Client intake and wordlists

Give the agent a client-specific plan

saveAssessmentPlan stores objectives, human-readable allowed and prohibited methods, exact allowedToolNames, data handling, stop conditions, report audience, work ownership, and model data policy as a versioned evidence record. getAssessmentPlan reads the latest version. The managed worker receives the full catalog but the server rejects any call omitted from allowedToolNames before its handler runs, leaving a failed audit receipt. When a plan exists, its allowlist also gates direct manual MCP calls to the 14 assessment methods; denials are audited before the handler or command runs. Direct calls on legacy engagements without a plan keep their previous behavior and still pass engagement scope gates. This plan cannot expand createEngagement targets or time. An external-client plan needs a provider client-work approval reference before model drafting, and no-model permits only the deterministic draft. See the plan schema and example.

After a plan with modelDataPolicy: "local-agent" or "approved-provider" and nonempty allowedToolNames is recorded, launch the tool-using run:

{
  "tool": "runAgentAssessment",
  "arguments": {
    "engagementId": "client-2026-10",
    "profileId": "daybreak-cli-assessment",
    "timeoutSeconds": 900
  }
}

The response includes a run ID, status, model, toolCounts, imported evidence IDs, importMapRecordId, and an ID for unreviewed model output. If the model, MCP child, or an assessment tool fails, inspect the retained failure and any imported records before retrying. If only a start receipt exists after a process interruption, verify that the old process stopped and call reconcileAgentAssessment with that run ID, the reviewer identity, and the reason for the decision. The server will not silently replay the run. A process that finishes without a successful assessment-tool call is rejected; its bounded output is retained privately with a failed outcome and linked hash for diagnosis, never as verified finding evidence. A completed agent process does not make its observations confirmed findings. The worker blocks engagement creation, closure, plan changes, recursive assessment launches, reconciliation, and report publication.

Plan example

{
  "engagementId": "example-engagement",
  "client": "Example Client",
  "title": "Example application assessment",
  "assessmentType": "Web application and API",
  "objectives": ["Assess authorization boundaries using dedicated test accounts"],
  "authorizedMethods": ["Read-only discovery", "Bounded authenticated API tests"],
  "allowedToolNames": [
    "getRuntimeStatus",
    "getEngagement",
    "getAssessmentPlan",
    "nmapScan",
    "httpxProbe",
    "recordResearchActivity",
    "listEngagementRecords",
    "getEngagementRecord"
  ],
  "prohibitedMethods": ["Password attacks", "Production data access", "State-changing requests"],
  "dataHandling": "Retain private scanner evidence and send only sanitized summaries to the selected model.",
  "reportAudience": "Client security lead",
  "stopConditions": ["Unexpected customer data", "Service health alarm", "Scope redirect"],
  "workOwnership": "external-client",
  "modelDataPolicy": "local-agent"
}

Ask for useful wordlist clues

Call generateWordlist with engagementId and omit baseWords when the MCP client supports form elicitation. The server asks the authorized operator for known names and aliases, organization or product terms, dates, location or address terms, and prefix or suffix patterns. They may skip unknown categories or decline. The prompt excludes current passwords and patient data. If the client lacks form elicitation, the tool returns the questions so the assistant can ask and retry with explicit baseWords, dates, locationWords, and customPatterns. The private wordlist record retains input counts and a SHA-256 digest rather than the supplied words or a sample of the list. Wordlist creation does not authorize password attempts; hydraBruteforce, runJohnTheRipper, and runHashcat must also fit the engagement methods.

Researcher invocations

generateWordlist can elicit missing facts through MCP. The agent prompt uses this question:

What information do you have that could likely be helpful? Provide only authorized facts: known names or aliases, organization or product terms, dates, address or location fragments, username, email or phone formats, and actual password format rules.

The operator can accept, decline or cancel. The server logs input counts and provenance, not clue values. The agent cannot invent personal facts or substitute scraped breach data. Use the same pattern when a method needs a dedicated test identity, owned endpoint, protocol peer, synthetic document, credential role or emergency contact. Missing required input means skip the method and record the coverage gap.