{
 "schema_version": 1,
 "generated": "2026-10-20",
 "id": "martian56-redcell--run-authorized-pentest-and-export-report",
 "repo": "martian56/redcell",
 "repo_url": "https://github.com/martian56/redcell",
 "repo_slug": "martian56-redcell",
 "title": "Run an authorized pentest and export the report",
 "page_title": "How to run an authorized pentest and export the report with Redcell",
 "summary": "Let REDCELL's agents test an approved target and export a PDF, JSON, and SARIF report.",
 "who": "A security consultant with a signed scope who needs a first-pass engagement run and a draft report to review before handing it to the client.",
 "problem": "Running recon, scanning, and write-up by hand takes days, and findings often get lost between tools and notes.",
 "outcome": "An engagement run where the agents record hosts, findings, and loot, followed by a PDF, JSON, and SARIF export with an executive summary, methodology, findings, and prioritized remediation.",
 "steps": [
  "Start the infrastructure with `docker compose -f docker-compose.dev.yml up -d`.",
  "Install dependencies and set up the database with `uv sync --group live`, `uv run rc db upgrade`, and `uv run rc seed`.",
  "Copy the env template with `cp .env.example .env`, then start the API with `cd apps/api    && uv run uvicorn app.main:app --host 127.0.0.1 --port 8080`, the worker with `cd apps/worker && uv run arq worker.settings.WorkerSettings`, and the web app with `cd apps/web    && bun install && bun run dev`.",
  "Open http://localhost:5183, sign in with `admin` / `admin`, change that password, and add a provider API key in Settings.",
  "Create a session for the approved target, set its execution server, model, and optional egress proxy, and start the run.",
  "When the run finishes, triage findings (verify or dismiss, merge duplicates) and export the PDF, JSON, and SARIF report."
 ],
 "agent_prompt": "Using the repo martian56/redcell, set up the local stack and run an engagement against <target> only if written authorization for that exact scope is confirmed. Expected output: a PDF, JSON, and SARIF report exported from the session. Verify that dismissed findings are absent from the report and verified findings are marked.",
 "agents": [
  "any"
 ],
 "difficulty": "Intermediate",
 "time": "1 hour",
 "basis": "readme",
 "caveat": "The README warns that REDCELL runs real tools by default, so use REMOTE or sim mode (REDCELL_RUN_MODE=sim) for dry runs and confirm scope before any live run.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "python",
 "requirements": [
  "Docker installed and able to pull the Kali image ghcr.io/martian56/redcell-kali:latest",
  "uv and bun installed for the Python and frontend processes",
  "A provider API key added in the Settings page (any LiteLLM-supported model)",
  "Written authorization and a defined scope for every target you test"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "The provider API key and any server credentials are stored in the database, so keep them out of shared logs and change the default admin password before use."
  },
  {
   "tag": "reverse-engineering",
   "notice": "Agents open listeners and catch reverse shells on targets, so only run this against systems you are authorized to test."
  }
 ],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/martian56-redcell/run-authorized-pentest-and-export-report/",
 "md": "https://dedupedai.com/use-cases/martian56-redcell/run-authorized-pentest-and-export-report/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/martian56-redcell--run-authorized-pentest-and-export-report.json",
 "api_version": "v1"
}