Skip to content

Back to the catalog

0xtbug/Recat
github.comrepo

0xtbug/Recat

Recat is a local, Bun-based web workspace for reviewing security findings, including ones produced by AI agents such as Hermes, Codex and Claude Code. It reads a folder of finding.json, README and PoC evidence per project, and offers a dashboard by severity, status and asset coverage (web, smart contract, mobile, desktop, network, hardware). It also has filters by vulnerability class, an evidence viewer, JSON and ZIP exports, password-protected access with a censored view, and a SKILL.md reporting skill that lets agents write findings straight to the source folder.

TL;DR Local dashboard for triaging, evidencing and exporting vulnerability findings, with agent skills so Codex, Claude Code and Hermes can file reports.
Open original ↗
Document

What it is

Recat (github.com/0xtbug/Recat) is a local Bun web app for reviewing security findings that agents write to disk. Its main value for an engineer is the operational detail: where it reads from, how agents publish to it, and how access is controlled.

How it works

Recat polls a source folder every five seconds. The default is ../finding/source, relative to the web repository, and it can be changed in Settings. Each finding is a directory:

finding/source/
  project-name/bug/finding-name/
    finding.json
    README.md
    poc/

Agents publish by writing files straight into that folder. The page says no Recat password is needed to publish, only filesystem access, or shared storage if the agent runs on another machine. The page says Recat displays reported results and preserves the original records.

Source settings are saved in ../.recat/settings.json.

Preconditions / Affected

  • Bun is required.
  • Run commands from the directory containing package.json (frontend/ in this workspace).
  • A running server with access to the findings folder is required.
  • The production server binds to 127.0.0.1:5173, so it is local only. PORT overrides the port.

What to do

Manual setup: create .env from .env.example and set RECAT_PASSWORD. Keep an existing configuration. The password is server-only, so do not give it a VITE_ prefix.

bun install
bun run dev

Dev mode serves on the local URL Vite prints, normally http://127.0.0.1:5173.

Production:

bun run build
bun run start

Checks:

bun test
bun run lint
bun run build

Agent integration:

  1. Set the source folder in Recat Settings.
  2. Open Agent integration → Download SKILL.md, or use skills/SKILL.md and set its Active source folder to the same absolute path.
  3. Install that single file in the agent's skills location. The Codex example is $HOME/.agents/skills/recat-findings/SKILL.md. The page points to separate docs for the Claude Code and Hermes destinations.
  4. Start a new session and invoke $recat-findings in Codex, or /recat-findings in Claude Code or Hermes.
  5. Ask: "Use recat-findings to save this finding to Recat's configured source folder."

Codex install on PowerShell:

New-Item -ItemType Directory -Force "$HOME/.agents/skills/recat-findings"
Copy-Item "$HOME/Downloads/SKILL.md" "$HOME/.agents/skills/recat-findings/SKILL.md"

The page also offers a prompt that has an agent install and run Recat via the root SKILL.md. That workflow installs missing prerequisites, generates a local password if none is set, preserves existing data and settings, runs tests and the build, starts the server, and reports the URL, install directory, password file path and restart instructions.

Caveats

  • The password gates viewing in the UI only. Anyone or anything with write access to the source folder can add findings without it, so folder permissions are the real control on what gets published.
  • Keep any customized skill before replacing it with a new SKILL.md.
  • The agent-driven install prompt lets an agent install software and write a password, so review what it does.
  • The page defers JSON schema, evidence path and import rules to a "findings reference" and does not reproduce them here.

Technologies named here

Related in Offensive Security