
+
+
+class FaraiMitmController(UPSTREAM_MITM_CONTROLLER):
+    def __init__(self, dump_file: str | None = None):
+        super().__init__(dump_file=dump_file)
+        configured_tls = os.environ.get("FARAI_PROXY_TLS", "relaxed").strip().lower()
+        self.farai_tls_mode = configured_tls if configured_tls in {"strict", "relaxed"} else "relaxed"
+        self.farai_pass_through_hosts = env_json_strings("FARAI_PROXY_PASS_THROUGH_HOSTS")
+
+    async def start(
+        self,
+        port: int = 8080,
+        host: str = "127.0.0.1",
+        dump_file: str | None = None,
+    ):
+        result = await super().start(port=port, host=host, dump_file=dump_file)
+        self.apply_farai_policy()
+        return result
+
+    def apply_farai_policy(self) -> None:
+        if self.master is None:
+            return
+        self.master.options.update(
+            ssl_insecure=self.farai_tls_mode == "relaxed",
+            ignore_hosts=[pass_through_pattern(host) for host in self.farai_pass_through_hosts],
+        )
+
+    def farai_policy_state(self) -> dict[str, Any]:
+        return {
+            "tls": self.farai_tls_mode,
+            "passThroughHosts": list(self.farai_pass_through_hosts),
+        }
+
+    def set_farai_policy(
+        self,
+        tls_mode: str | None = None,
+        pass_through_hosts: list[str] | None = None,
+    ) -> dict[str, Any]:
+        if tls_mode is not None:
+            normalized_tls = tls_mode.strip().lower()
+            if normalized_tls not in {"strict", "relaxed"}:
+                raise ValueError("tls_mode must be strict or relaxed")
+            self.farai_tls_mode = normalized_tls
+        if pass_through_hosts is not None:
+            self.farai_pass_through_hosts = normalize_pass_through_hosts(pass_through_hosts)
+        self.apply_farai_policy()
+        return self.farai_policy_state()
+
+
 class FlowStore:
     def __init__(self, db_path: str):
         self.db_path = db_path
@@ -138,6 +217,13 @@ class FaraiTrafficRecorder(UPSTREAM_TRAFFIC_RECORDER):
         self._capture(flow)
 
     def error(self, flow: http.HTTPFlow) -> None:
+        message = flow_error(flow)
+        if flow.response is None and message and upstream_tls_verification_failed(message):
+            flow.response = http.Response.make(
+                502,
+                b"farai proxy: upstream tls verification failed; use relaxed tls or pass-through for this host\n",
+                {"Content-Type": "text/plain; charset=utf-8", "X-Farai-Proxy-Error": "upstream-tls-verification-failed"},
+            )
         super().error(flow)
         self._capture(flow)
 
@@ -624,6 +710,11 @@ def flow_error(flow: Any) -> str | None:
     return text_value(getattr(error, "msg", error))
 
 
+def upstream_tls_verification_failed(message: str) -> bool:
+    normalized = message.lower()
+    return "certificate verify failed" in normalized or "certificate verification failed" in normalized
+
+
 def text_value(value: Any, encoding: str = "utf-8") -> str:
     if isinstance(value, bytes):
         return value.decode(encoding, errors="replace")
@@ -720,6 +811,28 @@ async def proxy_scope_get() -> str:
     return json.dumps(recorder.scope_state(), indent=2)
 
 
+@server.mcp.tool()
+async def proxy_policy_get() -> str:
+    controller = server.controller
+    if not isinstance(controller, FaraiMitmController):
+        return json.dumps({"tls": "strict", "passThroughHosts": []}, indent=2)
+    return json.dumps(controller.farai_policy_state(), indent=2)
+
+
+@server.mcp.tool()
+async def proxy_policy_set(
+    tls_mode: str | None = None,
+    pass_through_hosts: list[str] | None = None,
+) -> str:
+    controller = server.controller
+    if not isinstance(controller, FaraiMitmController):
+        raise RuntimeError("Farai proxy policy controller is unavailable.")
+    return json.dumps(
+        controller.set_farai_policy(tls_mode, pass_through_hosts),
+        indent=2,
+    )
+
+
 @server.mcp.tool()
 async def proxy_intercept_configure(
     enabled: bool,
@@ -787,6 +900,7 @@ async def proxy_intercept_resolve(
 
 
 server.TrafficRecorder = FaraiTrafficRecorder
+server.MitmController = FaraiMitmController
 
 
 if __name__ == "__main__":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "farai",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "private": false,
   "type": "module",
   "description": "Cyber-first freestyle local AI agent",
@@ -46,7 +46,7 @@
     "tui:test": "bun test ./test/tui-*.test.ts ./test/tui-*.test.tsx",
     "doctor": "bun run src/cli/index.ts doctor",
     "typecheck": "tsc --noEmit",
-    "test": "bun test ./test",
+    "test": "bun test ./test/*.test.ts ./test/*.test.tsx",
     "verify": "bun run typecheck && bun run test && bun run test:package",
     "release:check": "bun run verify && bun audit",
     "eval:smoke": "bun run test/evals/smoke.ts",