Human-led pentest · open source

The hound that never leaves the scope.

An AI agent that follows the scent, forms hypotheses and calls tools — but scope and permissions live outside the model. No prompt bypasses them. Inspired by the logic of Burp AT.

Start the case See on GitHub

C:\> git clone github.com/saulofilho/scopehound

scopehound.exe — chat lab

leads.txt

[LOW] missing CSP on /
[MED] enumeration on /login

SCOPEHOUND 95

01 · the method

The model asks. The policy decides. The tool runs.

At every step, a guardrails layer separate from the model validates scope, DNS, budget and permission before any request goes out. Same idea as Burp AT: the rule does not live in the prompt.

Control Panel — Policy

1Agent
forms hypotheses and asks for a tool
2Policy
allows, asks or denies — Ask / Act
3Tools
only what was allowed, through the egress

Guardrails (enforced outside the model)

Scope
DNS pinning
Budget
Kill switch
Rate limit
Audit

OKCancelApply

02 · the scent

Everything a detective needs — inside the fence.

Exploring — C:\scopehound\features

AddressC:\scopehound\features

Scope that can't be bypassed

Authorized host, port, path and method. Connects to the validated IP (DNS pinning), blocks cloud metadata and internal networks. Out of scope, nothing goes out.

Skills with methodology

IDOR, content discovery and race condition ready to go. The skill loads the playbook and restricts the tools to that work.

Case context

Capture proxy, HAR and Burp XML import, and a site map that normalizes /api/users/{id} and flags numeric parameters.

Approvals at your pace

Manual, Smart or Autonomous. Approve once, for the session, always, reject or redirect. The pause survives restarts.

/goal and subagents

Give it a goal and the agent pursues it across steps; for broad investigations, it splits the work into subagents with their own budget.

Local or server

Run on your machine with SQLite, or deploy for the team with Postgres, SSO login, roles and masking of sensitive data.

6 object(s)Scope: authorized

03 · the lead

A lead only becomes a finding when the proof matches.

The agent records leads and re-runs the proof of concept to confirm. No finding without reproducible evidence.

MS-DOS Prompt — scopehound chat lab

C:\LAB> scopehound chat lab --mode smart

you › map the API and look for IDOR
scopehound › I'll start with the baskets listing.
  ↳ send_request GET /rest/basket/6
  ↳ replay_as /rest/basket/6 as userB
scopehound › userB read userA's basket. Let me prove it.
  ↳ verify_finding GET /rest/basket/6 (expected: 200 + "UserId":21)

  [ OK ] VERIFIED  IDOR in /rest/basket/{id}  [HIGH]

C:\LAB>

04 · the reference

The logic of Burp AT, for local development.

The team already uses Burp AT. scopehound brings the same architecture outside Burp — and it runs on a server too.

burp_at.txt — Notepad

Agent inside Burp Suite Pro
Scope checked before acting
Manual / Smart / Autonomous
Skills bank
Project file and Logger

scopehound.txt — Notepad

Agent local or on a server, open source
Scope enforced at the egress, outside the model
Same three autonomy modes
File-based skills, yours included
Project in SQLite/Postgres with audit

05 · to work

Release the hound.

Python 3.12+ and uv. Point it only at systems you own or are authorized in writing to test.

scopehound Setup Wizard

Welcome to the scopehound wizard

Follow the steps below to configure the scope and release the hound in your lab.

REM install and configure the scope
git clone https://github.com/saulofilho/scopehound
cd scopehound && uv sync
cp scope.example.yaml scope.yaml

REM check the target without sending anything
uv run scopehound check http://localhost:3000 -s scope.yaml

REM create the project and chat with the agent
uv run scopehound project create lab -s scope.yaml
uv run scopehound chat lab --mode smart

< Read the docs See on GitHub >

Security notice

Authorized use only. The scope file is the contract: anything not in it is blocked before any I/O. Point scopehound only at systems you own or have written permission to test.