codex-redteam-mode - 针对于红队攻击思维做出的red team模式(破限项目，封号概不负责）##可自行适配其他Agent。

项目说明

Codex Red-Team Opt-In Mode

中文

Current : v2.1.0

> Normal mode remains the default. The durable red-team operation runtime starts only after explicit acti, while the system-layer base instructions and acti profile remain loaded in every mode.

An opt-in, durable red-team runtime for Codex App and Codex CLI. It compiles each objective into a criteria-bearing GoalContract, executes typed WorkflowSpec graphs through live MCP tools, preser e, and reaches successful terminal state only after TerminalJudge pro criterion.

Usage Instructions

Before using this project, you should read the README file completely to prevent any issues during use.
If you're a beginner, please read the GUIDE file completely to avoid any unnecessary trouble while using it.

Models and System Prompts

The installer composes the user's prior instructions, instruction.ctf.md, and the matching Jailbreak.gpt-5.x.md through the system-layer model_instructions_file. Codex App tasks select the current profile from Hook model metadata; the CLI wrapper builds a single-profile system file before process startup and pins the model family.

Asking Questions Wisely

1. If you ha about the content in the README, you should submit an ISSUE, including the corresponding content from the README to seek help, or ask in the QQ group in the same way.

Do:

Don't:

2. If you ha or ideas for maintaining the project, you can submit an ISSUE, submit a Pull Request, or suggest in the QQ group.

Do:

Don't:

QQ Group

Operating Boundary

The runtime treats task targets as operation assets whose scope was resol the model, or as local sandbox fixtures. It does not repeat scope-document requests. Irre file replacement and external publication still retain explicit engineering confirmation to prevent accidental side effects.

Why This Project

Moti

Codex can use many security tools, but long-running workflows are to session interruption, tool , manual result relay, and false completion based on a tool success flag. This project unifies objectives, actions, e, recovery, and terminal judgment in one durable execution path:

2.1.0 uses the unified generic-adaptive runtime without the former phase -> router -> pack -> leaf runtime, regex domain routers, Markdown exit gates, or a second Automation state machine. Domain names act only as asset and technique metadata rather than control-plane branches.

Core Features

Installation

Install Commands

From the repository root, install dependencies and deploy to the current user Codex Home:

The installer detects the model from the en, target config, or existing manifest; --model is normally unnecessary.

Project-local installation:

Custom Skill and durable operation roots:

Options

| Option | Description |
|---|---|
| --codex-home PATH | Install into a specific Codex Home/profile; its AGENTS.md provides global guidance |
| --project-home PATH | Install under PATH/.codex and PATH/.agents, and manage the project-root AGENTS.md; mutually exclusive with --codex-home |
| --agents-home PATH | Select the Skill destination; custom roots should also use --enable-custom-skill-dirs |
| --enable-custom-skill-dirs | Prefer the manifest-recorded custom Skill directory at runtime |
| --log-root PATH | Select the durable root for SQLite state, events, and e artifacts |
| --model MODEL | Optional: o automatic detection and explicitly select the installation-time system profile |
| --enable-rewrite-proxy | Enable the shared App/CLI loopback Rewrite Proxy and preserve the previous model_provider for uninstall rollback |
| --dry-run | Preview installation, upgrade, or uninstall actions without writing files |
| --uninstall | Remo files, Hooks, config , and AGENTS.md blocks |

Runtime State Locations

The default operation root is:

Hook session state is stored under $CODEX_HOME/redteam-mode/state/sessions. Use --log-root OPERATION_PATH to relocate operation data. Status responses inline no more than 64 KiB of e; larger payloads are fetched with redteam_e, and each e payload is capped at 4 MiB.

Upgrade and uninstall preser session, memory, and operation data for recovery, auditing, or manual cleanup.

What the Installer Does

Quick Start

1. Complete installation and restart Codex App or Codex CLI.
2. Start a new task and submit redteam on, redteam light, or redteam full as a standalone prompt.
3. Submit the complete objective. The Hook compiles it into a GoalContract, with independent operations for single or multiple targets.
4. redteam_run starts or resumes execution and uses ToolBroker to invoke a MCP tools.
5. Host-only tools receive a next_action_spec, gate, exit condition, and output contract, then automatically submit their obser to the Runtime.
6. TerminalJudge emits the final result after proving every target criterion, e lineage, and cleanup state.
7. Submit redteam off or disable red team mode to return to normal mode.

Prompt Rewrite

Default context mode leaves the Provider unchanged. Only after explicit red-team acti, the Hook resolves the requested action before the technical object, keeps ordinary de out of the red-team dispatcher, inherits short follow-up context, and emits Clause hashes, taxonomy, risk level, e requirements, and a reproducible plan. It does not force remediation output unless the user requested it.

Enable real pre-request rewriting with:

The request path is:

provider = "inherit" and model = "inherit" reuse the original Provider and current Codex model. For a separate relay, add a model_pro entry and set [redteam.prompt_rewrite] provider, model, and api_key_env. Normal-mode requests pass through unchanged. If the relay drops a URL, IP, CVE, path, CLI flag, Clause, high-risk marker, context bundle, or semantic-fidelity flag, the Proxy uses the deterministic local rewrite. Uninstall restores the previous model_provider.

The optional CLI wrapper pins one model-family profile for the current process:

Changing model families requires a new App task or wrapper process so that model_instructions_file is reloaded.

Modes

| Mode | Default | Typical Use |
|---|---:|---|
| normal | Yes | Ordinary coding, documentation, and research; no red-team operation or operation doctrine is started |
| redteam-light | No | Explicit durable Goal/Workflow execution through /redteam on or /redteam light |
| redteam-full | No | Explicit full-mode marker; in v2.1.0 it shares the same Runtime, e rules, and TerminalJudge gates as light mode |

Installer and test co includes:

GitHub Actions runs the full suite on Windows, Ubuntu, and macOS with Python 3.11.

Contributions & Acknowledgements

Known Limitations

Contributions and Acknowledgements

Indi Contributors

Reference Projects

The earlier routing/Skill design and current runtime research drew from:

Star History

<a href="
<picture>
<source media="(prefers-color-scheme: dark)" srcset=" />
<source media="(prefers-color-scheme: light)" srcset=" />
<img alt="Star History Chart" src=" />
</picture>
</a>

Contributing

See CONTRIBUTING.md for the contribution workflow, coding con, and submission requirements.

License

MIT

项目信息

开发语言：Python

Star 数：1103

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕针对于红队攻击思维做出的red team模式(破限项目，封号概不负责）##可自行适配其他Agent。项目问题请提issue展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。