Skip to content

Back to the catalog

RAPTOR
github.comrepo

RAPTOR

RAPTOR is an autonomous offensive/defensive security research framework built on top of Claude Code that chains static analysis (Semgrep, Coccinelle, CodeQL), binary analysis (radare2, Frida, Z3-based exploit feasibility), LLM-driven multi-stage vulnerability validation, exploit PoC generation, and patch writing into a single workflow against source code or compiled binaries. It also includes an /sca supply-chain command that enriches dependency findings with OSV, CISA KEV, EPSS, and SSVC data and emits CycloneDX SBOMs, and sandboxes LLM-generated/untrusted code execution using Linux namespaces, Landlock, and seccomp. Authored by Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), Michael Bargury, and John Cartwright, it ships 200+ custom static analysis rules and supports multi-model LLM analysis (Claude, GPT, Gemini, Ollama).

TL;DR Claude Code-based autonomous framework that chains SAST/binary analysis with LLM validation to find, exploit, and patch vulnerabilities, plus a supply-chain SCA scanner.
Open original ↗
Document

What to do

Install and launch:

git clone https://github.com/gadievron/raptor.git
cd raptor
pip install -r requirements.txt
npm install -g @anthropic-ai/claude-code
pip install semgrep
export PATH="$PATH:$PWD/bin"
raptor

Use the raptor launcher, not plain claude. The launcher resolves the install, remembers your launch directory (so /scan defaults to it), runs pre-flight trust/project checks, loads coverage tracking, and sanitises the environment. It accepts a target path plus --project, --continue, --model (see raptor --help). Gotcha the summary omits: RAPTOR loads config from the repo directory only. Running claude from anywhere else silently gives you plain Claude Code, not RAPTOR — a failure mode the launcher avoids.

For sandboxed runs, pull or build the container (≈6 GB, based on the Microsoft Python 3.12 devcontainer):

docker pull danielcuthbert/raptor:latest
docker build -f .devcontainer/Dockerfile -t raptor:latest .
docker run -it -v "$(pwd):/workspaces/raptor" raptor:latest

Mount a target with a second -v /path/to/target-folder:/workspaces/target. Add --privileged only if you need the rr deterministic debugger. The repo must be mounted at /workspaces/raptor.

Preconditions

  • Claude Code with an active subscription (Max, Pro, Team, Enterprise) or an Anthropic API key — this is the orchestration layer; RAPTOR runs inside a Claude Code session.
  • Python 3.10+ and Node.js 18+; Semgrep required, CodeQL optional but recommended.
  • Multi-model analysis (Claude + GPT + Gemini) needs a separate API key per provider. By default Claude Code alone handles the analysis-dispatch layer with no extra keys.

Caveats

  • Licensing: RAPTOR is MIT, but CodeQL carries its own licence that does not permit commercial use — relevant if you enable the optional CodeQL path in a commercial engagement.
  • The authors state it is "not polished software… held together with enthusiasm and duct tape." Treat it as a research tool, not production tooling.
  • The codebase is mostly AI-generated; humans set direction and review, with tests, static analysis, and corpus calibration as the quality gate. Factor that into your own review before running it against sensitive targets.
  • Full name: Recursive Autonomous Penetration Testing and Observation Robot; page version marker is v3.1.0.

Organisations named here

  • Daniel Cuthbert
  • Gadi Evron
  • John Cartwright
  • Michael Bargury
  • Thomas Dullien

Technologies named here

  • RAPTOR
  • Claude Code
  • Semgrep
  • CodeQL
  • Coccinelle
  • Z3
  • radare2
  • Frida
  • YARA
  • Playwright
  • OSV
  • CISA KEV
  • EPSS
  • CISA Vulnrichment/SSVC
  • rr
  • GitHub API / GH Archive / Wayback Machine
  • Docker devcontainer
  • SARIF
  • CycloneDX

Techniques named here

  • SQLi
  • Cross-site scripting
  • SSRF
  • SSTI
  • Command injection
  • Insecure deserialisation
  • XXE
  • LDAP/NoSQL injection
  • Path traversal
  • Open redirect
  • Log/header injection
  • Eval injection
  • ReDoS
  • Prototype Pollution
  • JWT misconfiguration
  • Weak crypto / insecure TLS
  • Hardcoded secrets
  • Double free / use-after-free
  • Integer overflow / sign extension / double sizeof
  • Resource leaks
  • Buffer handling bugs
  • TOCTOU races
  • Format string injection
  • Integer truncation
  • Use-after-move
  • Iterator invalidation
  • Binary exploit feasibility assessment / one-gadget analysis
  • Fuzzing
  • Exploitation-validator methodology
  • Threat Modeling
  • Attack surface mapping
  • Supply-chain/dependency analysis
  • OSS forensics investigation

Related in AppSec