RedAmon 4.0.0: Fireteam + SG-ReAct

RedAmon 4.0.0 ships Fireteam, a scatter-gather multi-agent execution mode built into the core ReAct orchestrator. The root agent can now fan out into N specialist sub-agents that work independent angles of the same objective in parallel, each with its own ReAct loop, inside the same event loop, the same MCP session, and the same Neo4j connection. Zero cross-process serialisation.

The architecture is called SG-ReAct (Scatter-Gather ReAct). It's the first pentesting AI pattern that treats autonomy and safety as orthogonal axes, not opposites. Phase gating, RoE enforcement, dangerous-tool confirmation, scope rails, and the recursion ban all sit on the edges of the state graph, the agent reasons freely inside the nodes.

Also in this release: the new built-in XSS attack skill (8-step workflow covering reflected, stored, DOM, blind, WAF bypass, CSP bypass), a full Argentum Digital XSS practice lab (~1,650 LoC embedding every XSS vector the skill can hit), MCP dead-session auto-reconnect, MCP server supervisor with restart-on-crash, and a new PLAN_MAX_PARALLEL_TOOLS concurrency cap that prevents SSE head-of-line blocking under heavy fireteam fan-out.

Benchmarked against PentAGI, PentestGPT, Strix, and Shannon on 82 agentic primitives across 14 architectural dimensions: RedAmon leads at 72.0% coverage, 30 percentage points above the runner-up. Guardrails 8.0/8.0 (nearest 2.0), Domain knowledge 5.0/5.0 (nearest 2.0), Multi-tenancy 4.0/4.0 (nearest 3.0), Memory 6.0/8.0 (+50% over the field). Full methodology in readmes/README.AGENTIC_SYSTEM.md.

What's new

Fireteam (multi-agent deployment)

The root agent can deploy a coordinated team of specialised agent members that work the same target in parallel, each with its own ReAct loop, skill set, and tool budget. Each member runs as a LangGraph subgraph with its own state, reasoning trace, and WebSocket streaming channel. Results are collected by a fireteam_collect_node that merges findings back into the shared graph.

Gating: FIRETEAM_ENABLED master switch (default true), requires PERSISTENT_CHECKPOINTER=true
8 project settings: FIRETEAM_MAX_CONCURRENT (5), FIRETEAM_MAX_MEMBERS (5), FIRETEAM_MEMBER_MAX_ITERATIONS (20), FIRETEAM_TIMEOUT_SEC (3600), FIRETEAM_ALLOWED_PHASES, FIRETEAM_CONFIRMATION_TIMEOUT_SEC (600), FIRETEAM_PROPENSITY (1-5)
Mutex groups: TOOL_MUTEX_GROUPS serialises singleton tools (metasploit_console) across the team
Dangerous-tool operator gate: per-member approval card on the chat drawer, auto-reject after timeout
Wave-based plan_tools execution: each member can emit a single-turn plan of N independent tools run via asyncio.gather
Webapp UI integration: new Agent Behaviour settings, per-member live badges with spinners and stop buttons, fireteam card in sessions view
Tests: test_fireteam_core.py, test_fireteam_deploy.py, test_fireteam_regressions.py

PLAN_MAX_PARALLEL_TOOLS setting

Per-wave concurrency cap applied uniformly to root agent and fireteam member plan execution. Default 10. Prevents SSE head-of-line blocking on the MCP kali-sandbox stream under heavy concurrency. Prisma field agentPlanMaxParallelTools, range 1-50, exposed in Agent Behaviour settings. 13 new tests in test_plan_parallelism.py.

MCP dead-session auto-reconnect

MCPToolsManager transparently rebuilds its MultiServerMCPClient when the kali-sandbox SSE stream dies mid-tool-call. Generation counter bumps on every successful get_tools(), asyncio.Lock serialises reconnects, _is_mcp_transport_error walks __cause__/__context__ chain plus ExceptionGroup sub-exceptions. Concurrent fireteam failures collapse to one real rebuild. 48 tests in test_mcp_reconnect.py across 4 classes.

MCP server supervisor

mcp/servers/run_servers.py polls Process.is_alive() every 5s and automatically respawns any dead child server (network_recon, nuclei, metasploit, nmap, playwright) with a logged restart counter. Also fixed a pre-existing AssertionError: can only test a child process on container restart.

Built-in XSS attack skill (Skill #6)

End-to-end Cross-Site Scripting workflow promoted from xss-unclassified fallback to first-class skill. 8-step workflow covering reflected, stored, DOM, and blind XSS. Classified by the Intent Router as a green XSS badge.

XSS_TOOLS (~16 KB): canary reflection sweep (rEdAm0n1337XsS), per-char filter probe via kxss, context-aware payload selection across 8 contexts, DOM XSS via Playwright monkey-patched sinks, dialog-handler verification, dalfox WAF bypass, impact proof via cookie theft
XSS_BLIND_WORKFLOW (~2.7 KB, opt-in): interactsh-client OOB callbacks for stored XSS in admin contexts
XSS_PAYLOAD_REFERENCE (~5 KB): payloads by context, Brute Logic polyglot, 12-row WAF bypass encoding table, 9-row CSP bypass shortcut table
3 project settings: XSS_DALFOX_ENABLED, XSS_BLIND_CALLBACK_ENABLED, XSS_CSP_BYPASS_ENABLED
Tests: test_xss_skill.py with 6 test classes, 46 tests

kxss Go binary in kali-sandbox

Per-character XSS filter probe (go install github.com/Emoe/kxss@latest). Reports which dangerous chars survive each parameter unfiltered. Used by Step 3b of the XSS workflow to eliminate blind tag-spraying.

Argentum Digital comprehensive XSS practice lab

guinea_pigs/dvws-node/xss-lab/, ~1,650 LoC, Node.js + Express + headless Chromium. A fictional B2B consulting firm site that embeds every XSS vector the new skill can exploit, hidden inside normal-looking site features. Zero references to "XSS", "lab", "vulnerable", or "challenge" anywhere on the site.

8 reflected contexts, 4 stored surfaces, 7 DOM XSS sinks
3 blind XSS surfaces fired by an admin-bot.js headless Chromium sidecar on a 30-second moderation queue
5 WAF bypass tiers disguised as "search engine generations"
6 CSP scenarios disguised as marketing/dashboard/widget pages
Internal moderation queue at /argentum/admin/inbox (loopback or X-Internal-Bot: 1 only)
Integrated into the dvws-node guinea pig with nginx proxy on /argentum/*

Webapp UI integration

New Cross-Site Scripting toggle in the Built-In Skills section, defaulted to ON. Updated 4 webapp files. Existing project rows in Postgres backfilled with xss:true.

Wiki documentation

Agent-Skills.md, Project-Settings-Reference.md, Chat-Skills.md, and Home.md all updated with the new XSS skill.

Changed

KNOWN_ATTACK_PATHS expanded from 5 to 6 entries
Classification prompt new XSS section, classifier criteria, unclassified-fallback pruned
_inject_builtin_skill_workflow new branch for xss, gated on execute_curl
build_attack_path_behavior new XSS behavior block
tool_registry.py kali_shell description now lists dalfox, kxss, interactsh-client
DVWS-Node deploy command now ships the xss-lab source alongside setup.sh
docker-compose.override.yml new argentum service on port 3001

Notes

Major version bump. The new built-in skill expands the agent's first-class attack methodology surface by 20% and ships a brand-new comprehensive practice lab
Existing projects automatically inherit xss:true (Postgres backfill). New projects get it via the Prisma default
No breaking changes to existing skills, workflows, or APIs

Full technical deep-dive: readmes/README.AGENTIC_SYSTEM.md Full changelog entry: CHANGELOG.md

RedAmon is built for authorized security testing, education, and research only. Always obtain proper authorization before testing any target you do not own.