# Project export: re:zero This document was generated by HackStack to give an AI agent context about a hackathon project. Sections are labeled with their provenance; content marked as truncated was cut to keep this document small. ## Project metadata - Hackathon: TreeHacks 2026 - Tagline: Reverse engineer anything - websites, hardware, encryption! - Devpost: https://devpost.com/software/re-zero - GitHub: https://github.com/tetraslam/re-zero - Demo: https://rezero.sh/ - Team: 5 GitHub contributor(s) — William Y. Feng (25 commits), shresht (18 commits), Claude Opus 4.6 (16 commits), mouad-hpc (11 commits), Kenneth Chap (2 commits) ## Devpost submission (written by the team) ### Inspiration A week ago, Anthropic released Claude Opus 4.6 after disclosing that it found 500+ vulnerabilities in many popular, well-tested open-source repos/software. We wanted to extend this to EVERY target possible, so that we can improve security faster than agents degrade it. ### What it does It's a platform with an agent named Rem who will reverse-engineer and penetration test anything. For websites, this includes your public site and also authed routes if you give Rem test credentials. She'll even handle 2FA codes by asking you for them when she hits that snag! We used Browserbase/Stagehand for this. For OSS repos, we clone the repo to a Modal sandbox and have Rem run a series of vulnerability tests and just manual exploration of the code to analyze attack surfaces. For hardware, we also use sandboxes to give Rem a scratchpad with which to interact with hardware like drones, webcams, ESP32s, etc. She also has access to an FPGA with a program which can analyze power fluctuations in a device running AES-256 encryption (government comms, financial systems, cloud storage, VPNs, smartphones, etc.) and decrypt their key by measuring the fluctuations in power on the device running encryption. ### How we built it We reverse-engineered the drone by tapping into its wireless protocol and emulating its app's signals to take control of the drone's flight. We also reverse-engineered a webcam by modifying its drivers. For inference and agent sandboxes, we used Modal GPUs, Sandboxes, volumes, and services. All our RL environments use prime-rl environments from Prime Intellect's Environments Hub, and we specifically focused on CTFs, phishing detection, vulnerability detection, and code security. We served our custom-trained models using vLLM running on Modal. ### Challenges we ran into Reverse engineering is not universal, as hardware contains different entry points and different protocols that does not have to be standardized. It was difficult to build a system for distributed reverse engineering. Training the model was also challenging because we had to build and train on our own dataset of phishing scams and GitHub bugs and vulnerabilities across 5 environments. FPGAs are impossibly hard to work with, and our drone has a stabilization problem which we did manage to fix. Tying everything together in a cohesive platform was marvelous but deathly hard because of the really different stacks different targets use. Also, we ran reinforcement learning on an open Nvidia model (OpenReasoning-Nemotron-14b) on cybersec and pentesting, and that was our first pass on a pretty large rollout of GRPO on any model. We used Prime Intellect's (https://primeintellect.ai) stack for RL and verifiers, and Modal for compute. ### Accomplishments we're proud of Rem was able to reverse engineer a drone and a webcam Kenneth and Rem cracked AES-256 encryption, which is one of the most widely-used encryption protocols in the world Rem found several hundred zero-days in OSS repos which we are disclosing to their maintainers directly Rem also found at least 22 REALLY bad exploits on Shresht's personal website (https://tetraslam.world) which he will be fixing right after this hackathon, or so he swears ### What we learned How firmware is implemented and used in conjunction with software. IoT device safety is at greater risk because of AI, even going down to electrical signals. One could steal encryption keys by tapping into a chip's voltage line and monitoring timing fluctuations going through FPGA logic gates. Hardware is cool but agents reverse engineering hardware is even cooler. ### What's next We have everything set up but payments. We only have $200 in Claude API credits remaining so we'll probably set up a Stripe account and see how people like this, especially since it seems highly useful for indie devs and small-scale usage with outsized impact on their security. We'll also be open-sourcing several third-party SDKs we've now created to interface with the variety of hardware that Rem was able to reverse-engineer. ## README (from the GitHub repository) # Re:Zero ## Reverse Engineer Anything. The universal autonomous red teaming platform. Point it at any attack surface — source code, web infrastructure, physical hardware — and AI agents will reverse engineer it, find vulnerabilities, and generate a full security audit. One platform, any target, zero prior knowledge required. ## The Pitch There are ~500k unfilled cybersecurity jobs globally. Pen testers cost $200-400/hr. Most companies test annually if at all. Hardware supply chain audits require specialists that barely exist. Every existing player is vertical-locked: Pentera does networks, Synack (YC W13) does web apps, Snyk does code. Nobody does hardware. But the reasoning pattern is the same across all surfaces: 1. **Recon** — map the attack surface 2. **Hypothesize** — what could be vulnerable? 3. **Probe** — test the hypothesis 4. **Escalate** — how far can you go? 5. **Report** — document findings + remediation The only thing that changes is the tool suite. That's Re:Zero. ## Stuff we need to do - [ ] Get Claude Code SDK on reverse engineering - [ ] RL-train GLM-4.7V and Nemotron 3 Nano (30b-A3B) on CTF environments (Prime Intellect environments hub) for reverse engineering and pentesting - [ ] Set up a web app (dashboard, "projects", project types so web, codebase, and hardware, with overlap allowed) - [ ] Convex backend (including functions which connect to modal and monitor your relevant sandboxes) - [ ] Modal sandboxes - [ ] Agent harness: skills, ghidra/other mcps, subagents -> opencode? - [ ] Targets for demo: open source repos (target C/C++, IoT, MCPs, OpenClaw), drone, 3d printer, laptop - [ ] FPGA logic analyzer firmware as a tool for the agent ## The Four Modes 1. Code mode (OSS) 2. Hardware RE (drone) 3. Side-channel mode (extract AES key from power traces via FPGA) 4. Web ## Team 1. Shresht: claude code sdk, agent harnesses, modal sandboxes, convex backend, frontend (live agent streams, camera feed views, waveform visualization for fpga travces, scan results, unified reports), 0-day farming pipeline (on sandboxes), perplexity sonar, demo 2. Kenneth: ChipWhisperer HDL -> Genesys 2, Pmod ADC, trigger logic, DDR3 trace buffer, python api for agent integration, ESP32 AES target setup with shunt resistor 3. Mouad: RL training pipeline (Prime Intellect CTF environments, cybersec reasoning, vulnerability reasoning, PCBs, protocol analysis) on GLM-4.7V, Nemotron 3 Nano, create vLLM config for Modal deployment 4. William: ESP32 probe controller firmware (drone, etc), drone flight controller interface, probe jig, wiring, camera, help shresht with frontend and agent harnesses, join kenneth on fpga ## Project Structure ``` re-zero/ ├── web/ # Next.js dashboard, Convex, Clerk auth ├── server/ # FastAPI, Claude Code SDK agents, Modal sandboxes, Perplexity Sonar ├── hardware/ # ESP32 firmware (William), FPGA RTL + Python API (Kenneth) ├── training/ # RL training (Prime Intellect CTF envs), vLLM deploy configs (Mouad) └── targets/ # demo target info, intentionally vulnerable test apps ``` ### Stack - **Frontend:** Next.js, shadcn/ui, Vercel AI SDK UI, Clerk, Vercel - **Database:** Convex (real-time sync for live agent state → dashboard) - **API + Agents:** FastAPI, Claude Code SDK, Anthropic Agent SDK, Pydantic - **Compute:** Modal (sandboxes for code targets, GPUs for model serving + training) - **RL-trained Models:** GLM-4.7V, Nemotron 3 Nano — RL via Prime Intellect CTF environments, served via vLLM on Modal - **Research:** Perplexity Sonar API (CVE lookup, datasheets, component ID) - **Hardware Probing:** ESP32 (PlatformIO), USB serial bridge - **Side-Channel:** Kintex-7 FPGA (Verilog), ChipWhisperer Python analyzer - **Deployment:** Vercel (frontend), Railway (API server), Modal (sandboxes + gpus) ## Target customers - Any app/website/software big enough to need security for its users - IoT companies - Data centers - Cloud providers - Defense/government - Automotive - Medical devices - Power grids, water treatment, manufacturing - Semiconductor companies (chip-level security) - Crypto - Anyone who needs to get compliance certified ## Tracks we're targeting - Anthropic Claude Code SDK - Modal (sandboxes and main track) - Nvidia (inference and open models track) - Human Capital (company track) - YC track (Salt Security) - Human Capital Fellowship track - Greylock (multiturn agent track) - Vercel (best use of vercel) - Perplexity (Sonar API track) ## Detected evidence (automated analysis) Indexed codebase: 236 recognized source files, 1525 KB. - C (language) — detected in the code - CSS (language) — detected in the code - FastAPI (technology) — detected in the code - HTML (language) — detected in the code - JavaScript (language) — detected in the code - Next.js (technology) — detected in the code - Python (language) — detected in the code - React (technology) — detected in the code - Tailwind CSS (technology) — detected in the code - TypeScript (language) — detected in the code - Anthropic (technology) — claimed on Devpost, not found in the code - Vercel (technology) — claimed on Devpost, not found in the code - AI coding agent: Claude Code — evidence: config files committed to the repository; commit authorship or trailers ## Codebase structure (from repository index) ### Files (120 of 467) ``` .claude/architecture.md .gitignore 2026-02-14-024107-i-have-a-seperate-claude-right-now-and-like-im-get.txt action/action.yml CLAUDE.md cli/.gitignore cli/package.json cli/src/commands/init.ts cli/src/commands/login.ts cli/src/commands/scan.ts cli/src/commands/status.ts cli/src/commands/update.ts cli/src/index.ts cli/src/lib/api.ts cli/src/lib/config.ts cli/src/lib/git.ts cli/src/lib/output.ts cli/src/lib/tarball.ts cli/src/types.ts cli/tsconfig.json hardware/.gitignore hardware/drone/.gitignore hardware/drone/controller/.python-version hardware/drone/controller/controller.ipynb hardware/drone/controller/drone.py hardware/drone/controller/log_neutral.log hardware/drone/controller/log.log hardware/drone/controller/main.py hardware/drone/controller/pyproject.toml hardware/drone/controller/README.md hardware/drone/controller/uv.lock hardware/drone/controller/wait_telemetry.log hardware/drone/controller/web_static/index.html hardware/drone/controller/web.py hardware/drone/drone_bridge_re/bridge/__init__.py hardware/drone/drone_bridge_re/bridge/bridge.py hardware/drone/drone_bridge_re/bridge/requirements.txt hardware/drone/drone_bridge_re/bridge/serial_frame.py hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/dependency_links.txt hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/entry_points.txt hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/PKG-INFO hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/requires.txt hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/SOURCES.txt hardware/drone/drone_bridge_re/drone_bridge_re.egg-info/top_level.txt hardware/drone/drone_bridge_re/drone_protocol.md hardware/drone/drone_bridge_re/esp32_ap/esp32_ap.ino hardware/drone/drone_bridge_re/esp32_ap/serial_frame.h hardware/drone/drone_bridge_re/esp32_sta/esp32_sta.ino hardware/drone/drone_bridge_re/esp32_sta/forward_types.h hardware/drone/drone_bridge_re/esp32_sta/serial_frame.h hardware/drone/drone_bridge_re/logs/bridge_1771135354.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771135378.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771135414.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771135601.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771135789.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771136751.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771136924.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771137197.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771137269.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771137308.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771137317.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771137320.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138103.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138105.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138152.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138157.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138162.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138510.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138560.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138592.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138763.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138816.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138932.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138934.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138943.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138972.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771138993.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139088.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139165.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139179.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139250.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139329.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771139514.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771140318.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771147972.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148051.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148103.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148106.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148126.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148180.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148276.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148312.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148336.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771148410.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149167.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149245.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149248.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149271.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149311.jsonl hardware/drone/drone_bridge_re/logs/bridge_1771149499.jsonl hardware/drone/drone_bridge_re/logs/buttons.txt hardware/drone/drone_bridge_re/logs/estop.txt hardware/drone/drone_bridge_re/logs/forward_backward_trim.txt hardware/drone/drone_bridge_re/logs/gravity_sensor.txt hardware/drone/drone_bridge_re/logs/gyro_calibrate.txt hardware/drone/drone_bridge_re/logs/headless.txt hardware/drone/drone_bridge_re/logs/old/bridge_1771129489.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130410.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130439.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130773.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130841.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130878.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771130906.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771131263.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771131290.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771131890.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771132695.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771132760.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771133704.jsonl hardware/drone/drone_bridge_re/logs/old/bridge_1771134195.jsonl [347 more files omitted for size] ``` ### Dependencies - cli/package.json: @types/node@^20.0.0, chalk@^5.4.0, commander@^13.0.0, ora@^8.0.0, typescript@^5.7.0 - hardware/drone/controller/pyproject.toml: aiohttp@>=3.10.0, ipykernel@>=7.2.0, ipywidgets@>=8.1.0, numpy@>=2.4.2, opencv-python@>=4.10.0.0 - hardware/drone/drone_bridge_re/bridge/requirements.txt: pyserial@>=3.5 - hardware/drone/drone_bridge_re/pyproject.toml: pyserial@>=3.5 - hardware/drone/esp_controller/server/pyproject.toml: aiohttp@>=3.10.0, aiortc@>=1.8.0, av@>=12.0.0, numpy@>=2.2.0, opencv-python-headless@>=4.10.0.0 - hardware/drone/esp_controller/vps_server/pyproject.toml: fastapi[standard]@>=0.110, uvicorn[standard]@>=0.27 - server/pyproject.toml: anthropic[bedrock]@>=0.80.0, convex@>=0.7.0, fastapi@>=0.129.0, httpx@>=0.28.1, modal@>=1.3.3, pydantic@>=2.12.5, pydantic-settings@>=2.12.0, stagehand@>=3.5.0, uvicorn@>=0.40.0 - training/pyproject.toml: huggingface-hub@>=1.4.1, mlflow@>=3.9.0, modal@>=1.3.3, rouge-score@>=0.1.2, seaborn@>=0.13.2 - web/package.json: @base-ui/react@^1.2.0, @clerk/nextjs@^6.37.4, @clerk/themes@^2.4.52, @hookform/resolvers@^5.2.2, @paper-design/shaders-react@^0.0.71, @tailwindcss/postcss@^4, @types/node@^20, @types/react@^19, @types/react-dom@^19, animejs@^4.3.6, autumn-js@^0.1.75, class-variance-authority@^0.7.1, clsx@^2.1.1, cmdk@^1.1.1, convex@^1.31.7, date-fns@^4.1.0, embla-carousel-react@^8.6.0, eslint@^9, eslint-config-next@16.1.6, input-otp@^1.4.2, lucide-react@^0.564.0, next@16.1.6, next-themes@^0.4.6, radix-ui@^1.4.3, react@19.2.3, react-day-picker@^9.13.2, react-dom@19.2.3, react-hook-form@^7.71.1, react-resizable-panels@^4, recharts@2.15.4, shadcn@^3.8.4, sonner@^2.0.7, tailwind-merge@^3.4.0, tailwindcss@^4, tw-animate-css@^1.4.0, typescript@^5, vaul@^1.1.2, zod@^4.3.6 ### Recent commits (newest first) - updated ref - reference - updated UI a lot and orchestrator/prompt - Fix web scan agent: proxy streaming, variables, timeouts, and prompt rewrite - Fix Stagehand: proxy Anthropic API to Bedrock for SEA binary - Fix Stagehand Chrome: symlink at build time, fail fast if missing - Fix Stagehand Chrome path: search both chromium and headless_shell paths - Increase Stagehand SEA binary timeout to 60s, add debug logging - Fix Stagehand: use camelCase keys for browser launch options - Fix Stagehand: pass launch_options with Chrome path for local browser - Fix Stagehand: pass browser type=local to skip browserbase header check - Replace raw Playwright with Stagehand AI browser automation for web scans - Redesign scan sidebar: model labels, relative time, duration - Fix OpenCode config: use custom provider for includeUsage - Fix OpenCode SSE relay hang + NaN token crash - Fix dropdown z-index clipping from oni shimmer overflow-hidden - updated oni mode - usage graph updates and model selector standardization - updated usage graphs and deploy UI - updated billing and model selector ## Key source files (fetched from GitHub, selected and truncated for size) ### CLAUDE.md ```markdown # CLAUDE.md This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. ## What Re:Zero Is Autonomous AI security scanning platform. Agent "Rem" red-teams source code and web apps. One platform, multiple scan types, AI-powered vulnerability discovery. **Live services:** - **Web dashboard**: Vercel (rezero.sh) — Next.js + Convex + Clerk - **API server**: Railway (api.rezero.sh) — FastAPI, stateless orchestrator - **Database**: Convex cloud (steady-mosquito-754) — all persistent state - **Compute**: Modal (re-zero-sandbox) — sandboxed scan agents - **Billing**: Autumn (usage-based, per-scan via Stripe) - **Auth**: Clerk (OAuth, JWT) ## Monorepo Structure ``` re-zero/ ├── web/ # Next.js dashboard + Convex backend (see web/CLAUDE.md) ├── server/ # FastAPI orchestrator (see server/CLAUDE.md) ├── cli/ # rem-scan npm package (Commander.js + TypeScript) ├── action/ # GitHub Actions composite action (action.yml) ├── training/ # RL training pipeline on Modal (see training/CLAUDE.md) ├── hardware/ # Hackathon hardware demos (inactive) ├── PLANNING.md # Strategy, pricing, roadmap, competitive analysis └── CLAUDE.md # This file ``` Each subdirectory with a CLAUDE.md has detailed architecture docs. This file covers cross-cutting concerns. ## Commands ```bash # Web (Next.js + Convex) cd web && pnpm dev # Next.js dev server cd web && pnpm exec convex dev # Convex dev (separate terminal) # Server (FastAPI) cd server && uv run uvicorn main:app --reload # CLI cd cli && npm run build # Compile TypeScript cd cli && node dist/index.js # Run locally # Training cd training && .venv/bin/modal run deploy/train.py --config .toml ``` ## Architecture Flow ``` User → CLI (rem scan .) → POST /scans/launch → Railway server → Creates project + scan in Convex → Spawns Modal sandbox (run_oss_scan or run_web_scan) → Claude agent reads code / browses site → Agent writes actions directly to Convex (real-time) → Agent calls submit_findings → report saved to Convex → Frontend subscribes via Convex reactivity (live updates) → Autumn tracks usage on scan completion ``` Gate scans (CI): `POST /gate/scan` → Haiku single-shot on git diff → findings (no Modal, synchronous, <10s) ## API Endpoints (server) | Route | Purpose | |-------|---------| | `POST /scans/launch` | All-in-one: create project, scan, launch Modal | | `POST /scans/start` | Internal: launch Modal from existing scan | | `GET /scans/{id}/poll` | Poll actions + report | | `POST /scans/action` | Agent callback: push action to Convex | | `POST /scans/report` | Agent callback: submit findings | | `POST /scans/upload-url` | Presigned URL for tarball upload | | `POST /scans/verify` | Validate API key | | `POST /gate/scan` | Synchronous Haiku gate scan on diffs | | `GET /health` | Health check | ## CLI Commands | Command | Status | |------ [truncated — 2860 more characters] ``` ### server/CLAUDE.md ```markdown # Server — Re:Zero ## What this is Stateless FastAPI server that orchestrates Modal sandboxes for security scanning agents, relays agent actions to Convex, and manages hardware gateways. All persistent state lives in Convex. ## Package management - **uv only**. Never use pip. Never manually edit pyproject.toml for package versions. - `uv add ` / `uv remove ` / `uv sync` ## Running ```bash uv run uvicorn main:app --reload ``` ## Architecture ``` server/ ├── main.py # FastAPI app, CORS, routers ├── app/ │ ├── config.py # Settings from .env (Convex URL, deploy key, Modal tokens) │ ├── convex_client.py # HTTP client for calling Convex mutations/queries │ ├── routers/ │ │ ├── scans.py # POST /scans/launch, /scans/start, /scans/action, /scans/report, /scans/verify │ │ ├── gate.py # POST /gate/scan (synchronous Haiku gate scan on diffs) │ │ └── gateways.py # POST /gateways/heartbeat │ ├── lib/ │ │ ├── anthropic_client.py # Shared Anthropic/Bedrock client factory │ │ └── autumn.py # Autumn billing: autumn_check, autumn_track │ └── sandbox/ │ └── orchestrator.py # Modal functions: run_oss_scan, run_web_scan ``` ## Scan modes ### OSS (source code) - Modal function: `run_oss_scan` - Image: `sandbox_image` (debian + git + httpx/anthropic) - Flow: clone repo → Claude agent reads/searches files → submit findings - Tools: `read_file`, `search_code`, `submit_findings` + Firecrawl MCP ### Web (pentesting) - Modal function: `run_web_scan` - Image: `web_sandbox_image` (debian + Playwright/Chromium + Stagehand) - Flow: launch headless Chrome → Claude agent browses/tests target → submit findings - Tools: `navigate`, `observe`, `act`, `extract`, `execute_js`, `screenshot`, `submit_findings` + Firecrawl MCP - Browser: Stagehand (server=local, Haiku for element resolution) → Playwright via CDP for raw JS/screenshots (all in Modal container, no external browser service) - Screenshots: uploaded to Convex file storage via `storage:generateUploadUrl` mutation, storageId stored in action payload - Auth: if test account provided, scans both unauthenticated and authenticated surfaces - Active testing: injects XSS/SQLi payloads, tests auth bypass, checks headers, CORS, cookies ## Key patterns - **Stateless**: Server stores nothing locally. All state → Convex via `convex_client.py`. - **Agent callbacks**: Agents in Modal sandboxes write directly to Convex (not back to server). Frontend subscribes via Convex reactivity. - **Report submission**: Agents call `_submit_report()` which writes to Convex and marks scan completed. - **MCP**: Firecrawl MCP server available to agents via Anthropic's MCP connector beta (`betas=["mcp-client-2025-11-20"]`). ## Convex integration - Uses HTTP API (not the Convex Python SDK's real-time client) for simplicity - Auth: `Authorization: Convex {deploy_key}` header - Mutations: POST to `{CONVEX_URL}/api/mutation` with `{path, args}` - Queries: POST to `{C [truncated — 386 more characters] ``` ### training/pyproject.toml ``` [project] name = "training" version = "0.1.0" description = "Add your description here" readme = "README.md" requires-python = ">=3.12" dependencies = [ "huggingface-hub>=1.4.1", "mlflow>=3.9.0", "modal>=1.3.3", "rouge-score>=0.1.2", "seaborn>=0.13.2", ] ``` ### server/pyproject.toml ``` [project] name = "server" version = "0.1.0" description = "Add your description here" readme = "README.md" requires-python = ">=3.13" dependencies = [ "anthropic[bedrock]>=0.80.0", "convex>=0.7.0", "fastapi>=0.129.0", "httpx>=0.28.1", "modal>=1.3.3", "pydantic>=2.12.5", "pydantic-settings>=2.12.0", "stagehand>=3.5.0", "uvicorn>=0.40.0", ] ``` ### cli/package.json ``` { "name": "rem-scan", "version": "0.4.0", "description": "Re:Zero security scanner CLI", "type": "module", "bin": { "rem": "./dist/index.js" }, "files": [ "dist" ], "scripts": { "build": "tsc", "dev": "tsc --watch", "release": "npm version minor --no-git-tag-version && npm run build && npm publish", "release:major": "npm version major --no-git-tag-version && npm run build && npm publish" }, "engines": { "node": ">=18.0.0" }, "dependencies": { "chalk": "^5.4.0", "commander": "^13.0.0", "ora": "^8.0.0" }, "devDependencies": { "@types/node": "^20.0.0", "typescript": "^5.7.0" }, "keywords": [ "security", "scanner", "re-zero", "vulnerability" ], "license": "MIT", "repository": { "type": "git", "url": "https://github.com/Tetraslam/re-zero" } } ``` ### web/package.json ``` { "name": "web", "version": "0.1.0", "private": true, "scripts": { "dev": "next dev", "build": "next build", "start": "next start", "lint": "eslint" }, "dependencies": { "@base-ui/react": "^1.2.0", "@clerk/nextjs": "^6.37.4", "@clerk/themes": "^2.4.52", "@hookform/resolvers": "^5.2.2", "@paper-design/shaders-react": "^0.0.71", "animejs": "^4.3.6", "autumn-js": "^0.1.75", "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "cmdk": "^1.1.1", "convex": "^1.31.7", "date-fns": "^4.1.0", "embla-carousel-react": "^8.6.0", "input-otp": "^1.4.2", "lucide-react": "^0.564.0", "next": "16.1.6", "next-themes": "^0.4.6", "radix-ui": "^1.4.3", "react": "19.2.3", "react-day-picker": "^9.13.2", "react-dom": "19.2.3", "react-hook-form": "^7.71.1", "react-resizable-panels": "^4", "recharts": "2.15.4", "sonner": "^2.0.7", "tailwind-merge": "^3.4.0", "vaul": "^1.1.2", "zod": "^4.3.6" }, "devDependencies": { "@tailwindcss/postcss": "^4", "@types/node": "^20", "@types/react": "^19", "@types/react-dom": "^19", "eslint": "^9", "eslint-config-next": "16.1.6", "shadcn": "^3.8.4", "tailwindcss": "^4", "tw-animate-css": "^1.4.0", "typescript": "^5" } } ``` ### hardware/drone/controller/pyproject.toml ``` [project] name = "controller" version = "0.1.0" description = "Add your description here" readme = "README.md" requires-python = ">=3.12" dependencies = [ "aiohttp>=3.10.0", "ipykernel>=7.2.0", "ipywidgets>=8.1.0", "numpy>=2.4.2", "opencv-python>=4.10.0.0", ] [dependency-groups] dev = [ "ipykernel>=7.2.0", ] ``` ### hardware/drone/drone_bridge_re/pyproject.toml ``` [project] name = "drone-bridge-re" version = "0.1.0" requires-python = ">=3.12" dependencies = [ "pyserial>=3.5", ] [project.scripts] drone-bridge = "bridge.bridge:main" [build-system] requires = ["setuptools>=68"] build-backend = "setuptools.build_meta" [tool.setuptools.packages.find] include = ["bridge"] [tool.uv] package = true ``` ### hardware/fpga/vivado/docker-compose.yml ```yaml services: vivado: # image: public.ecr.aws/ubuntu/ubuntu:22.04 build: context: . dockerfile: Dockerfile platform: linux/amd64 container_name: vivado mac_address: '76:04:0a:69:a4:38' tty: true stdin_open: true working_dir: /root/fpga command: ['bash'] volumes: - ${HOME}/Downloads:/root/Downloads:cached - ${HOME}/Desktop/re-zero/hardware/fpga:/root/fpga - vivado_opt:/tools/Xilinx volumes: vivado_opt: ``` ### hardware/drone/drone_bridge_re/bridge/requirements.txt ``` pyserial>=3.5 ``` [214 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]