${GITHUB_REF#refs/tags/v}

Release notes pending.

${GITHUB_REF#refs/tags/v}

Release notes pending.

${GITHUB_REF#refs/tags/v}

Release notes pending.

${GITHUB_REF#refs/tags/v}

Release notes pending.

${GITHUB_REF#refs/tags/v}

Release notes pending.

HunterX v7.0.1 is the finalized production-grade autonomous assessment engine.

This corrective release completes the autonomous, model-driven, target-agnostic assessment loop on top of the existing v7.0.0 foundation, hardened by the final multi-target acceptance pass.

What's in this release

• Target-agnostic architecture — universal discovery, attack-surface graph, capability × surface mapping and assessment-queue execution with zero target-specific logic in the production core.
• Autonomous model-driven attacking — the connected model participates in the real execution loop (observe → reason → hypothesize → real task → probe → analyze → verify → find → learn → reason again) until genuine attack-surface/hypothesis exhaustion; a finding never terminates the mission.
• Continuous discovery — newly discovered endpoints, parameters, objects, APIs and workflows flow back into the model's reasoning and attack planning.
• Adaptive aggressive execution — bounded aggression with rate-control, pacing, backoff and recovery on defensive responses (429/403/5xx/resets); throttling is never reported as completion.
• Capability execution — every one of the 21 catalog capabilities is demonstrated through real execution (differential probes, tool-orchestration fallback chains, honest BLOCKED/FAILED/NOT_APPLICABLE states).
• Evidence / verification / replay / impact / PoC — validation-grade evidence, deterministic replay, reproduction classification, generic impact assessment and minimal PoCs.
• Validated finding lifecycle — candidate → evidence → replay → reproduction → impact → PoC → validated finding → report-ready packages with deduplication and evidence-derived severity.
• Multi-target acceptance — the full contract verified on generic synthetic profiles (simple web, REST API, GraphQL, authenticated, multi-user, file-handling, workflow).
• Reliability / failure recovery — prolonged-soak stability, bounded queues/hypotheses/telemetry, explicit model/tool failure states (MODEL_UNAVAILABLE, RESOURCE_LIMIT, BLOCKED) that are never faked as completion.
• Packaging, Docker and installer — wheel + sdist, clean-environment install, non-root Docker image, verified installer and documentation alignment.

HunterX performs an exhaustive assessment of discovered and applicable attack surfaces within the available capabilities and execution constraints — it does not guarantee discovery of every possible vulnerability.

Juice Shop (localhost:3010) was used strictly as a black-box regression target, never as a design target.

Breaking changes

None. This is a corrective/finalized release over v7.0.0.

Assets

• Wheel: hunterxsec-7.0.1-py3-none-any.whl
• Source distribution: hunterxsec-7.0.1.tar.gz
• SBOM (CycloneDX + SPDX), provenance and Cosign (Sigstore) signatures.

HunterX v7.0.0 — AI-Assisted Vulnerability Discovery, Validation & Proof Engine

From "Possible vulnerability detected" to validated, evidence-driven findings — Observed → Hypothesized → Probed → Verified → Reproduced → Proven.

HunterX v7 is a major re-architecture of the platform around vulnerability validation and proof, not just detection. Traditional scanners stop at a detection; HunterX v7 continues through validation, reproduction, and evidence-backed proof of concept workflows.

🚀 1.7K+ Docker image pulls and counting.

What's New in v7

AI-Assisted Offensive Security

• Autonomous mission orchestration — create, run, checkpoint, resume and finalize full-spectrum security-assessment missions
• Adaptive Mission Planning Engine — attack-path planning, replanning and explainable next-best-action selection
• Observe → Hypothesize → Probe → Verify reasoning across the assessment lifecycle
• Evidence-driven findings with confidence, impact and report-readiness checks

Vulnerability Validation & Proof

• Evidence-driven vulnerability validation — hypothesis testing, validation verdicts, and controlled, safe Proof of Concept engineering with replay verification
• Reproducible proof workflows — proof contracts, minimal safe proofs, replay, reproducibility
• Professional reporting — findings, evidence bundles, remediation plans and multi-format exports (markdown, HTML, JSON, SARIF, PDF, package)

Platform & Intelligence

• Tool Integration SDK and Tool Integration Factory — 100+ registered security tools with machine-readable contracts, structured execution, parsing/normalization and dependency-aware chaining
• Security Skills, Knowledge Graph and Threat Modeling with cross-tool correlation and Attack Chain Analysis
• Cloud & SaaS Attack-Surface Intelligence — provider detection, resource/exposure/environment classification and topology
• Payload Intelligence for evidence capture and validation
• Target memory & campaign intelligence — snapshots, diffs, coverage and revalidation planning
• TIDB persistence — SQL storage with 21 linear Alembic migrations, events, audit and versioning

Security & Reliability

• HUNTERX_* environment-variable configuration overrides
• Safe XML parsing via defusedxml (XXE / entity-expansion hardened)
• Hardened hunterx base install and Docker image runtime
• Official Docker images (nullc0d30/hunterx) — multi-arch amd64/arm64, non-root, tags 7, 7.0, 7.0.0, latest, stable

Works with Your Security Ecosystem

HunterX orchestrates, correlates, validates and proves across an integrated ecosystem including Nmap, Nuclei, SQLmap, FFUF, Amass, Subfinder, httpx, Katana, OWASP ZAP, Metasploit, Semgrep, Gitleaks, TruffleHog, Dalfox, XSStrike, Ghauri, Commix, and Interactsh — as an orchestration, reasoning, correlation, validation and evidence layer around your offensive-security workflows.

Install

pip install hunterxsec
hunterx --help

docker pull nullc0d30/hunterx:7.0.0

Changelog

7.0.0

Added

• Clean Architecture v7 core (src/hunterx): domain, application, infrastructure, engines, agents, tools, plugins, knowledge, reporting, config, CLI and API layers
• Autonomous mission orchestration — create, run, checkpoint, resume and finalize full-spectrum security-assessment missions
• Adaptive mission planning — attack-path planning, replanning and explainable next-best-action selection
• Toolchain intelligence layer — 100+ registered security tools with machine-readable contracts, structured execution, parsing/normalization and dependency-aware chaining
• Evidence-driven vulnerability validation — hypothesis testing, validation verdicts, and controlled, safe proof/PoC engineering with replay verification
• Professional reporting — findings, evidence bundles, remediation plans and multi-format exports (markdown, HTML, JSON, SARIF, PDF, package)
• Target memory & campaign intelligence — snapshots, diffs, coverage and revalidation planning
• TIDB persistence — SQL storage with 21 linear Alembic migrations, events, audit and versioning
• HUNTERX_* environment-variable configuration overrides
• Mission persistence across CLI invocations and process restarts (restore path)
• Safe XML parsing via defusedxml (XXE / entity-expansion hardened)
• install.sh v7 installer (idempotent, database initialization, verified installation)

Fixed

• Base installation no longer crashes without optional extras (SQLAlchemy now a base dependency)
• mission create → mission start workflow works across separate CLI invocations
• Harden hunterx base install and Docker image runtime
• Ruff, dead-code (vulture) and bandit security gates green

Note on naming: HunterX publishes to PyPI as hunterxsec (the plain hunterx name on PyPI belongs to an unrelated project). The import package and CLI command remain hunterx.