autarch/data/codex/autarch_codex.md

AUTARCH Codex

Codebase Knowledge Reference for AI Agents

Generated: 2026-03-20 05:05:31

This document is auto-generated by scripts/build_codex.py and provides structured knowledge about the AUTARCH codebase for LLM agents to use when creating modules, routes, templates, and features.

---

1. Module System

AUTARCH modules are Python files in the modules/ directory. Each module:

• Has a run() function as the entry point
• Declares metadata: DESCRIPTION, AUTHOR, VERSION, CATEGORY
• Is auto-discovered by core/menu.py at startup
• Can be run via CLI (python autarch.py -m <name>) or from the web UI

Required Module Attributes

DESCRIPTION = "Short description of what the module does"
AUTHOR = "Your Name"
VERSION = "1.0"
CATEGORY = "defense"  # One of: defense, offense, counter, analyze, osint, simulate, core, hardware

Module Template

"""
Module description here.
"""

DESCRIPTION = "Short description"
AUTHOR = "darkHal"
VERSION = "1.0"
CATEGORY = "defense"

import sys
from pathlib import Path
sys.path.insert(0, str(Path(__file__).parent.parent))
from core.banner import Colors, clear_screen, display_banner


def run():
    """Main entry point — REQUIRED."""
    clear_screen()
    display_banner()
    print(f"{Colors.BOLD}Module Name{Colors.RESET}")
    print(f"{Colors.DIM}{'─' * 50}{Colors.RESET}\n")

    # Module logic here


if __name__ == "__main__":
    run()

Categories and Module Counts

• defense (12): android_protect, container_sec, defender, defender_monitor, defender_windows, email_sec, incident_resp, log_correlator, mysystem, threat_intel ... and 2 more
• offense (29): ad_audit, android_advanced, android_boot, android_payload, android_recon, android_root, android_screen, android_sms, api_fuzzer, c2_framework ... and 19 more
• counter (3): anti_forensics, counter, steganography
• analyze (12): analyze, ble_scanner, forensics, llm_trainer, malware_sandbox, net_mapper, password_toolkit, report_engine, reverse_eng, rfid_tools ... and 2 more
• osint (7): adultscan, dossier, geoip, ipcapture, recon, snoop_decoder, yandex_osint
• simulate (1): simulate
• core (4): agent, agent_hal, chat, setup
• hardware (4): android_apps, hardware_local, hardware_remote, iphone_local

Total modules: 73

---

2. Core API Reference

The core/ directory contains the framework backbone. Key modules:

core/agent.py

• class AgentState — Agent execution states.
• class AgentStep — Record of a single agent step.
• class AgentResult — Result of an agent task execution.
• get_steps_summary() — Get a formatted summary of all steps taken.

core/android_exploit.py

• class AndroidExploitManager — All Android exploitation logic.
  • Methods: list_packages, pull_apk, pull_app_data, extract_shared_prefs, full_device_dump, get_accounts, get_wifi_passwords, extract_call_logs
• get_exploit_manager() —
• list_packages(serial, include_system) — List installed packages. Returns [{package, path, is_system}].
• pull_apk(serial, package) — Pull APK for a package.
• pull_app_data(serial, package) — Pull app data (databases, shared_prefs, files). Tries run-as then root.
• extract_shared_prefs(serial, package) — Extract shared_prefs XML files for a package.
• full_device_dump(serial) — Full device reconnaissance dump.
• get_accounts(serial) — Get accounts registered on device.
• get_wifi_passwords(serial) — Extract saved WiFi passwords. Requires ROOT.

core/android_protect.py

• class AndroidProtectManager — Anti-stalkerware / anti-spyware shield for Android devices.
  • Methods: update_signatures, get_signature_stats, check_shizuku, install_shizuku, start_shizuku, stop_shizuku, shizuku_status, check_shield_app
• get_android_protect_manager() —
• update_signatures(url) — Download latest signatures from GitHub.
• get_signature_stats() — Count known threats by category.
• check_shizuku(serial) — Check Shizuku installation and status.
• install_shizuku(serial, apk_path) — Install Shizuku APK via ADB.
• start_shizuku(serial) — Start Shizuku service via ADB.
• stop_shizuku(serial) — Stop Shizuku server process.
• shizuku_status(serial) — Full Shizuku status check.

core/autonomy.py

• class ActivityEntry — Single entry in the autonomy activity log.
  • Methods: to_dict
• class AutonomyDaemon — Background daemon for autonomous threat response.
  • Methods: status, start, stop, pause, resume, get_activity, get_activity_count, subscribe
• get_autonomy_daemon() — Get the global AutonomyDaemon instance.
• reset_autonomy_daemon() — Stop and reset the global daemon.
• to_dict() —
• status() — Current daemon status.
• start() — Start the autonomy daemon background thread.
• stop() — Stop the daemon and wait for thread exit.
• pause() — Pause rule evaluation (monitoring continues).
• resume() — Resume rule evaluation.

core/banner.py

• class Colors —
• display_banner() — Print the AUTARCH banner to the console.
• clear_screen() — Clear the terminal screen.

core/config.py

• class Config — Configuration manager for AUTARCH settings.
  • Methods: save, get, get_int, get_float, get_bool, set, is_first_run, mark_setup_complete
• get_config() — Get the global configuration instance.
• save() — Save the current configuration to file.
• get(section, key, fallback) — Get a configuration value.
• get_int(section, key, fallback) — Get a configuration value as integer.
• get_float(section, key, fallback) — Get a configuration value as float.
• get_bool(section, key, fallback) — Get a configuration value as boolean.
• set(section, key, value) — Set a configuration value.
• is_first_run() — Check if this is the first run of AUTARCH.

core/cve.py

• class CVEDatabase — SQLite-based CVE Database with NVD API synchronization.
  • Methods: get_system_info, get_db_stats, sync_database, sync_recent, search_cves, get_cve, get_system_cves, get_software_cves
• get_cve_db() — Get the global CVE database instance.
• get_system_info() — Get detected system information.
• get_db_stats() — Get database statistics.
• sync_database(days_back, full_sync, progress_callback, verbose) — Synchronize database with NVD.
• sync_recent(days, verbose) — Quick sync of recent CVEs only.
• search_cves(keyword, cpe_pattern, severity, min_score) — Search CVEs in local database.
• get_cve(cve_id) — Get detailed information about a specific CVE.
• get_system_cves(severity_filter, max_results) — Get CVEs relevant to the detected system.

core/discovery.py

• class DiscoveryManager — Manages network discovery advertising for AUTARCH.
  • Methods: get_status, start_mdns, stop_mdns, start_bluetooth, stop_bluetooth, start_all, stop_all, shutdown
• get_discovery_manager(config) — Get or create the DiscoveryManager singleton.
• get_status() — Get current discovery status for all methods.
• start_mdns() — Start mDNS service advertisement.
• stop_mdns() — Stop mDNS service advertisement.
• start_bluetooth() — Start Bluetooth service advertisement.
• stop_bluetooth() — Stop Bluetooth advertisement.
• start_all() — Start all enabled discovery methods.
• stop_all() — Stop all discovery methods.

core/dns_service.py

• class DNSServiceManager — Manage the autarch-dns Go binary (start/stop/API calls).
  • Methods: api_base, api_token, find_binary, is_running, start, stop, status, list_zones
• get_dns_service() —
• api_base() —
• api_token() —
• find_binary() — Find the autarch-dns binary.
• is_running() — Check if the DNS service is running.
• start() — Start the DNS service.
• stop() — Stop the DNS service.
• status() — Get service status.

core/hardware.py

• class HardwareManager — Manages ADB, Fastboot, and Serial/ESP32 devices.
  • Methods: get_status, adb_devices, adb_device_info, adb_shell, adb_shell_raw, adb_reboot, adb_install, adb_sideload
• get_hardware_manager() —
• get_status() — Get availability status of all backends.
• adb_devices() — List connected ADB devices.
• adb_device_info(serial) — Get detailed info about an ADB device.
• adb_shell(serial, command) — Run a shell command on an ADB device.
• adb_shell_raw(serial, command, timeout) — Run shell command without safety filter. For exploit modules.
• adb_reboot(serial, mode) — Reboot an ADB device. mode: system, recovery, bootloader
• adb_install(serial, apk_path) — Install an APK on device.

core/iphone_exploit.py

• class IPhoneExploitManager — All iPhone USB exploitation logic using libimobiledevice.
  • Methods: get_status, list_devices, device_info, device_info_brief, device_info_domain, pair_device, unpair_device, validate_pair
• get_iphone_manager() —
• get_status() — Get availability of libimobiledevice tools.
• list_devices() — List connected iOS devices.
• device_info(udid) — Get full device information.
• device_info_brief(udid) — Get key device info (name, model, iOS version).
• device_info_domain(udid, domain) — Get device info for a specific domain.
• pair_device(udid) — Pair with device (requires user trust on device).
• unpair_device(udid) — Unpair from device.

core/llm.py

• class LLMError — Exception raised for LLM-related errors.
• class LLM — Wrapper class for llama-cpp-python integration.
  • Methods: is_loaded, model_name, load_model, unload_model, generate, chat, clear_history, get_history
• class TransformersLLM — HuggingFace Transformers backend for safetensors models.
  • Methods: is_loaded, model_name, load_model, unload_model, generate, chat, clear_history, get_history
• get_llm() — Get the global LLM instance, auto-loading the model if needed.
• detect_model_type(path) — Detect the type of model at the given path.
• reset_llm() — Reset the global LLM instance (used when switching backends).
• is_loaded() — Check if a model is currently loaded.
• model_name() — Get the name of the currently loaded model.
• load_model(model_path, verbose) — Load a GGUF model.
• unload_model() — Unload the current model and free resources.
• generate(prompt, max_tokens, temperature, top_p) — Generate text completion.

core/mcp_server.py

• get_autarch_tools() — Build the list of AUTARCH tools to expose via MCP.
• execute_tool(name, arguments) — Execute an AUTARCH tool and return the result as a string.
• create_mcp_server() — Create and return the FastMCP server instance.
• run_stdio() — Run the MCP server in stdio mode (for Claude Desktop / Claude Code).
• run_sse(host, port) — Run the MCP server in SSE (Server-Sent Events) mode for web clients.
• get_mcp_config_snippet() — Generate the JSON config snippet for Claude Desktop / Claude Code.
• get_server_status() — Check if the MCP server is running.
• start_sse_server(host, port) — Start the MCP SSE server in the background.

core/menu.py

• class ModuleInfo — Information about a loaded module.
• class MainMenu — Main menu handler for AUTARCH.
  • Methods: print_status, load_modules, get_modules_by_category, get_status_line, display_menu, display_category_menu, run_module, show_settings
• print_status(message, status) — Print a status message.
• load_modules() — Load all available modules from the modules directory.
• get_modules_by_category(category) — Get all modules in a specific category.
• get_status_line() — Get the status line showing model and MSF status.
• display_menu() — Display the main menu.
• display_category_menu(category) — Display the submenu for a category.
• run_module(module_name) — Run a specific module.
• show_settings() — Display settings menu.

core/model_router.py

• class ModelTier —
• class _TierConfigProxy — Proxies Config but overrides the backend section for a specific model tier.
  • Methods: get, get_int, get_float, get_bool, get_llama_settings, get_transformers_settings, get_claude_settings, get_huggingface_settings
• class ModelRouter — Manages up to 3 concurrent LLM instances (SLM, SAM, LAM).
  • Methods: status, load_tier, unload_tier, load_all, unload_all, get_instance, is_tier_loaded, classify
• get_model_router() — Get the global ModelRouter instance.
• reset_model_router() — Reset the global ModelRouter (unloads all models).
• get(section, key, fallback) —
• get_int(section, key, fallback) —
• get_float(section, key, fallback) —
• get_bool(section, key, fallback) —
• get_llama_settings() —
• get_transformers_settings() —

core/module_crypto.py

• encrypt_module(source_code, password, metadata) — Encrypt a Python module source string.
• decrypt_module(data, password) — Decrypt an .autarch blob.
• encrypt_file(src, dst, password, metadata) — Encrypt a .py source file to a .autarch file.
• decrypt_file(src, password) — Decrypt an .autarch file and return (source_code, metadata).
• load_and_exec(path, password, module_name) — Decrypt and execute an encrypted module.
• read_metadata(path) — Read only the metadata from an .autarch file without decrypting.
• encrypt(key, iv, plaintext) —
• decrypt(key, iv, ciphertext) —

core/msf.py

• class MSFError — Exception raised for Metasploit-related errors.
• class MSFModule — Information about a Metasploit module.
• class MetasploitRPC — Client for Metasploit RPC API.
  • Methods: is_connected, connect, disconnect, get_version, list_modules, search_modules, get_module_info, get_module_options
• check_msgpack() — Check if msgpack is available, raise error if not.
• get_msf_manager() — Get the global MSF manager instance.
• msf_startup_autoconnect(skip_if_disabled) — Perform MSF autoconnect during application startup.
• msf_quick_connect(username, password, host, port) — Quick non-interactive MSF server setup and connection.
• is_connected() — Check if connected to MSF RPC.
• connect(password) — Connect and authenticate to MSF RPC.
• disconnect() — Disconnect from MSF RPC.
• get_version() — Get Metasploit version info.

core/msf_interface.py

• class MSFStatus — Status of an MSF operation.
• class MSFResult — Result from an MSF module execution.
  • Methods: success, get_summary
• class MSFInterface — High-level interface for Metasploit operations.
  • Methods: manager, is_connected, last_error, ensure_connected, run_module, run_scanner, get_module_info, get_module_options
• get_msf_interface() — Get the global MSF interface instance.
• success() —
• get_summary() — Get a brief summary of the result.
• manager() — Get or create the MSF manager.
• is_connected() — Check if connected to MSF RPC.
• last_error() — Get the last error message.
• ensure_connected(password, auto_prompt) — Ensure we have a valid connection to MSF RPC.
• run_module(module_path, options, timeout, auto_reconnect) — Execute an MSF module and return parsed results.

core/msf_modules.py

• get_module_info(module_path) — Get information about a module.
• get_module_description(module_path) — Get just the description for a module.
• search_modules(query, max_results) — Search modules by keyword.
• get_modules_by_type(module_type) — Get all modules of a specific type.
• get_modules_by_tag(tag) — Get all modules with a specific tag.
• get_modules_by_platform(platform) — Get all modules for a specific platform.
• get_module_options(module_path) — Get the common options for a module.
• format_module_help(module_path) — Get formatted help text for a module.

core/msf_terms.py

• get_setting_info(name) — Get information about an MSF setting.
• get_setting_description(name) — Get just the description for a setting.
• get_setting_prompt(name, default, required) — Get a formatted input prompt for a setting.
• format_setting_help(name, include_examples, include_notes) — Get a formatted help text for a setting.
• get_settings_by_category(category) — Get all settings in a category.
• get_common_settings() — Get list of most commonly used settings.
• get_category_info(category) — Get information about a setting category.
• list_all_settings() — Get list of all known setting names.

core/paths.py

• is_frozen() — Return True if running from a PyInstaller bundle.
• get_app_dir() — Return the writable application root directory.
• get_bundle_dir() — Return the bundle directory (read-only assets: templates, static, default modules).
• get_core_dir() —
• get_modules_dir() — Return the bundled modules directory (read-only in frozen mode).
• get_user_modules_dir() — Return the user modules directory (writable, next to exe).
• get_data_dir() —
• get_config_path() — Return config path. Writable copy lives next to the exe;

core/pentest_pipeline.py

• class ParsingModule — Normalizes raw tool output into structured summaries.
  • Methods: parse
• class ReasoningModule — Maintains PTT and decides next actions.
  • Methods: reason
• class GenerationModule — Converts abstract tasks into concrete commands.
  • Methods: generate
• detect_source_type(output) — Auto-detect tool output type from content patterns.
• parse(raw_output, source_type, context) — Parse raw tool output into normalized summary.
• reason(parsed_output, context) — Three-step reasoning: update tree, validate, extract next todo.
• generate(task_description, target, context) — Generate executable commands for a task.
• process_output(raw_output, source_type) — Full pipeline: parse -> reason -> generate.
• get_initial_plan() — Generate initial pentest plan for the target.
• inject_information(info, source) — Inject external information and get updated recommendations.
• discuss(question) — Ad-hoc question that doesn't affect the tree.

core/pentest_session.py

• class PentestSessionState —
• class SessionEvent — A single event in the session timeline.
  • Methods: to_dict, from_dict
• class PentestSession — Manages a single penetration testing session.
  • Methods: start, pause, resume, complete, set_error, log_event, log_pipeline_result, add_finding
• to_dict() —
• from_dict(cls, data) —
• start() — Initialize a new session.
• pause() — Pause the session and save state.
• resume() — Resume a paused session.
• complete(summary) — Mark session as completed.
• set_error(error_msg) — Mark session as errored.
• log_event(event_type, data) — Log an event to the session timeline.

core/pentest_tree.py

• class NodeStatus —
• class PTTNodeType —
• class PTTNode — A single node in the Penetration Testing Tree.
  • Methods: to_dict, from_dict
• to_dict() —
• from_dict(cls, data) —
• add_node(label, node_type, parent_id, details) — Add a node to the tree. Returns the new node's ID.
• update_node(node_id, status, details, tool_output) — Update a node's properties. Returns True if found and updated.
• delete_node(node_id) — Delete a node and all its children recursively.
• get_node(node_id) —
• get_next_todo() — Get the highest priority TODO node.
• get_all_by_status(status) —

core/report_generator.py

• class ReportGenerator — Generate HTML reports for OSINT scan results.
  • Methods: generate_username_report, generate_geoip_report, generate_security_audit_report, generate_network_scan_report, generate_vulnerability_report, generate_pentest_report
• get_report_generator(output_dir) — Get a ReportGenerator instance.
• generate_username_report(username, results, total_checked, scan_time) — Generate HTML report for username scan.
• generate_geoip_report(results) — Generate HTML report for GEO IP lookups.
• generate_security_audit_report(system_info, issues, score) — Generate HTML report for security audit.
• generate_network_scan_report(target, hosts, scan_time) — Generate HTML report for network scan.
• generate_vulnerability_report(target, correlations, scan_time) — Generate HTML report for vulnerability scan.
• generate_pentest_report(target, network_data, vuln_data, exploit_data) — Generate combined pentest report.
• get_confidence_class(conf) —

core/revshell.py

• class RevShellSession — Active reverse shell session with an Archon device.
  • Methods: alive, device_name, android_version, uid, uptime, execute, execute_special, sysinfo
• class RevShellListener — TCP listener for incoming Archon reverse shell connections.
  • Methods: running, active_sessions, start, stop, get_session, list_sessions, remove_session, save_screenshot
• get_listener() — Get or create the global RevShellListener singleton.
• start_listener(host, port, token) — Start the global listener.
• stop_listener() — Stop the global listener.
• alive() —
• device_name() —
• android_version() —
• uid() —
• uptime() —

core/rsf.py

• class RSFError — Custom exception for RouterSploit operations.
• class RSFModuleInfo — Metadata for a RouterSploit module.
• class RSFManager — Manager for RouterSploit framework operations.
  • Methods: is_available, reset_cache, index_all_modules, get_module_count, get_modules_by_type, search_modules, load_module, get_module_options
• get_rsf_manager() — Get the global RSFManager singleton instance.
• is_available() — Check if RouterSploit is importable. Caches result.
• reset_cache() — Reset cached state (availability, module index).
• index_all_modules() — Discover all RSF modules. Returns list of dotted module paths.
• get_module_count() — Get total number of indexed modules.
• get_modules_by_type(module_type) — Filter modules by type (exploits, creds, scanners, payloads, encoders, generic).
• search_modules(query) — Search modules by substring match on path.
• load_module(path) — Load a RouterSploit module by path.

core/rsf_interface.py

• class RSFStatus — Status codes for RSF operations.
• class RSFResult — Result of an RSF module execution.
• class RSFInterface — High-level interface for RouterSploit operations.
  • Methods: ensure_available, is_available, module_count, list_modules, search_modules, get_module_info, get_module_options, check_module
• get_rsf_interface() — Get the global RSFInterface singleton instance.
• ensure_available() — Check that RSF is importable and available.
• is_available() — Check if RSF is available without raising.
• module_count() — Get total number of available modules.
• list_modules(module_type) — List available modules, optionally filtered by type.
• search_modules(query) — Search modules by keyword.
• get_module_info(path) — Get metadata for a module.
• get_module_options(path) — Get configurable options for a module.

core/rsf_modules.py

• get_module_info(module_path) — Get curated module info by path.
• get_module_description(module_path) — Get just the description for a module.
• search_modules(query) — Search curated modules by keyword.
• get_modules_by_type(module_type) — Get curated modules filtered by type.
• format_module_help(module_path) — Format detailed help text for a module.
• get_all_modules() — Get all curated modules.
• get_type_info(module_type) — Get info about a module type.

core/rsf_terms.py

• get_setting_info(name) — Get full setting information by name.
• get_setting_prompt(name, default, required) — Get a formatted input prompt for a setting.
• format_setting_help(name, include_examples, include_notes) — Get formatted help text for a setting.
• validate_setting_value(name, value) — Validate a setting value against its type.

core/rules.py

• class Rule — A single automation rule.
  • Methods: to_dict, from_dict
• class RulesEngine — Evaluates automation rules against a threat context.
  • Methods: save, add_rule, update_rule, delete_rule, get_rule, get_all_rules, evaluate
• to_dict() —
• from_dict(cls, d) —
• save() — Save rules to JSON file.
• add_rule(rule) —
• update_rule(rule_id, updates) —
• delete_rule(rule_id) —
• get_rule(rule_id) —
• get_all_rules() —

core/sites_db.py

• class SitesDatabase — Unified OSINT sites database with SQLite storage.
  • Methods: get_stats, get_sites, get_site, search_sites, get_categories, get_sites_for_scan, get_site_by_url, toggle_site
• get_sites_db() — Get the global sites database instance.
• get_stats() — Get database statistics.
• get_sites(category, include_nsfw, enabled_only, source) — Get sites from database.
• get_site(name) — Get a specific site by name.
• search_sites(query, include_nsfw, limit) — Search sites by name.
• get_categories() — Get all categories with site counts.
• get_sites_for_scan(categories, include_nsfw, max_sites, sort_alphabetically) — Get sites optimized for username scanning with detection patterns.
• get_site_by_url(url_template) — Get a site by its URL template.

core/tools.py

• class ToolParameter — Definition of a tool parameter.
• class Tool — Definition of an agent tool.
  • Methods: to_schema, execute
• class ToolRegistry — Registry for managing available tools.
  • Methods: register, unregister, get, list_tools, get_tools_schema, get_tools_prompt, execute
• get_tool_registry() — Get the global tool registry.
• to_schema() — Convert tool to JSON schema for LLM.
• execute() — Execute the tool with given parameters.
• register(tool) — Register a tool.
• unregister(name) — Unregister a tool by name.
• get(name) — Get a tool by name.
• list_tools() — List all registered tools.
• get_tools_schema() — Get JSON schema for all tools.

core/tray.py

• class TrayManager — Manages the system tray icon and Flask server lifecycle.
  • Methods: start_server, stop_server, restart_server, open_browser, quit, run
• create_icon_image(size) — Load tray icon from .ico file, falling back to programmatic generation.
• start_server() — Start the Flask web server in a background thread.
• stop_server() — Stop the Flask web server.
• restart_server() — Stop and restart the Flask web server.
• open_browser() — Open the dashboard in the default web browser.
• quit() — Stop server and exit the tray icon.

core/upnp.py

• class UPnPManager — UPnP port forwarding manager wrapping the upnpc CLI.
  • Methods: is_available, list_mappings, add_mapping, remove_mapping, get_external_ip, refresh_all, load_mappings_from_config, save_mappings_to_config
• get_upnp_manager(config) — Get the global UPnP manager instance.
• is_available() — Check if upnpc is installed.
• list_mappings() — List current UPnP port mappings.
• add_mapping(internal_ip, internal_port, external_port, protocol) — Add a UPnP port mapping.
• remove_mapping(external_port, protocol) — Remove a UPnP port mapping.
• get_external_ip() — Get the external IP via UPnP.
• refresh_all() — Re-add all configured port mappings. Returns list of results.
• load_mappings_from_config() — Load port mappings from config file.

core/wireguard.py

• class WireGuardManager — WireGuard VPN + Remote ADB manager.
  • Methods: is_available, get_server_status, start_interface, stop_interface, restart_interface, generate_keypair, generate_preshared_key, get_next_ip
• get_wireguard_manager(config) —
• is_available() — Check if wg binary exists.
• get_server_status() — Parse wg show for interface info.
• start_interface() — Start WireGuard interface with wg-quick.
• stop_interface() — Stop WireGuard interface with wg-quick.
• restart_interface() — Restart WireGuard interface.
• generate_keypair() — Generate WireGuard keypair. Returns (private_key, public_key).
• generate_preshared_key() — Generate WireGuard preshared key.

core/wireshark.py

• class WiresharkManager — Packet capture and analysis using scapy + optional tshark.
  • Methods: scapy_available, tshark_available, can_capture, get_status, list_interfaces, start_capture, stop_capture, get_capture_stats
• get_wireshark_manager() — Get the global WiresharkManager instance.
• scapy_available() —
• tshark_available() —
• can_capture() — Check if live capture is possible (needs root + libpcap).
• get_status() — Get engine status.
• list_interfaces() — List available network interfaces.
• start_capture(interface, bpf_filter, duration, output_file) — Start packet capture in a background thread.
• stop_capture() — Stop running capture.

Common Imports for Modules

# Colors and display
from core.banner import Colors, clear_screen, display_banner

# Configuration
from core.config import get_config

# LLM access
from core.llm import get_llm, LLMError

# Agent tools
from core.tools import get_tool_registry

# File paths
from core.paths import get_app_dir, get_data_dir, find_tool

# Hardware (ADB/Fastboot)
from core.hardware import get_hardware_manager

# Available Colors
Colors.RED, Colors.GREEN, Colors.YELLOW, Colors.BLUE,
Colors.MAGENTA, Colors.CYAN, Colors.WHITE, Colors.BOLD,
Colors.DIM, Colors.RESET

---

3. Web Route Patterns

Routes live in web/routes/. Each file defines a Flask Blueprint.

Blueprint Template

from flask import Blueprint, render_template, request, jsonify
from web.auth import login_required

myfeature_bp = Blueprint('myfeature', __name__, url_prefix='/myfeature')


@myfeature_bp.route('/')
@login_required
def index():
    return render_template('myfeature.html')


@myfeature_bp.route('/action', methods=['POST'])
@login_required
def action():
    data = request.get_json(silent=True) or {}
    # Process...
    return jsonify({'ok': True, 'result': ...})

Registration

In web/app.py, add:

from web.routes.myfeature import myfeature_bp
app.register_blueprint(myfeature_bp)

Existing Routes

ad_audit (22 routes)

• GET / → index
• POST /connect → connect
• POST /disconnect → disconnect
• GET /status → status
• GET /users → users
• ... and 17 more

analyze (13 routes)

• GET / → index
• POST /file → analyze_file
• POST /strings → extract_strings
• POST /hash → hash_lookup
• POST /log → analyze_log
• ... and 8 more

android_exploit (81 routes)

• GET / → index
• POST /apps/list → apps_list
• POST /apps/pull-apk → apps_pull_apk
• POST /apps/pull-data → apps_pull_data
• POST /apps/shared-prefs → apps_shared_prefs
• ... and 76 more

android_protect (63 routes)

• GET / → index
• POST /scan/quick → scan_quick
• POST /scan/full → scan_full
• POST /scan/export → scan_export
• POST /scan/stalkerware → scan_stalkerware
• ... and 58 more

anti_forensics (14 routes)

• GET / → index
• GET /capabilities → capabilities
• POST /delete/file → delete_file
• POST /delete/directory → delete_directory
• POST /wipe → wipe_free_space
• ... and 9 more

api_fuzzer (12 routes)

• GET / → index
• POST /discover → discover
• POST /openapi → parse_openapi
• POST /fuzz → fuzz
• POST /auth/bypass → auth_bypass
• ... and 7 more

archon (11 routes)

• GET / → index
• POST /shell → shell
• POST /pull → pull
• POST /push → push
• GET /packages → packages
• ... and 6 more

auth_routes (4 routes)

• GET,POST /login → login
• POST /api/login → api_login
• GET /api/check → api_check
• GET /logout → logout

autonomy (16 routes)

• GET / → index
• GET /status → status
• POST /start → start
• POST /stop → stop
• POST /pause → pause
• ... and 11 more

ble_scanner (12 routes)

• GET / → index
• GET /status → status
• POST /scan → scan
• GET /devices → devices
• GET /device/<address> → device_detail
• ... and 7 more

c2_framework (13 routes)

• GET /c2/ → index
• GET /c2/listeners → list_listeners
• POST /c2/listeners → start_listener
• DELETE /c2/listeners/<name> → stop_listener
• GET /c2/agents → list_agents
• ... and 8 more

chat (6 routes)

• POST /chat → chat
• POST /chat/reset → chat_reset
• GET /chat/status → chat_status
• POST /agent/run → agent_run
• GET /agent/stream/<run_id> → agent_stream
• ... and 1 more

cloud_scan (8 routes)

• GET / → index
• POST /s3/enum → s3_enum
• POST /gcs/enum → gcs_enum
• POST /azure/enum → azure_enum
• POST /services → exposed_services
• ... and 3 more

container_sec (16 routes)

• GET / → index
• GET /status → status
• POST /docker/audit → docker_audit
• GET /docker/containers → docker_containers
• POST /docker/containers/<container_id>/audit → docker_container_audit
• ... and 11 more

counter (4 routes)

• GET / → index
• POST /scan → scan
• POST /check/<check_name> → check
• GET /logins → logins

dashboard (4 routes)

• GET / → index
• GET /manual → manual
• GET /manual/windows → manual_windows
• POST /api/modules/reload → reload_modules

deauth (14 routes)

• GET / → index
• GET /interfaces → interfaces
• POST /monitor/start → monitor_start
• POST /monitor/stop → monitor_stop
• POST /scan/networks → scan_networks
• ... and 9 more

defense (51 routes)

• GET / → index
• GET /linux → linux_index
• POST /linux/audit → linux_audit
• POST /linux/check/<check_name> → linux_check
• GET /linux/firewall/rules → linux_firewall_rules
• ... and 46 more

dns_service (51 routes)

• GET / → index
• GET /nameserver → nameserver
• GET /network-info → network_info
• GET /nameserver/binary-info → binary_info
• POST /nameserver/query → query_test
• ... and 46 more

email_sec (12 routes)

• GET / → index
• POST /domain → analyze_domain
• POST /spf → check_spf
• POST /dmarc → check_dmarc
• POST /dkim → check_dkim
• ... and 7 more

encmodules (8 routes)

• GET / → index
• POST /upload → upload
• POST /verify → verify
• POST /run → run_module
• GET /stream/<run_id> → stream
• ... and 3 more

exploit_dev (12 routes)

• GET / → index
• POST /shellcode → shellcode
• GET /shellcodes → list_shellcodes
• POST /encode → encode
• POST /pattern/create → pattern_create
• ... and 7 more

forensics (10 routes)

• GET / → index
• POST /hash → hash_file
• POST /verify → verify_hash
• POST /image → create_image
• POST /carve → carve_files
• ... and 5 more

hack_hijack (10 routes)

• GET /hack-hijack/ → index
• POST /hack-hijack/scan → start_scan
• GET /hack-hijack/scan/<job_id>/stream → scan_stream
• GET /hack-hijack/scan/<job_id> → scan_status
• POST /hack-hijack/takeover → attempt_takeover
• ... and 5 more

hardware (25 routes)

• GET / → index
• GET /status → status
• GET /adb/devices → adb_devices
• POST /adb/info → adb_info
• POST /adb/shell → adb_shell
• ... and 20 more

incident_resp (19 routes)

• GET / → index
• POST /incidents → create_incident
• GET /incidents → list_incidents
• GET /incidents/<incident_id> → get_incident
• PUT /incidents/<incident_id> → update_incident
• ... and 14 more

ipcapture (12 routes)

• GET /ipcapture/ → index
• GET /ipcapture/links → list_links
• POST /ipcapture/links → create_link
• GET /ipcapture/links/<key> → get_link
• DELETE /ipcapture/links/<key> → delete_link
• ... and 7 more

iphone_exploit (35 routes)

• GET / → index
• POST /devices → list_devices
• POST /device-info → device_info
• POST /fingerprint → fingerprint
• POST /pair → pair
• ... and 30 more

llm_trainer (18 routes)

• GET / → index
• POST /deps → check_deps
• POST /deps/install → install_deps
• POST /scan → scan_codebase
• POST /dataset/generate → generate_dataset
• ... and 13 more

loadtest (7 routes)

• GET / → index
• POST /start → start
• POST /stop → stop
• POST /pause → pause
• POST /resume → resume
• ... and 2 more

log_correlator (10 routes)

• GET / → index
• POST /ingest/file → ingest_file
• POST /ingest/text → ingest_text
• GET /search → search
• GET,DELETE /alerts → alerts
• ... and 5 more

malware_sandbox (9 routes)

• GET / → index
• GET /status → status
• POST /submit → submit
• GET /samples → samples
• POST /static → static_analysis
• ... and 4 more

mitm_proxy (16 routes)

• GET / → index
• POST /start → start
• POST /stop → stop
• GET /status → status
• POST /ssl-strip → ssl_strip
• ... and 11 more

module_creator (7 routes)

• GET / → index
• GET /templates → templates
• POST /create → create
• POST /validate → validate
• GET /list → list_modules
• ... and 2 more

msf (4 routes)

• GET / → index
• GET /status → status
• POST /connect → connect
• POST /console/send → console_send

net_mapper (9 routes)

• GET /net-mapper/ → index
• POST /net-mapper/discover → discover
• GET /net-mapper/discover/<job_id> → discover_status
• POST /net-mapper/scan-host → scan_host
• POST /net-mapper/topology → build_topology
• ... and 4 more

network (15 routes)

• GET / → index
• POST /connections → connections
• POST /arp-table → arp_table
• POST /interfaces → interfaces
• POST /ids/scan → ids_scan
• ... and 10 more

offense (15 routes)

• GET / → index
• GET /status → status
• POST /connect → connect
• POST /disconnect → disconnect
• POST /server/start → start_server
• ... and 10 more

osint (11 routes)

• GET / → index
• GET /categories → get_categories
• GET /stats → db_stats
• GET /search/stream → search_stream
• GET /dossiers → list_dossiers
• ... and 6 more

password_toolkit (13 routes)

• GET /password-toolkit/ → index
• POST /password-toolkit/identify → identify_hash
• POST /password-toolkit/crack → crack_hash
• GET /password-toolkit/crack/<job_id> → crack_status
• POST /password-toolkit/generate → generate
• ... and 8 more

phishmail (35 routes)

• GET / → index
• POST /send → send
• POST /validate → validate
• GET /campaigns → list_campaigns
• POST /campaigns → create_campaign
• ... and 30 more

pineapple (23 routes)

• GET / → index
• GET /interfaces → interfaces
• GET /tools → tools_status
• POST /start → start_ap
• POST /stop → stop_ap
• ... and 18 more

port_scanner (5 routes)

• GET / → index
• POST /start → start_scan
• GET /stream/<job_id> → stream
• GET /result/<job_id> → get_result
• POST /cancel/<job_id> → cancel_scan

rcs_tools (79 routes)

• GET / → index
• GET /status → status
• GET /device → device
• GET /shizuku → shizuku
• GET /archon → archon
• ... and 74 more

report_engine (11 routes)

• GET /reports/ → index
• GET /reports/list → list_reports
• POST /reports/create → create_report
• GET /reports/<report_id> → get_report
• PUT /reports/<report_id> → update_report
• ... and 6 more

reverse_eng (13 routes)

• GET / → index
• POST /analyze → analyze
• POST /strings → strings
• POST /disassemble → disassemble
• POST /hex → hex_dump
• ... and 8 more

revshell (18 routes)

• GET / → index
• POST /listener/start → listener_start
• POST /listener/stop → listener_stop
• POST /listener/status → listener_status
• POST /sessions → list_sessions
• ... and 13 more

rfid_tools (14 routes)

• GET / → index
• GET /tools → tools_status
• POST /lf/search → lf_search
• POST /lf/read/em410x → lf_read_em
• POST /lf/clone → lf_clone
• ... and 9 more

sdr_tools (22 routes)

• GET / → index
• GET /devices → devices
• POST /spectrum → spectrum
• POST /capture/start → capture_start
• POST /capture/stop → capture_stop
• ... and 17 more

settings (29 routes)

• GET / → index
• POST /password → change_password
• POST /osint → update_osint
• POST /upnp → update_upnp
• POST /llm → update_llm
• ... and 24 more

simulate (7 routes)

• GET / → index
• POST /password → password_audit
• POST /portscan → port_scan
• POST /banner → banner_grab
• POST /payloads → generate_payloads
• ... and 2 more

sms_forge (21 routes)

• GET / → index
• GET /status → status
• GET /messages → messages
• POST /sms → add_sms
• POST /mms → add_mms
• ... and 16 more

social_eng (18 routes)

• GET / → index
• POST /clone → clone_page
• GET /pages → list_pages
• GET /pages/<page_id> → get_page
• DELETE /pages/<page_id> → delete_page
• ... and 13 more

starlink_hack (29 routes)

• GET / → index
• GET /status → status
• POST /discover → discover
• GET /dish-status → dish_status
• GET /dish-info → dish_info
• ... and 24 more

steganography (8 routes)

• GET / → index
• GET /capabilities → capabilities
• POST /capacity → capacity
• POST /hide → hide
• POST /extract → extract
• ... and 3 more

targets (7 routes)

• GET / → index
• POST /add → add
• POST /update/<tid> → update
• POST /delete/<tid> → delete
• POST /status/<tid> → set_status
• ... and 2 more

threat_intel (13 routes)

• GET / → index
• GET,POST,DELETE /iocs → iocs
• POST /iocs/import → import_iocs
• GET /iocs/export → export_iocs
• GET /iocs/detect → detect_type
• ... and 8 more

upnp (5 routes)

• GET / → index
• POST /refresh → refresh
• POST /add → add
• POST /remove → remove
• POST /cron → cron

vuln_scanner (10 routes)

• GET / → index
• POST /scan → start_scan
• GET /scan/<job_id> → get_scan
• GET /scans → list_scans
• DELETE /scan/<job_id> → delete_scan
• ... and 5 more

webapp_scanner (7 routes)

• GET /web-scanner/ → index
• POST /web-scanner/quick → quick_scan
• POST /web-scanner/dirbust → dir_bruteforce
• GET /web-scanner/dirbust/<job_id> → dirbust_status
• POST /web-scanner/subdomain → subdomain_enum
• ... and 2 more

wifi_audit (18 routes)

• GET / → index
• GET /tools → tools_status
• GET /interfaces → interfaces
• POST /monitor/enable → monitor_enable
• POST /monitor/disable → monitor_disable
• ... and 13 more

wireguard (25 routes)

• GET / → index
• POST /server/status → server_status
• POST /server/start → server_start
• POST /server/stop → server_stop
• POST /server/restart → server_restart
• ... and 20 more

wireshark (14 routes)

• GET / → index
• GET /status → status
• GET /interfaces → interfaces
• POST /capture/start → capture_start
• POST /capture/stop → capture_stop
• ... and 9 more

---

4. Template Patterns

Templates live in web/templates/ and use Jinja2 extending base.html.

Template Structure

{%% extends "base.html" %%}
{%% block title %%}Feature Name - AUTARCH{%% endblock %%}

{%% block content %%}
<div class="page-header">
    <h1>Feature Name</h1>
</div>

<div class="section">
    <h2>Section Title</h2>
    <!-- Content here -->
</div>

<script>
// JS for this page
</script>
{%% endblock %%}

CSS Variables Available

--bg-main, --bg-card, --bg-secondary, --bg-input
--text-primary, --text-secondary, --text-muted
--accent (green), --danger (red), --border
--radius (border radius), --success (green)

Common UI Patterns

• Tab bar: <div class="tab-bar"><button class="tab active">Tab 1</button></div>
• Card: <div style="border:1px solid var(--border);background:var(--bg-card);border-radius:var(--radius);padding:0.85rem 1rem">
• Table: <table class="data-table"><thead>...</thead><tbody>...</tbody></table>
• Button: <button class="btn btn-primary btn-sm">Action</button>
• Form: <div class="form-group"><label>...</label><input ...><small>Help text</small></div>

Templates (74 total)

• ad_audit.html (extends: base.html)
• analyze.html (extends: base.html)
• android_exploit.html (extends: base.html)
• android_protect.html (extends: base.html)
• anti_forensics.html (extends: base.html)
• api_fuzzer.html (extends: base.html)
• archon.html (extends: base.html)
• autonomy.html (extends: base.html)
• base.html (extends: none)
• ble_scanner.html (extends: base.html)
• c2_framework.html (extends: base.html)
• category.html (extends: base.html)
• cloud_scan.html (extends: base.html)
• container_sec.html (extends: base.html)
• counter.html (extends: base.html)
• dashboard.html (extends: base.html)
• deauth.html (extends: base.html)
• defense.html (extends: base.html)
• defense_linux.html (extends: base.html)
• defense_monitor.html (extends: base.html)
• defense_windows.html (extends: base.html)
• dns_nameserver.html (extends: base.html)
• dns_service.html (extends: base.html)
• email_sec.html (extends: base.html)
• encmodules.html (extends: base.html)
• exploit_dev.html (extends: base.html)
• forensics.html (extends: base.html)
• hack_hijack.html (extends: base.html)
• hardware.html (extends: base.html)
• hash_detection.html (extends: base.html)
• incident_resp.html (extends: base.html)
• ipcapture.html (extends: base.html)
• iphone_exploit.html (extends: base.html)
• legendary_creator.html (extends: base.html)
• llm_settings.html (extends: base.html)
• llm_trainer.html (extends: base.html)
• loadtest.html (extends: base.html)
• log_correlator.html (extends: base.html)
• login.html (extends: base.html)
• malware_sandbox.html (extends: base.html)
• manual.html (extends: base.html)
• mcp_settings.html (extends: base.html)
• mitm_proxy.html (extends: base.html)
• module_creator.html (extends: base.html)
• msf.html (extends: base.html)
• net_mapper.html (extends: base.html)
• network.html (extends: base.html)
• offense.html (extends: base.html)
• osint.html (extends: base.html)
• password_toolkit.html (extends: base.html)
• phishmail.html (extends: base.html)
• pineapple.html (extends: base.html)
• port_scanner.html (extends: base.html)
• rcs_tools.html (extends: base.html)
• report_engine.html (extends: base.html)
• reverse_eng.html (extends: base.html)
• revshell.html (extends: base.html)
• rfid_tools.html (extends: base.html)
• sdr_tools.html (extends: base.html)
• settings.html (extends: base.html)
• simulate.html (extends: base.html)
• sms_forge.html (extends: base.html)
• social_eng.html (extends: base.html)
• starlink_hack.html (extends: base.html)
• steganography.html (extends: base.html)
• system_deps.html (extends: base.html)
• targets.html (extends: base.html)
• threat_intel.html (extends: base.html)
• upnp.html (extends: base.html)
• vuln_scanner.html (extends: base.html)
• webapp_scanner.html (extends: base.html)
• wifi_audit.html (extends: base.html)
• wireguard.html (extends: base.html)
• wireshark.html (extends: base.html)

---

5. Configuration System

Config is managed by core/config.py using Python's configparser. File: autarch_settings.conf (INI format).

Config Sections

• [llama]: model_path, n_ctx, n_threads, n_gpu_layers, gpu_backend, temperature, top_p, top_k ... +3 more
• [autarch]: first_run, modules_path, verbose, quiet, no_banner, llm_backend
• [claude]: api_key, model, max_tokens, temperature
• [osint]: max_threads, timeout, include_nsfw
• [pentest]: max_pipeline_steps, output_chunk_size, auto_execute, save_raw_output
• [transformers]: model_path, device, torch_dtype, load_in_8bit, load_in_4bit, trust_remote_code, max_tokens, temperature ... +3 more
• [rsf]: install_path, enabled, default_target, default_port, execution_timeout
• [upnp]: enabled, internal_ip, refresh_hours, mappings
• [web]: host, port, secret_key, mcp_port
• [mcp]: enabled, auto_start, transport, host, port, log_level, instructions, auth_enabled ... +16 more
• [revshell]: enabled, host, port, auto_start
• [slm]: enabled, backend, model_path, n_ctx, n_gpu_layers, n_threads
• [sam]: enabled, backend, model_path, n_ctx, n_gpu_layers, n_threads
• [lam]: enabled, backend, model_path, n_ctx, n_gpu_layers, n_threads
• [agents]: backend, local_max_steps, local_verbose, claude_enabled, claude_model, claude_max_tokens, claude_max_steps, openai_enabled ... +4 more
• [autonomy]: enabled, monitor_interval, rule_eval_interval, max_concurrent_agents, threat_threshold_auto_respond, log_max_entries

Usage in Code

from core.config import get_config
config = get_config()

# Read values
val = config.get('section', 'key', 'default')
num = config.get_int('section', 'key', 0)
flt = config.get_float('section', 'key', 0.0)
bol = config.get_bool('section', 'key', False)

# Write values
config.set('section', 'key', 'value')
config.save()

# Typed getters
config.get_llama_settings()      # dict
config.get_claude_settings()     # dict
config.get_mcp_settings()        # dict
config.get_agents_settings()     # dict
config.get_autonomy_settings()   # dict

---

6. Adding to the Navigation

Edit web/templates/base.html. The sidebar has sections:

• Top (Dashboard, Port Scanner, Targets)
• Categories (Defense, Offense, Counter, Analyze, OSINT, Simulate)
• Network (Network Security, Wireshark, Net Mapper)
• Tools (Create Module, Enc Modules, Hardware, exploits, Shield, etc.)
• System (UPnP, WireGuard, MSF Console, DNS, Settings, etc.)

Add a nav item:

<li><a href="{{ url_for('myfeature.index') }}"
       class="{% if request.blueprint == 'myfeature' %}active{% endif %}">
    My Feature</a></li>

Sub-items use: style="padding-left:1.5rem;font-size:0.85rem" with └ prefix.

---

7. MCP Tool System

Tools exposed via Model Context Protocol (MCP) are defined in core/mcp_server.py. To add a new MCP tool:

# In create_mcp_server(), add:
@mcp.tool()
def my_tool(param1: str, param2: int = 10) -> str:
    """Description of what the tool does."""
    return execute_tool('my_tool', {'param1': param1, 'param2': param2})

# In execute_tool(), add the handler:
elif name == 'my_tool':
    return _run_my_tool(arguments)

# Implement the handler:
def _run_my_tool(args: dict) -> str:
    # ... implementation
    return json.dumps({'result': ...})