cert-x-gen - Polyglot execution engine and CLI for vulnerabilit

项目说明

<h1 align="center">CERT-X-GEN</h1>
<h4 align="center">A Polyglot Execution Engine for Detection</h4>

<p align="center">
Write security checks as real code — Python, Rust, Go, C, Shell, or YAML — and run them reproducibly, at scale.
</p>

<p align="center">
<a href=" src="
<a href=" src="
<a href=" src="
</p>

<p align="center">
<a href="#what-is-cert-x-gen">What is it</a> •
<a href="#two-surfaces">Surfaces</a> •
<a href="#installation">Install</a> •
<a href="#quick-start">Quick Start</a> •
<a href="#templates">Templates</a> •
<a href=" •
<a href=" Repo</a>
</p>

---

What is CERT-X-GEN

Modern security scanning has outgrown static templates. Today's detection often requires real programming logic, protocol-le, data processing, and reuse of existing scripts — yet most scanners force e into YAML-only abstractions.

CERT-X-GEN is a different kind of scanner. It is a polyglot security execution engine that treats detection as code, not configuration. You write detection logic in the language that fits the problem — CERT-X-GEN handles orchestration, execution, and output.

What this means in practice:

Highlights

> A note on execution pri. Templates execute as ordinary child processes with the
> in user's pri and full network and filesystem access. Review templates before
> running them. There is no execution sandbox or resource limiting anywhere in cxg — no flag,
> no configuration key, no default. Run cxg inside a container or VM, and as a non-pri
> user, if you need isolation. See the
> dependency en guide, whose cxg sandbox
> command manages per-language *dependency* en (not isolation).

---

Two Surfaces

CERT-X-GEN ships two distinct workflows:

| Surface | Command | What it does |
|---------|---------|--------------|
| Template scanning | cxg scan | Runs polyglot detection templates against network/host targets (single host, file, CIDR, URL). This is the classic scanner. |
| AI-dri pentest | cxg pentest | Ranks guardlink source-code hypotheses against an operator goal, has a local AI CLI write Ja probe templates that read the target's source, and executes them in parallel authenticated Chromium contexts against a running web app or Electron desktop app. |

The full command set:

| Command | Purpose |
|---------|---------|
| cxg scan | Run a polyglot template security scan |
| cxg build | Build a compiled target with sanitizer instrumentation, so a scan can earn its |
| cxg pentest | AI-dri pentest pipeline (web or Electron) |
| cxg template | Manage templates (list, search, info, , update) |
| cxg search | Search templates (full-text, regex, filters) |
| cxg ai | AI-powered template generation |
| cxg mcp | Run as an MCP (Model Context Protocol) server for AI agents |
| cxg sandbox | Manage per-language dependency en |
| cxg config | Generate / / show configuration |
| cxg update | Update cxg to the latest released build |
| cxg server | REST API server — not implemented (returns an error) |
| cxg | Display information |

Run cxg <command> --help for the full reference on any of them.

---

Why This Matters

<table>
<tr>
<td width="50%">

The Problem

YAML DSLs hit a wall when you need:

</td>
<td width="50%">

The Solution

CERT-X-GEN runs templates written in:

</td>
</tr>
</table>

Real-World Examples

| Scenario | Template | Why It Can't Be YAML |
|----------|----------|---------------------|
| SMTP relay testing | smtp-open-relay.py | Multi-step con: EHLO → MAIL FROM → RCPT TO with branching |
| PostgreSQL auth check | postgresql-default-credentials.go | PostgreSQL wire protocol + MD5 challenge-response |
| SNMP community strings | snmp-default-community.sh | Native snmpwalk integration |
| detection | .c | RFB binary protocol handshake |

---

Installation

Cargo (crates.io) — recommended

The quickest cross-platform install if you have a Rust toolchain:

This builds and installs the cxg binary into ~/.cargo/bin. Make sure that directory is on your PATH. To upgrade later, run cargo install cert-x-gen --force (or use the built-in cxg update).

Homebrew (macOS/Linux)

Quick Install Script

Docker

From Source

From Git (latest main or a specific tag)

Build straight from the repository — useful for unreleased changes or pinning to a tag:

Download Binary

Download pre-built binaries from GitHub Releases:

Installation

---

Quick Start

Scanning (cxg scan)

Whitebox Pentest (cxg pentest)

The pentest pipeline drives an authenticated browser (or Electron app), so it needs a captured
session and a guardlink source-code analysis (whitebox/findings.sarif) in the codebase.

For CI, capture the session once, export it as a Playwright storage_state, then replay it
without a browser:

--ci (or CXG_CI=1) makes a dead/expired session a hard failure (exit code 5) at
pre-flight, so a pipeline ne probes unauthenticated. A profile bundle can also be
materialised from the base64 env var CXG_AUTH_STATE_<NAME> and pointed at with --auth-dir.
See the pentest docs for the full pipeline, Electron target support, OAST
modes, and the report.json schema.

Template Operations

Output Formats

cxg scan writes reports with --output-format (comma-separated for several at once) and
-o/--output for the destination basename. The output extension is derived from the format —
any extension you put on --output is replaced, so --output report.txt --output-format json
writes report.json.

Supported formats: json, cs, html, markdown.

---

Templates

Runtime templates are not shipped in this repository. They are distributed separately in the
template library repo:

github.com/Bugb-Technologies/cert-x-gen-templates

Fetch them with cxg template update, which clones the library into ~/.cert-x-gen/templates/.
From there the scanner discovers them automatically. (Templates are not auto-downloaded by a bare
cxg scan — run cxg template update, or pass --ut / --auto-update-templates on a scan.)

Templates co languages — Python, Go, C, Rust, Shell, YAML and more — with the exact
in maintained in the template repository.

Writing Templates

All templates follow a simple contract:
1. Read CERT_X_GEN_TARGET_HOST and CERT_X_GEN_TARGET_PORT from en
2. Perform detection logic
3. Output JSON with findings array

A template can also drive a local binary rather than a network host
(cxg scan --scope cli:///path/to/binary), take its probe input from cxg
(--arg, --stdin-file, --input, --target-env), and declare its own
so a refutation is recorded rather than inferred. Passing
--require-instrumentation makes cxg skip the templates a build could not
ha the defect for, instead of reporting a refutation it did not earn;
templates whose oracles work on any build (exit, signal, timeout,
exception) still run. Build an instrumented target with
cxg build --instrument, or declare one you built yourself
with cxg scan --instrumented-manifest <path>. The full contract is in
docs/ENGINE_ARCHITECTURE.md.
Note that CERT_X_GEN_TARGET_PORT is meaningless when CERT_X_GEN_TARGET_KIND
is cli — ignore it there.

Python example:

---

Design Principles

---

Features

Execution Engine

CLI

Integration

AI pro (pentest)

cxg pentest generates probes with a local AI CLI or an HTTP API. --ai-provider accepts:
auto | bridge | claude | codex | gemini | anthropic | openai. The bridge provider posts
each prompt to $BUGB_BRIDGE_URL (with Authorization: Bearer $BUGB_BRIDGE_TOKEN when set) and
reads the completion back — an editor/CI integration point rather than a local CLI. When
--ai-provider auto is used, the bridge is preferred whenever $BUGB_BRIDGE_URL is set.

Findings in report.json carry the identity of the exposure they tested — the annotation's
{file, line}, its asset and threat, and guardlink's threat_id — so
guardlink hypothesis confirm --from-scan report.json joins each confirmation straight back to
the claim it settles. A probe with no originating guardlink exposure carries none and is left
unmatched (an AI-synthesised template, or one generated for a hypothesis cxg minted itself from
Electron IPC or --disco); a mutated retry inherits its parent's. See
pentest architecture § "The exposure identity a finding carries"
for the join, its measured bounds, and the identity_withdrawn record.

---

Documentation

Full documentation is at <. It is generated against a released
binary, and every command it shows was run and its real output pasted in.

| | |
|---|---|
| Install cxg | Three install methods, and where templates come from |
| Run your first scan | A real finding on a target you control |
| Scan a target | Scope, template selection, output formats, exit codes |
| Write your first template | A detection that follows one response to choose its next request |
| Run a pentest | The whitebox pipeline, auth, OAST, Electron, CI |
| CLI reference | Every command, flag, and default, generated from --help |
| Why polyglot templates | When a check should be code, and what that costs |
| Template trust model | What running a template actually grants it |

In this repository

Contributor documentation stays here, because it describes the code rather than
the product.

| Document | Description |
|----------|-------------|
| Architecture | System design and internals |
| Engine architecture | How an engine is structured and added |
| Pentest architecture | Pipeline, substrate, and the runtime intelligence layer |
| Probe templates | The Ja probe format and its primitives |
| Contributing | How to contribute code and templates |

pentest/docs/TEMPLATES.md and pentest/docs/ARCHITECTURE.md are referenced by
cxg pentest run --help and by the pipeline's own code, so they live with the
code they describe.

---

Contributing

We welcome contributions. See CONTRIBUTING.md for guidelines.

Priority areas:

---

License

CERT-X-GEN is licensed under Apache License 2.0.

Security

Report to . See SECURITY.md.

---

<p align="center">
<b>Built with Rust</b> · <a href=" · <a href="
</p>

项目信息

开发语言：Python

Star 数：21

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Polyglot execution engine and CLI for vulnerability detection using real code展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。