First engagement

Register an engagement

Call createEngagement before scanning. Use dates, targets, and references from the actual signed authorization; the values below are illustrative.

json

{
  "tool": "createEngagement",
  "arguments": {
    "engagementId": "client-2026-10",
    "authorizationReference": "Signed SoW section 4, approved 2026-10-24",
    "notBefore": "2026-10-25T09:00:00-06:00",
    "expiresAt": "2026-10-26T18:00:00-06:00",
    "allowedTargets": ["app.example.com", "192.0.2.0/28"],
    "excludedTargets": ["192.0.2.7"],
    "testingWindows": [
      {
        "start": "2026-10-25T09:00:00-06:00",
        "end": "2026-10-25T17:00:00-06:00"
      }
    ]
  }
}

Allowed targets accept exact hosts, CIDRs, wildcard subdomains, and HTTP(S) URL prefixes. Exclusions take precedence. All timestamps need an explicit timezone. getEngagement and listEngagements inspect stored registrations. closeEngagement revokes later execution, aborts managed assessments running in the same server process, and causes a separate managed runner to stop when it observes the parent registry closure.

Run and review

Use the same engagementId for active tools. The default non-root container supports a TCP connect scan; SYN and OS detection need additional privileges that are not granted by default.

json

{
  "tool": "nmapScan",
  "arguments": {
    "engagementId": "client-2026-10",
    "target": "app.example.com",
    "scanTechnique": "Connect",
    "serviceVersionDetection": true
  }
}

A successful tool response includes a recordId for its stored evidence. Retrieve only the records you need:

json

{
  "tool": "listEngagementRecords",
  "arguments": {
    "engagementId": "client-2026-10",
    "limit": 50
  }
}

listEngagementRecords returns summaries and accepts limit and offset for paging through older records. getEngagementRecord takes both engagementId and recordId and returns stored evidence when permitted. Credential tools return counts and output digests. New unauthenticated Gobuster/Nikto records retain private scanner output and findings for owner-scoped reads; older scanner records remain redacted. Nmap XML and bounded ffuf/Nuclei machine output are retained alongside summaries. A record's outcome is succeeded, failed, or cancelled, with a start time and duration when tracked; subprocess failures create an audit record rather than a successful scan result. A preflight scope refusal starts no command. For authenticated HTTP, engagement and evidence access is scoped to the verified token owner; stdio data is local to the server installation.

First engagement ​

Register an engagement ​

Run and review ​

First engagement

Register an engagement

Run and review