cryptex-oss - Open-source LLM red-teaming technique toolkit (162

项目说明

<!--
Hero image lives at docs/Tool-bar.png (and docs/Tool-bar-dark.png for
the light-mode swap). Screenshot triplet placeholders below render
gracefully when the asset files do not exist; GitHub silently hides
broken <img> inside centered <p>. Drop these to replace the placeholders:
docs/img/screenshot-transforms.png first feature shot
docs/img/screenshot-promptcraft.png second feature shot
docs/img/screenshot-harmbench.png third feature shot
-->
<p align="center">
<img src="docs/img/logo.png" alt="Cryptex OSS" width="7%">
<h1 align="center">Cryptex OSS</h1>
</p>
<p align="center">
<strong>Open-source LLM red-team lab.</strong><br>
159 transforms, 26 tool surfaces, one Campaign front door, BYOK gateway. Runs in your browser.
</p>

<p align="center">
<a href="LICENSE"><img src=" alt="MIT"></a>
<a href=" src=" alt="latest release"></a>
<a href="CHANGELOG.md"><img src=" alt="Changelog"></a>
<a href=" src=" alt="GHCR image"></a>
<a href=" src=" alt="Docker build"></a>
</p>

<p align="center">
<img src=" alt="Svelte 5">
<img src=" alt="S 2">
<img src=" alt="TypeScript 5">
<img src=" alt="Tailwind 4">
<img src=" alt="shadcn-svelte">
<img src=" alt="Vite 7">
<img src=" alt=" 3">
<img src=" alt="nginx alpine">
<img src=" alt="Docker multi-arch">
</p>

<p align="center">
<a href=" Online→</strong></a>
&nbsp;·&nbsp;
<a href="#self-host-in-30-seconds"><strong>Self-host in 30 seconds</strong></a>
&nbsp;·&nbsp;
<a href="docs/USAGE.md"><strong>Offensi</strong></a>
&nbsp;·&nbsp;
<a href="CHANGELOG.md"><strong>Changelog</strong></a>
</p>

---

<p>
<img src="docs/img/screenshot-promptcraft2.png" alt="PromptCraft multi-step viz" width="100%">
</p>
<p align="center">
<img src="docs/img/Promp-Craft-TAP.png" alt="PromptCraft multi-step viz" width="100%">
</p>
<p align="center">
_{Left: 159 transformers, encode + decode, options per transform. Middle: PromptCraft multi-step viz (TAP tree shown). Right: HarmBench heuristic scoring with per-category breakdown.}
</p>

---

What it is

Cryptex bundles 159 text transformers (encodings, classical ciphers, Unicode tricks, steganography, ancient scripts) with 26 specialized tool surfaces. The Campaign front door is the one-shot way in: type a goal, pick a target once, and Cryptex fans your goal across many attack strategies, judges each with an LLM judge, and shows a graded ASR report you can export. Behind it sit ten technique workbenches (Transform, Decode, Emoji stego, Gibberish, Tokenizer, Tokenade, Bijection, Fuzzer, PromptCraft, Anti-Classifier) and fifteen red-team labs co the 2024 to 2026 jailbreak literature (HarmBench, StrongREJECT, JailbreakBench, indirect injection, glitch tokens, ad suffixes, defense fingerprinting, watermark forensics). It is the lab bench for ad and encoding research.

E runs in your browser. No backend, no database, no telemetry. AI calls go from your browser direct to whiche you choose, with your BYOK key staying in localStorage. Open source under MIT. Same canonical 159 transformers feed both the S app and the Python CLI, so adding one anywhere makes it a e.

---

Self-host in 30 seconds

Open < Done.

The image is multi-arch (linux/amd64 plus linux/arm64), so it pulls native on Intel and AMD Linux servers, Apple Silicon Macs, and Raspberry Pi.

<details>
<summary><strong>Docker Compose</strong></summary>

docker compose up -d and you are done. The repo's own docker-compose.yml is Dokploy-tuned with Traefik labels for HTTPS plus Let's Encrypt. See DEPLOY.md for that path.
</details>

<details>
<summary><strong>Build from source</strong></summary>

Prereqs: Node 20.19+ or 22.12+ (not plain “Node 20”), npm. Install deps in app/, then npm run dev.
Optional: uv for the Python CLI.
</details>

<details>
<summary><strong>Production (Dokploy + Let's Encrypt)</strong></summary>

The committed docker-compose.yml is Dokploy-first. It joins the external dokploy-network and ships full Traefik routing labels for HTTPS plus Let's Encrypt cert issuance. Fi setup against Hostinger, Contabo, or any VPS.

Step-by-step in DEPLOY.md. Covers Dokploy install, DNS, env vars, cert troubleshooting, and a docker run plain-Docker .
</details>

Need a subpath? Build with BASE_PATH=/cryptex to serve at /cryptex/... instead of /.

---

Use it on your phone

The app is responsive. Just visit the URL on mobile and add to home screen for one-tap launch. The full feature set works on iOS Safari and Chrome Android, including the BYOK gateway and all 26 tool surfaces.

For private personal hosting reachable from your phone anywhere: run the Docker image on a Raspberry Pi or any home box, then expose it through Tailscale Funnel or Cloudflare Tunnel. Your phone reaches your self-hosted instance o with zero port-forwarding and no public DNS exposure.

---

Host it for free

Fi, all free for a Cryptex-scale static site:

| Platform | What to set | Free tier covers this |
|---|---|---|
| GitHub Pages | Fork the repo, Settings -> Pages -> Source: GitHub Actions | Yes, no limits for static |
| Cloudflare Pages | Connect repo. Build: cd app && npm ci && npm run build. Output: app/build | Yes, unmetered bandwidth |
| | Same build settings as Cloudflare Pages | Yes for personal |
| Netlify | Same build settings | Yes for personal |
| Render | Static site, same settings | Yes |
| Raspberry Pi at home | docker run the linux/arm64 image. Reach from your phone Funnel. | Zero monthly cost beyond electricity |

Cryptex ne home. Your hosted instance is your own.

---

Cryptex Production

Cryptex Production at < is a separate sibling product, not a hosted copy of this repository. Different codebase, different feature surface, different release cadence. It is included here as a pointer for users whose workflow needs more than the OSS toolkit covers.

What Production has that the OSS does not:

If your work needs the chat surface or the li mutator pipeline, that is the . Free, no signup, your BYOK key stays in your browser. The OSS in this repo is intentionally scoped to the tools layer; it does not and will not ship the chat playground or the attack-chain composer.

---

Recipes

docs/USAGE.md is the offensi. Twel recipes co target fingerprinting, three-layer kneel stacks (bijection + PAP + GCG), many-shot capstones, Crescendo, OCR stego injection, indirect-injection summary, tool-call hijack, glitch-token derailment, TAP for SOTA targets, multi-layer composites, watermark forensics, and cross-model bake-offs. Includes the Defense Fingerprinter e table so you can recognize a target's defense family by eye, plus a cross-tool composability map showing which tool's output naturally feeds which.

---

Tools

Technique workbenches (7)

| Route | What it does |
|---|---|
| Transform | 159 encoders and decoders. Encode plus decode. Options per transform. Chainable. |
| Decode | Uni decoder. Paste anything, every detector ranks by confidence plus priority. |
| Emoji | Steganography selectors, tag block, and combining marks. |
| Tokenade | Parameterized token-bomb payload builder (depth x breadth x repeats). |
| Fuzzer | 11 mutation strategies. Zero-width, Unicode noise, casing, Zalgo, homoglyph, grammar, synonym, prompt-injection, structured-noise. |
| PromptCraft | All 36 mutators plus the 4 multi-step orchestrators (TAP, PAIR, Crescendo, Many-Shot) with home-rolled S. v2.2: winning chains auto-promote to the Vault tagged with target model family. |
| Anti-Classifier | N- paraphrase fan-out with 5-feature heuristic e scoring. No external API calls. |

/gibberish, /tokenizer, /bijection were deprecated in v2.2 (low-impact or subsumed by siblings). Routes still resolve for deep-links.

Red-team labs (19)

Ad · Glitch Tokens · OCR Injection · Markdown Exfil · Probe Lab · Cross-Model Diff · Replayer · Tool Result Lab · Indirect Injection · HarmBench · StrongREJECT · JBB · Fingerprinter · Watermark · PDF Injection · Reasoning (v2.3, H-CoT + Mousetrap) · Stacked Cipher (v2.3, SEAL family) · Response (v2.3, AAAI 2026 context-priming) · Abliteration (v2.3, uncensored-model detection + HF vault)

Every benchmark lab carries a yellow "Heuristic scoring, not paper-accurate" banner. Scoring uses regex plus LLM-judge approximations of the published rubrics, not the original trained classifiers. Use it for craft signal and iteration, not as a .

Vault drawers (339 seeds)

Every tool with a curated payload set ships a collapsible Vault drawer at the bottom. 96 glitch tokens, 38 ad suffixes, 40 indirect-injection patterns, 17 tool-result fixtures, 20 PromptCraft chains, 50 fuzzer seeds, 15 emoji carriers, 6 reasoning-attack scaffolds, 8 SEAL stacks, 6 Response Attack primings, 10 HuggingFace abliterated-model identifiers, plus per-benchmark customs. Add your own through the drawer.

License posture is hard-locked: MIT, CC0, CC-BY-4.0, or Apache 2.0. No GPL, AGPL, CC-BY-SA, or CC-BY-NC. Per-source pro in app/src/lib/vault/LICENSES.md.

Cloud Sync (v2.2, opt-in)

Settings → Cloud Sync. Bring your own Supabase project URL and anon key. History runs and Vault custom items sync to two tables (synced_runs, synced_) in YOUR Supabase project. BYOK provider keys never sync. Setup guide with copy-pasteable SQL in docs/SUPABASE.md.

Self-e recon skill (v2.3, out-of-repo)

The cryptex-recon Claude Code skill at ~/.claude/skills/cryptex-recon/ runs GitHub + arXi recon for new jailbreak techniques + abliterated model releases, drafts proposals, and self-updates its own LESSONS.md after each run. Trigger with /cryptex-recon or phrases like "find new jailbreak tools". Seeded with the 12 already-promoted frameworks so it doesn't re-suggest them.

---

AI pro (BYOK)

Cryptex never sees your key. Paste it in Settings. It goes to localStorage only. Every AI call is direct browser to provider.

Direct OpenAI and Google Gemini are not supported from the browser (no CORS). Route those models through OpenRouter.

In dev mode (npm run dev), Vite mounts a /api/_proxy/<pro>/... ser passthrough so /v1/models works for every provider regardless of CORS. Production static deploys go direct; per-preset defaultModels lists in app/src/lib/ai/presets.ts cover any /models endpoints that block CORS.

---

Architecture

Key design notes:

---

Python CLI

The Python CLI reuses the same 159 transformers as the web app via a Node bridge.

---

Contributing

Add a transformer

1. Drop a file at src/transformers/<category>/<name>.js.
2. Export default new BaseTransformer({...}) from src/transformers/BaseTransformer.js.
3. Pick a priority (1 to 310) using the guide at the bottom of BaseTransformer.js.
4. Run npm run build from the repo root.

Auto-discovered. Web app and CLI pick it up via the S registry and the Node loader respectively.

Add a tool surface

1. Create the Svelte component in app/src/lib/components/tools/<tool>/ (or app/src/lib/components/redteam/<tool>/).
2. Add the route at app/src/routes/<tool>/+page.svelte, wrapping the content in <ToolShell toolId="…" title="…">.
3. Register the tab in app/src/lib/components/shell/TabRail.svelte.
4. Optional: add a Vault drawer via <> if the tool has a curated payload set. See CLAUDE.md for the v2.0 con.

Pre-PR checklist

---

License

MIT. See LICENSE.

Cryptex OSS bundles small red-team corpora (glitch tokens, ad suffixes, indirect-injection patterns, tool-result fixtures, emoji carriers, fuzzer seeds, PromptCraft chains, plus a tiny WordNet subset) sourced from openly-licensed papers, community write-ups, and public-domain Unicode references. Every bundled item is MIT, CC-BY-4.0, or CC0. Per-source attribution lives in app/src/lib/vault/LICENSES.md. No GPL, AGPL, CC-BY-SA, or CC-BY-NC material is bundled.

---
<p align="center">
<picture>
<source media="(prefers-color-scheme: light)" srcset="docs/Tool-bar-dark.png">
<img src="docs/Tool-bar.png" alt="Cryptex OSS" width="100%">
</picture>
</p>
<p align="left">
<strong>Source:</strong> <a href="
<br>
<strong>Recipes:</strong> <a href="docs/USAGE.md">docs/USAGE.md</a>
<br>
<strong>Sibling product:</strong> <a href=" (chat playground, attack-chain composer; separate codebase)
</p>

> P.S. — A tip of the hat to elder-plinius/P4RS3LT0NGV3: every model in this toolkit was already jailbroken there before our npm install finished, so consider Cryptex OSS the release engineering on his hobby.

项目信息

开发语言：TypeScript

Star 数：336

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source LLM red-teaming technique toolkit (162 transforms, 36 mutators, 25 tool surfaces). MIT.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。