Agent Policies, Local LLM, and Campaign Governance

This page documents agent governance: CLI flags, safety profiles, diagnostic subcommands, and policy files. The KittySploit agent is not an opaque script: it is a five-phase workflow (scan → analyze → reason → exploit → report) framed by explicit policies.

Anatomy of the agent command

Two invocation families coexist:

agent <target> [options]             # Autonomous campaign
agent <doctor|explain|replay|retest|profiles|metadata> ...

The first launches the full workflow graph. The second queries artifacts already produced or verifies the environment. Consult built-in help at any time:

agent
agent -h

Each campaign receives a unique identifier of the form agent_20260618T120000_ab12cd34ef. Keep it: it links the report, validation, explain, and retest.

Target phase and workflow

Target syntax

agent example.com
agent https://app.example.com:8443/admin
agent 10.0.0.42 --protocol https

The target may be a hostname, an IP address, or a full URL. The --protocol option forces the scheme (http, https, tcp…) when automatic heuristics are insufficient.

Campaign modes without exploitation

# Reconnaissance and analysis only
agent https://target.local --no-exploit

# Visible plan without network execution
agent https://target.local --dry-run

# Reconnaissance plus planning, no exploitation
agent https://target.local --plan-only

# Conservative combination for a first client pass
agent https://target.local --no-exploit --goal recon --safety-profile discreet

--dry-run builds a bounded plan without network traffic or module execution. --plan-only runs reconnaissance then stops before the exploit phase. These modes are essential for validating an engagement before any intrusive action.

Campaign goals (--goal)

The --goal option steers the planner (goal_planner) toward a specific business outcome:

agent https://target.local --goal recon
agent https://target.local --goal validate
agent https://target.local --goal obtain-auth
agent https://target.local --goal obtain-shell --approve-risk intrusive
agent https://target.local --goal post-auth --reuse-proxy-auth
agent https://target.local --goal evidence-only
agent https://target.local --goal detection-validation
agent https://target.local --goal retest

Extended surface (--all)

agent corp.example --all --no-exploit --safety-profile discreet

The --all flag broadens the surface: OSINT modules, cloud (auxiliary/aws, auxiliary/azure), passive scanners, then a bounded HTTP scan on discovered subdomains. This is the natural bridge to the cloud chapter.

Shell hunting (--shell-hunter)

agent https://target.local \
  --profile internal-lab \
  --goal obtain-shell \
  --shell-hunter \
  --approve-risk intrusive

--shell-hunter pushes the agent to pursue interactive sessions. It requires --approve-risk intrusive (or an equivalent policy). Without this approval, the command fails before launch.

Safety profiles (--safety-profile)

Four levels frame network behavior and module selection:

agent https://prod.client.fr --safety-profile safe --no-exploit
agent https://prod.client.fr --safety-profile discreet --request-budget 20
agent https://target.local --safety-profile normal
agent https://target.local --safety-profile aggressive --threads 10

In discreet profile, KittySploit automatically enforces:

• threads = 1 ;
• module cap (18 by default) and recon module cap (5) ;
• default request budget (26 units) if not specified ;
• LLM budget (1 call) if --llm-local ;
• delays between HTTP batches (0.7--2.2 s) ;
• disabling of --async-probes.

The safe profile blocks module substrings containing bruteforce, credential, fuzzer, file_download, etc. The discreet profile adds crawler, spider, smuggling…

Risk levels and approvals (--approve-risk)

The risk hierarchy is cumulative:

Approving a higher level implicitly includes lower levels. Each module declares an agent block in its __info__ with a risk field.

# Read-only checks: headers, banners, passive OSINT
agent https://target.local --approve-risk read

# Active validation with controlled mutating requests
agent https://target.local --approve-risk active --goal validate

# Multiple levels in one invocation
agent https://target.local --approve-risk read,active

# Isolated test environment with shell
agent https://target.local \
  --approve-risk intrusive \
  --shell-hunter \
  --goal obtain-shell

Supplementary approvals:

# Mutating HTTP replay: POST, PUT, DELETE
agent https://target.local \
  --http-replay active \
  --approve-active-replay \
  --approve-risk active

# Read-only post-exploitation collection
agent https://target.local \
  --approve-risk active \
  --approve-post-exploit

Mission profiles (--profile)

Mission profiles are presets that combine safety profile, approved risks, budgets, and proxy options. List them:

agent profiles

Available profiles:

• passive --- read-only observation, budget 8, replay disabled ;
• safe-web --- conservative web audit, read+active, budget 20 ;
• authenticated-audit --- proxy cookies, discreet profile ;
• api-review --- API surface without destructive actions ;
• internal-lab --- isolated test environment with intrusive, budget 80 ;
• detection-validation --- SOC detection objective ;
• training-lab --- plan-only, planning without exploitation.

agent https://target.local --profile safe-web
agent https://target.local --profile authenticated-audit --reuse-proxy-auth
agent https://target.local --profile internal-lab --goal obtain-shell
agent https://target.local --profile training-lab
agent https://target.local --profile detection-validation

A profile may pre-fill --goal (detection-validation) or enable plan-only (training-lab). Explicit CLI options remain authoritative when provided.

Policy files (--policy)

For recurring missions, externalize governance in a JSON or TOML file:

{
  "safety_profile": "discreet",
  "approved_risks": ["read", "active"],
  "approve_active_replay": false,
  "approve_post_exploit": false,
  "tls_verify": true,
  "tls_ca_bundle": "/etc/ssl/certs/client-ca.pem",
  "session_policy": "report-only",
  "deadline_seconds": 3600,
  "allowed_ports": [80, 443, 8080],
  "allowed_protocols": ["https"],
  "deny": ["admin.prod.client.fr", "payment.client.fr"]
}

TOML equivalent:

safety_profile = "discreet"
approved_risks = ["read", "active"]
approve_active_replay = false
approve_post_exploit = false
tls_verify = true
session_policy = "report-only"
deadline_seconds = 3600
allowed_ports = [80, 443, 8080]
allowed_protocols = ["https"]
deny = ["admin.prod.client.fr"]

Invocation:

agent https://app.client.fr \
  --policy missions/client-audit.toml \
  --goal validate \
  --reuse-proxy-auth

Policy file fields merge with CLI options. Approved risks are additive. Targets listed in deny (or denied_targets) are blocked by the scope guardrail even if the scope manager allows the parent domain.

Limits, budgets, and timing

Parallelism and modules

agent https://target.local --threads 10 --max-modules 60 --recon-modules 15

• --threads --- module parallelism (default: 5) ;
• --max-modules --- cap per phase (default: 40, minimum 5) ;
• --recon-modules --- recon cap (default: 12, minimum 3).

Network budget (--request-budget)

Each probe or module launch consumes one network unit. Zero means ``profile default'' or unlimited depending on context.

agent https://target.local --request-budget 15 --safety-profile discreet
agent https://target.local --request-budget 0   # profile default or unlimited

LLM budget (--llm-budget)

agent https://target.local --llm-local --llm-budget 3
agent https://target.local --llm-local --llm-budget 0

In discreet profile, the default LLM budget is 1 call if not specified.

Delays and deadlines

agent https://target.local \
  --request-delay-min 1.0 \
  --request-delay-max 3.5 \
  --deadline 7200 \
  --phase-timeout 600 \
  --seed 42

• --request-delay-min/max --- random pause between HTTP batches ;
• --deadline --- maximum campaign duration in seconds ;
• --phase-timeout --- timeout per workflow phase ;
• --seed --- deterministic seed for planning and delays (reproducibility).

HTTP replay and KittyProxy integration

Replay modes

agent https://target.local --http-replay off
agent https://target.local --http-replay safe
agent https://target.local --http-replay active --approve-active-replay
agent https://target.local --http-replay safe --http-replay-max 5

• off --- disables replay ;
• safe --- replays GET/HEAD/OPTIONS only (default) ;
• active --- may replay POST/PUT/PATCH/DELETE (approval required).

Proxy flow

proxy start --host 127.0.0.1 --port 8080
# ... manual authenticated browsing ...
agent https://target.local \
  --reuse-proxy-auth \
  --proxy-flow-limit 40 \
  --http-replay safe

agent https://target.local --no-proxy-flows   # ignore KittyProxy

--reuse-proxy-auth injects observed cookies into modules. Useful after a manually authenticated session via the proxy.

TLS and HTTP identity

agent https://target.local --tls-no-verify
agent https://target.local --tls-ca /path/to/corporate-ca.pem
agent https://target.local --user-agent "ClientAudit/2.0 (+mandate-2026-042)"
agent https://target.local --async-probes

--tls-no-verify is logged in the report. --async-probes enables aiohttp for agent probes when the dependency is present.

Ollama integration and local LLM

KittySploit can reason locally via Ollama, without sending client data to a cloud service.

Prerequisites

# Ollama installation outside KittySploit
ollama pull llama3.1:8b
ollama serve

Useful environment variables:

export KITTYSPLOIT_LLM_ENDPOINT=http://127.0.0.1:11434/api/chat
export KITTYSPLOIT_AGENT_HOME= /.kittysploit/agent

Agent invocation

agent https://target.local \
  --llm-local \
  --llm-model llama3.1:8b \
  --llm-endpoint http://127.0.0.1:11434/api/chat \
  --llm-budget 5 \
  --no-exploit \
  --goal recon

The LLM intervenes mainly in the reason phase to prioritize modules and draft plan rationale. Combine --llm-local with --safety-profile discreet in production audits to limit calls.

LLM diagnostics

agent doctor
agent doctor --json

agent doctor checks in particular:

• local loopback LLM endpoint (llm_endpoint_loopback) ;
• langgraph, requests, aiohttp dependencies ;
• module catalogs and agent metadata coverage ;
• agent directory write access (storage) ;
• agent JSON schemas (agent_schemas).

Session policy (--session-policy)

When the agent opens a session (shell, browser), four behaviors are possible:

agent https://target.local --session-policy report-only
agent https://target.local --session-policy open-latest
agent https://target.local --session-policy ask
agent https://target.local --session-policy never
agent https://target.local --no-interact   # alias for never

• report-only --- references the session in the report without interaction ;
• open-latest --- automatically opens the most recent session ;
• ask --- prompts the operator (default) ;
• never --- never offers interaction.

Diagnostic and audit subcommands

agent doctor

agent doctor
agent doctor --json | jq .

First reflex before a long campaign or CI deployment. Fix non-optional failures before launching agent <target>.

agent explain

agent explain agent_20260618T120000_ab12cd34ef

Produces structured JSON: selected modules, policy decisions, scores, LLM rationale. Essential for justifying a client reporting or SOC feedback.

agent replay

agent replay agent_20260618T120000_ab12cd34ef

Replays campaign HTTP decisions offline (no network traffic by default). Useful for auditing what the agent would have sent.

agent retest

agent retest finding-xss-1
agent retest agent_20260618T120000_ab12cd34ef

Builds a retest plan from a finding or a full run. Feeds the quality cycle used by reporting and follow-up workflows.

agent metadata

agent metadata
agent metadata --json
agent metadata annotate
agent metadata annotate --apply --family scanner,exploits
agent metadata annotate --apply --family auxiliary/aws --limit 20

Audits coverage of agent blocks in module __info__. annotate infers missing metadata (dry-run by default; --apply writes to disk). Module contributors should aim for high compliance so the agent correctly estimates risks and budgets.

Authenticated Web Engagement

workspace create client-staging-2026
workspace use client-staging-2026
scope add staging.client.fr

proxy start --host 127.0.0.1 --port 8080
# Manual authenticated browsing

agent doctor

agent https://staging.client.fr \
  --profile authenticated-audit \
  --policy missions/staging-discreet.toml \
  --goal validate \
  --reuse-proxy-auth \
  --http-replay safe \
  --validation \
  --llm-local \
  --llm-budget 2 \
  --verbose

agent explain agent_20260626T090000_xxxxxxxx

File missions/staging-discreet.toml:

safety_profile = "discreet"
approved_risks = ["read", "active"]
request_budget = 40
session_policy = "report-only"
deadline_seconds = 1800
deny = ["www.client.fr", "api.payment.client.fr"]

Shell With Guardrails

lab start dvwa-basics
workspace use dvwa-lab-shell
scope add 127.0.0.1

agent http://127.0.0.1 \
  --profile internal-lab \
  --goal obtain-shell \
  --shell-hunter \
  --approve-risk intrusive \
  --validation \
  --max-modules 25 \
  --threads 3

agent explain <run_id>
sessions list

Quick decision matrix

Common errors and resolutions

1. ``Agent scope blocked target'' --- verify scope add and deny entries in the policy file.
2. ``--shell-hunter blocked'' --- add --approve-risk intrusive.
3. ``--http-replay active requires --approve-active-replay'' --- missing approval or incomplete policy.
4. ``Invalid agent policy'' --- invalid JSON/TOML syntax or incorrect path.
5. Silent LLM --- run agent doctor; verify Ollama and --llm-budget.
6. Modules ignored in safe --- normal; switch to discreet or normal if the mandate allows it.

Reference tasks