praetorian-cli 2.4.2__tar.gz → 2.4.4__tar.gz

{praetorian_cli-2.4.2/praetorian_cli.egg-info → praetorian_cli-2.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: praetorian-cli
-Version: 2.4.2
+Version: 2.4.4
 Summary: For interacting with the Guard API
 Home-page: https://github.com/praetorian-inc/praetorian-cli
 Author: Praetorian

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/add.py

@@ -6,7 +6,7 @@ import click
 
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler, praetorian_only
-from praetorian_cli.handlers.utils import error, parse_configuration_value
+from praetorian_cli.handlers.utils import error, parse_configuration_value, parse_kv_entries
 from praetorian_cli.sdk.model.globals import AddRisk, Asset, Seed, Kind
 
 
@@ -357,40 +357,71 @@ def webpage(sdk, url, parent):
     sdk.webpage.add(url, parent)
 
 
-@add.command()
+@add.group(invoke_without_command=True)
 @cli_handler
-@click.option('-r', '--resource-key', required=True, help='The resource key for the credential (e.g., account key)')
-@click.option('-c', '--category', required=True,
+@click.option('-r', '--resource-key', help='The resource key for the credential (e.g., account key)')
+@click.option('-c', '--category',
               type=click.Choice(['integration', 'cloud', 'env-integration']),
               help='The category of the credential')
-@click.option('-t', '--type', 'cred_type', required=True,
-              help='The type of credential (aws, gcp, azure, static, ssh_key, json, active-directory, default)')
-@click.option('-l', '--label', required=True, help='A human-readable label for the credential')
+@click.option('-t', '--type', 'cred_type',
+              help='The type of credential (aws, gcp, azure, static-token, ssh-key, '
+                   'json-credential, active-directory, burp-authentication, web-auth, etc.)')
+@click.option('-l', '--label', help='A human-readable label for the credential')
 @click.option('-p', '--param', 'parameters', multiple=True,
               help='Parameter in format key=value (can be specified multiple times)')
-def credential(sdk, resource_key, category, cred_type, label, parameters):
+@click.pass_context
+def credential(ctx, sdk, resource_key, category, cred_type, label, parameters):
     """ Add a credential
 
-    This command adds a credential to the credential broker. Credentials can be used
-    for authentication with various cloud providers, integrations, and environment services.
+    Without a subcommand, adds a credential generically — you provide all of category,
+    type, label, and params. Use the typed subcommands (e.g. `webauth`) for friendlier
+    UX when adding a known credential type.
 
     \b
     Example usages:
         - guard add credential --resource-key "C.0c6cf7104f516b08-OGMPG" --category env-integration --type active-directory --label "Robb Stark" --param username=robb.stark --param password=sexywolfy --param domain=north.sevenkingdoms.local
         - guard add credential -r "C.example-key" -c cloud -t aws --label "AWS Production" -p region=us-east-1 -p role_arn=arn:aws:iam::123456789012:role/MyRole
-        - guard add credential -r "C.example-key" -c integration -t static --label "API Token" -p token=abc123xyz
+        - guard add credential -r "C.example-key" -c integration -t static-token --label "API Token" -p token=abc123xyz
     """
-    # Parse parameters from key=value format
-    params = {}
-    for param in parameters:
-        if '=' not in param:
-            error(f"Parameter '{param}' is not in the format key=value")
-            return
-        key, value = param.split('=', 1)
-        params[key] = value
+    if ctx.invoked_subcommand is not None:
+        return
+
+    missing = [name for name, val in
+               [('--resource-key', resource_key), ('--category', category),
+                ('--type', cred_type), ('--label', label)] if not val]
+    if missing:
+        error(f"Missing required option(s): {', '.join(missing)}")
+
+    params = parse_kv_entries(parameters, label='Param')
 
     try:
         result = sdk.credentials.add(resource_key, category, cred_type, label, params)
         click.echo(json.dumps(result, indent=2))
     except Exception as e:
         error(f'Unable to add credential. Error: {e}')
+
+
+@credential.command('webauth')
+@cli_handler
+@click.option('-k', '--resource-key', required=True,
+              help='Web-application key (e.g., #webapplication#https://app.example.com)')
+@click.option('-l', '--label', required=True, help='A human-readable label for the credential')
+@click.option('-H', '--header', 'headers', multiple=True, required=True,
+              help='Header in format Name=Value (can be specified multiple times)')
+def credential_webauth(sdk, resource_key, label, headers):
+    """ Add a static-token web-auth credential to a WebApplication.
+
+    Persists a header bag (e.g. an Authorization bearer token) that Chariot
+    capabilities and Burp Enterprise will use when scanning the target.
+
+    \b
+    Example usage:
+        - guard add credential webauth -k "#webapplication#https://app.example.com" -l "Prod token" -H "Authorization=Bearer abc123" -H "X-Tenant=acme"
+    """
+    headers_dict = parse_kv_entries(headers, label='Header')
+    parameters = {'method': 'static-token', 'headers': headers_dict}
+    try:
+        result = sdk.credentials.add(resource_key, 'env-integration', 'web-auth', label, parameters)
+        click.echo(json.dumps(result, indent=2))
+    except Exception as e:
+        error(f'Unable to add web-auth credential. Error: {e}')

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/delete.py

@@ -193,4 +193,61 @@ def webpage(chariot, key):
     Arguments:
         - KEY: the key of an existing webpage
     """
-    chariot.webpage.delete(key)
+    chariot.webpage.delete(key)
+
+
+@delete.group()
+def credential():
+    """ Delete a credential via the broker
+
+    For web-auth credentials shared across multiple WebApplications, this only
+    detaches the credential from the given resource_key — the underlying
+    credential is fully removed once it has no remaining attachments.
+
+    Use the typed subcommands (e.g. `webauth`) for friendlier UX, or `generic`
+    when deleting a credential type that doesn't have a typed subcommand yet.
+    """
+    pass
+
+
+@credential.command('generic')
+@cli_handler
+@click.argument('credential_id', required=True)
+@click.option('-r', '--resource-key', required=True,
+              help='The resource key the credential is attached to (e.g., web-application key, account key)')
+@click.option('-t', '--type', 'cred_type', required=True,
+              help='The credential type (e.g., active-directory, burp-authentication)')
+def credential_generic(chariot, credential_id, resource_key, cred_type):
+    """ Delete a credential of any type (escape hatch).
+
+    \b
+    Arguments:
+        - CREDENTIAL_ID: the ID of the credential to delete
+
+    \b
+    Example usage:
+        - guard delete credential generic def-456 -r "#asset#example.com#1.2.3.4" -t active-directory
+    """
+    chariot.credentials.delete(credential_id, resource_key, cred_type)
+
+
+@credential.command('webauth')
+@cli_handler
+@click.argument('credential_id', required=True)
+@click.option('-k', '--resource-key', required=True,
+              help='Web-application key (e.g., #webapplication#https://app.example.com)')
+def credential_webauth(chariot, credential_id, resource_key):
+    """ Delete a web-auth credential from a WebApplication.
+
+    Detaches the credential from this WebApplication; the underlying credential
+    is fully removed once it has no remaining attachments.
+
+    \b
+    Arguments:
+        - CREDENTIAL_ID: the ID of the web-auth credential to delete
+
+    \b
+    Example usage:
+        - guard delete credential webauth abc-123 -k "#webapplication#https://app.example.com"
+    """
+    chariot.credentials.delete(credential_id, resource_key, 'web-auth')

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/export.py

@@ -28,6 +28,9 @@ def export():
 @click.option('--retest/--no-retest', default=False,
               help='Include retest status badges and sections')
 @click.option('--version', 'report_version', default='1.0', help='Report version string')
+@click.option('--sow', default='', help='Statement of Work identifier (expands %%SOW%% shortcode).')
+@click.option('--footer', default='', help='Custom page-footer text (overrides the report title when set).')
+@click.option('--confidential-label', 'confidential_label', default='', help='Confidentiality label shown on cover, header, and footer (defaults to "Confidential").')
 @click.option('--format', 'export_format', type=click.Choice(['pdf', 'zip']),
               default='pdf', help='Export format')
 @click.option('--group-by', type=click.Choice(['attack_surface', 'tag']),
@@ -48,7 +51,7 @@ def export():
               help='Skip downloading the file; just print the job result')
 def report(chariot, title, client_name, status_filter, risk_keys,
            target, start_date, end_date, report_date, draft, retest,
-           report_version, export_format, group_by, shared,
+           report_version, sow, footer, confidential_label, export_format, group_by, shared,
            executive_summary, narratives, appendix, output,
            timeout, no_download):
     """ Generate and download a PDF or ZIP report.
@@ -84,6 +87,9 @@ def report(chariot, title, client_name, status_filter, risk_keys,
         draft=draft,
         retest=retest,
         version=report_version,
+        sow=sow,
+        footer=footer,
+        confidential_label=confidential_label,
         export_format=export_format,
         group_by=group_by,
         shared_output=shared,

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/get.py

@@ -4,7 +4,7 @@ import click
 
 from praetorian_cli.handlers.chariot import chariot
 from praetorian_cli.handlers.cli_decorators import cli_handler, praetorian_only
-from praetorian_cli.handlers.utils import print_json
+from praetorian_cli.handlers.utils import error, print_json
 
 
 @chariot.group()
@@ -259,31 +259,49 @@ def configuration(chariot, key):
 
 @get.command()
 @cli_handler
-@click.argument('credential_id', required=True)
+@click.argument('credential_id', required=False, default='')
 @click.option('--category', default='env-integration', help='The category of the credential (e.g., integration, cloud)')
 @click.option('--type', default='default', help='The type of credential (e.g., aws, gcp, azure, static, ssh_key, json)')
 @click.option('--format', default='token', help='The format of the credential response')
+@click.option('--resolution',
+              type=click.Choice(['by-target', 'from-parent'], case_sensitive=False),
+              default='by-target',
+              show_default=True,
+              help='How the broker should locate the credential. '
+                   'by-target: use the supplied CREDENTIAL_ID as-is. '
+                   'from-parent: walk DISCOVERED ancestors of --resource-key to find one with a matching credential.')
+@click.option('--resource-key', default=None,
+              help='Asset/resource key to scope the lookup. Required when --resolution=from-parent.')
 @click.option('--parameters', nargs=2, multiple=True, help='Additional parameters, as --parameters key value')
-def credential(chariot, credential_id, category, type, format, parameters):
+def credential(chariot, credential_id, category, type, format, resolution, resource_key, parameters):
     """ Get a specific credential
 
     Retrieve a specific credential using the credential broker.
 
     \b
     Argument:
-        - CREDENTIAL_ID: the ID of the credential to retrieve
+        - CREDENTIAL_ID: the ID of the credential to retrieve. Required for
+          --resolution=by-target; optional for from-parent.
 
     \b
     Example usages:
         - guard get credential aws-prod --category integration --type aws --format json
         - guard get credential ssh-key-1 --category cloud --type ssh_key --format pem
+        - guard get credential --resolution from-parent --resource-key '#asset#example.com#1.2.3.4' --type aws
     """
-    
+    if resolution == 'by-target' and not credential_id:
+        error('CREDENTIAL_ID is required when --resolution=by-target.')
+    if resolution == 'from-parent' and not resource_key:
+        error('--resource-key is required when --resolution=from-parent.')
+
     params = {}
     if parameters:
         params = {key: value for key, value in parameters}
-    
-    result = chariot.credentials.get(credential_id, category, type, [format], **params)
+
+    result = chariot.credentials.get(
+        credential_id, category, type, [format],
+        resolution=resolution, resource_key=resource_key, **params,
+    )
     output = chariot.credentials.format_output(result)
     click.echo(output)
 

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/run.py

@@ -124,27 +124,34 @@ def run():
     pass
 
 
-@run.command('tool')
+@run.command(
+    'tool',
+    context_settings={'ignore_unknown_options': True, 'allow_extra_args': True},
+)
 @cli_handler
 @click.argument('tool_name')
 @click.argument('target')
+@click.argument('tool_args', nargs=-1, type=click.UNPROCESSED)
 @click.option('-c', '--config', 'extra_config', default='', help='Extra JSON config to merge')
 @click.option('--credential', multiple=True, help='Credential ID(s) to use')
 @click.option('--wait', is_flag=True, default=False, help='Wait for job completion and show results')
 @click.option('--ask', 'use_agent', is_flag=True, default=False, help='Run via Marcus AI agent instead of direct job')
 @click.option('--local', is_flag=True, default=False, help='Run locally using installed binary')
 @click.option('--remote', is_flag=True, default=False, help='Force remote job execution on Guard backend')
-def tool(sdk, tool_name, target, extra_config, credential, wait, use_agent, local, remote):
+def tool(sdk, tool_name, target, tool_args, extra_config, credential, wait, use_agent, local, remote):
     """ Execute a named security tool against a target
 
     By default, runs LOCALLY if the binary is installed, otherwise schedules
-    a remote job. Use --local or --remote to force.
+    a remote job. Use --local or --remote to force. Any additional arguments
+    after the target are forwarded to the local binary. Use `--` to pass
+    flags that collide with our own options.
 
     \b
     Example usages:
-        guard run tool brutus 10.0.1.5
-        guard run tool nuclei example.com --remote
-        guard run tool titus github.com/org/repo
+        guard run tool brutus 10.0.1.5:22
+        guard run tool brutus 10.0.1.5:22 --protocol ssh -U users.txt
+        guard run tool brutus 10.0.1.5:22 -- --wait
+        guard run tool nuclei example.com --remote -c '{"templates":"cves/"}'
     """
     from praetorian_cli.runners.local import is_installed as _is_installed
 
@@ -152,11 +159,26 @@ def tool(sdk, tool_name, target, extra_config, credential, wait, use_agent, loca
     if not cap:
         error(f'Unknown capability: {tool_name}. Use "guard run capabilities" to see available capabilities.')
 
-    # Decide local vs remote
+    # --local / --remote / --ask are mutually exclusive routing flags.
+    mode_flags = [('--local', local), ('--remote', remote), ('--ask', use_agent)]
+    set_flags = [name for name, v in mode_flags if v]
+    if len(set_flags) > 1:
+        error(f'Mutually exclusive flags: {", ".join(set_flags)}. Choose one.')
+
+    tool_args = list(tool_args or [])
+
+    # Decide local vs remote first so we can validate tool_args against the resolved path.
     run_local = local or (not remote and not use_agent and _is_installed(tool_name.lower()))
 
+    if tool_args and (remote or use_agent or not run_local):
+        error(
+            'Extra arguments after the target are only supported when running locally. '
+            'Install the tool locally ("guard run install %s") or encode settings as JSON '
+            'via -c \'{"key":"value"}\'.' % tool_name.lower()
+        )
+
     if run_local:
-        _run_local(sdk, tool_name.lower(), target, extra_config)
+        _run_local(sdk, tool_name.lower(), target, extra_config, tool_args)
     elif use_agent:
         target_key, warning = resolve_target(sdk, target, cap['target_type'])
         if not target_key:
@@ -376,7 +398,7 @@ def _run_via_agent(sdk, cap, target_key):
         error(str(e))
 
 
-def _run_local(sdk, tool_name, target, extra_config):
+def _run_local(sdk, tool_name, target, extra_config, tool_args=None):
     """Run a tool locally using the installed binary."""
     from praetorian_cli.runners.local import LocalRunner, get_tool_plugin
 
@@ -392,7 +414,7 @@ def _run_local(sdk, tool_name, target, extra_config):
         raw_target = parts[-1] if len(parts) > 3 else parts[2] if len(parts) > 2 else target
 
     plugin = get_tool_plugin(tool_name)
-    args = plugin.build_args(raw_target, extra_config)
+    args = plugin.build_args(raw_target, extra_config, pass_through=list(tool_args or []))
 
     click.echo(f'Running {tool_name} locally against {raw_target}...')
     click.echo(f'Command: {tool_name} {" ".join(args)}')
@@ -408,6 +430,10 @@ def _run_local(sdk, tool_name, target, extra_config):
         proc.wait(timeout=600)
     except subprocess.TimeoutExpired:
         proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except Exception:
+            pass
         click.echo('\nTimed out (10 min).', err=True)
 
     stderr = proc.stderr.read() if proc.stderr else ''

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/update.py

@@ -16,8 +16,10 @@ def update():
 @click.argument('key', required=True)
 @click.option('-s', '--status', type=click.Choice([s.value for s in Asset]), help='The status of the asset')
 @click.option('-f', '--surface', required=False, default='', help=f'Attack surface of the asset', show_default=False)
-def asset(chariot, key, status, surface):
-    """ Update the status or surface of an asset
+@click.option('--secret', default=None,
+              help='For WebApplication assets, the credential ID to set as the default credential')
+def asset(chariot, key, status, surface, secret):
+    """ Update the status, surface, or default credential of an asset
 
     \b
     Argument:
@@ -27,8 +29,9 @@ def asset(chariot, key, status, surface):
     Example usages:
         - guard update asset "#asset#www.example.com#1.2.3.4" -s F
         - guard update asset "#asset#www.example.com#1.2.3.4" -f internal
+        - guard update asset "#webapplication#https://app.example.com" --secret abc-123
     """
-    chariot.assets.update(key, status, surface)
+    chariot.assets.update(key, status, surface, secret=secret)
 
 
 @update.command()

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/handlers/utils.py

@@ -17,7 +17,7 @@ def parse_configuration_value(
         error('--entry cannot be combined with --string, --integer, or --float')
 
     if has_entries:
-        return _parse_entry_dict(entries)
+        return parse_kv_entries(entries)
 
     provided = [(name, value) for name, value in typed_values.items() if value is not None]
 
@@ -30,27 +30,29 @@ def parse_configuration_value(
     return _cast_typed_value(value_type, raw_value)
 
 
-def _parse_entry_dict(entries):
-    parsed = {}
+def parse_kv_entries(entries, label='Entry'):
+    """Parse an iterable of 'key=value' strings into a dict.
+
+    Splits on the first '=' so values may themselves contain '=' (e.g.
+    base64-padded tokens, cookies). Calls error() (exits) on bad input.
 
+    :param entries: iterable of 'key=value' strings
+    :param label: human-readable label for the entry kind (used in error messages,
+        e.g. 'Header', '--param')
+    """
+    parsed = {}
     for item in entries:
-        key, value = _split_entry(item)
+        if '=' not in item:
+            error(f"{label} '{item}' is not in the format key=value")
+        key, value = item.split('=', 1)
         if not key:
-            error(f'Key cannot be empty: {item}')
+            error(f'{label} key cannot be empty: {item}')
         if not value:
-            error(f'Value cannot be empty: {item}')
+            error(f'{label} value cannot be empty: {item}')
         parsed[key] = value
     return parsed
 
 
-def _split_entry(item):
-    if '=' not in item:
-        error(f"Entry '{item}' is not in the format key=value")
-    if item.count('=') > 1:
-        error(f"Entry '{item}' contains multiple '=' characters. Format should be key=value")
-    return item.split('=', 1)
-
-
 def _cast_typed_value(value_type, raw_value):
     try:
         if value_type == 'integer':

{praetorian_cli-2.4.2 → praetorian_cli-2.4.4}/praetorian_cli/runners/local.py

@@ -34,6 +34,45 @@ INSTALLABLE_TOOLS = {
 }
 
 
+# Well-known service ports for Brutus protocol auto-detection.
+# Keep this minimal: only protocols Brutus natively supports.
+_WELL_KNOWN_PORTS = {
+    22: 'ssh',
+    3389: 'rdp',
+    21: 'ftp',
+    445: 'smb',
+    23: 'telnet',
+    3306: 'mysql',
+    5432: 'postgres',
+}
+
+
+def _infer_protocol(target: str):
+    """Infer protocol from a 'host:port' target using well-known ports.
+
+    Returns the protocol name or None if no inference is possible.
+    """
+    if not target or ':' not in target:
+        return None
+    # rsplit so 'host:port' works even if host contains ':'
+    _, sep, port_str = target.rpartition(':')
+    if not sep:
+        return None
+    try:
+        port = int(port_str)
+    except ValueError:
+        return None
+    return _WELL_KNOWN_PORTS.get(port)
+
+
+def _has_flag(pass_through, *flags):
+    """Return True if any of the given flag names appears in pass_through."""
+    if not pass_through:
+        return False
+    flag_set = set(flags)
+    return any(arg in flag_set for arg in pass_through)
+
+
 def _detect_platform():
     """Detect OS and architecture for binary download."""
     system = platform.system().lower()
@@ -191,88 +230,134 @@ class LocalRunner:
 class ToolPlugin:
     """Base class for local tool argument builders."""
 
-    def build_args(self, target, extra_config=''):
+    def build_args(self, target, extra_config='', pass_through=None):
         config = {}
         if extra_config:
             try:
                 config = json.loads(extra_config) if isinstance(extra_config, str) else extra_config
             except (json.JSONDecodeError, TypeError):
                 pass
-        return self._build(target, config)
+        args = self._build(target, config, pass_through=pass_through)
+        return args
 
-    def _build(self, target, config):
-        return [target]
+    def _build(self, target, config, pass_through=None):
+        args = [target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
 class BrutusPlugin(ToolPlugin):
-    def _build(self, target, config):
-        args = ['-t', target]
-        if config.get('usernames'):
+    def _build(self, target, config, pass_through=None):
+        args = ['--target', target]
+
+        # Protocol precedence: caller passthrough (silent) > config['protocol'] > inferred from port
+        caller_has_protocol = _has_flag(pass_through, '--protocol')
+        if not caller_has_protocol:
+            proto = config.get('protocol') or _infer_protocol(target)
+            if proto:
+                args.extend(['--protocol', proto])
+
+        if config.get('usernames') and not _has_flag(pass_through, '-u', '-U'):
             args.extend(['-u', config['usernames']])
-        if config.get('passwords'):
+        if config.get('passwords') and not _has_flag(pass_through, '-p', '-P'):
             args.extend(['-p', config['passwords']])
+
+        if pass_through:
+            args.extend(pass_through)
         return args
 
 
 class NucleiPlugin(ToolPlugin):
-    def _build(self, target, config):
+    def _build(self, target, config, pass_through=None):
         args = ['-u', target, '-jsonl']
         if config.get('templates'):
             args.extend(['-t', config['templates']])
+        if pass_through:
+            args.extend(pass_through)
         return args
 
 
 class TitusPlugin(ToolPlugin):
-    def _build(self, target, config):
+    def _build(self, target, config, pass_through=None):
         args = ['scan', target]
         if config.get('validation') == 'true':
             args.append('--validate')
+        if pass_through:
+            args.extend(pass_through)
         return args
 
 
 class TrajanPlugin(ToolPlugin):
-    def _build(self, target, config):
+    def _build(self, target, config, pass_through=None):
         args = ['scan', target]
         if config.get('token'):
             args.extend(['--token', config['token']])
+        if pass_through:
+            args.extend(pass_through)
         return args
 
 
 class JuliusPlugin(ToolPlugin):
-    def _build(self, target, config):
-        return ['-t', target]
+    def _build(self, target, config, pass_through=None):
+        args = ['-t', target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
 class AugustusPlugin(ToolPlugin):
-    def _build(self, target, config):
-        return ['scan', '-t', target]
+    def _build(self, target, config, pass_through=None):
+        args = ['scan', '-t', target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
 class NervaPlugin(ToolPlugin):
-    def _build(self, target, config):
-        return ['-t', target]
+    def _build(self, target, config, pass_through=None):
+        args = ['-t', target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
 class GatoPlugin(ToolPlugin):
-    def _build(self, target, config):
+    def _build(self, target, config, pass_through=None):
         args = ['enumerate', '-t', target]
         if config.get('token'):
             args.extend(['--token', config['token']])
+        if pass_through:
+            args.extend(pass_through)
         return args
 
 
 class UrlTargetPlugin(ToolPlugin):
     """For tools that take scan -u <target>."""
-    def _build(self, target, config):
-        return ['scan', '-u', target]
+    def _build(self, target, config, pass_through=None):
+        args = ['scan', '-u', target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
 class ScanTargetPlugin(ToolPlugin):
     """For tools that take scan <target>."""
-    def _build(self, target, config):
-        return ['scan', target]
+    def _build(self, target, config, pass_through=None):
+        args = ['scan', target]
+        if pass_through:
+            args.extend(pass_through)
+        return args
 
 
+# Plugin verification status:
+# - brutus:      verified against brutus --help (ENG-3042)
+# - nuclei:      -u is the documented URL flag — OK
+# - julius/nerva/nero: use -t <target>; unverified against each binary's --help
+# - titus/trajan/vespasian/constantine/caligula: `scan <target>` — unverified
+# - augustus/gato: `scan -t <target>` / `enumerate -t <target>` — unverified
+# - cato/florian/hadrian: `scan -u <target>` — unverified
+# Users can always override via `guard run tool <tool> <target> -- <raw args>`.
 TOOL_PLUGINS = {
     'brutus':      BrutusPlugin(),
     'nuclei':      NucleiPlugin(),