How to use RiftX: what you can do with it

4 use cases

• Validate web app findings with linked browser evidence

  Confirm suspected web issues in a scoped app and link each finding to requests, screenshots, and quotes.

  • REPO Ch1nfo/RiftX
  • Security and science
  • Advanced
  View prompt

  Using RiftX, validate the suspected issue at <target-url> within the authorized browser scope. Produce a list of findings, each linked to browser requests and screenshots with confidence and reproduction notes. Verify that every finding cites at least one captured request or screenshot before you report it.

  Share Email me this

• Map an app's attack surface with parallel child agents

  Crawl an in-scope app into an inventory, then split review work across child agents on a shared board.

  • REPO Ch1nfo/RiftX
  • Security and science
  • Advanced
  View prompt

  In RiftX, run the crawl tool on the authorized target <target-url> and build a board of review tasks from the inventory. Return the task list with owners, status, and evidence references. Verify that no task is marked complete until the main Agent has accepted the child result.

  Share Email me this

• Test access control with isolated browser identities

  Compare anonymous, low-privilege, and high-privilege sessions side by side to find broken access control.

  • REPO Ch1nfo/RiftX
  • Security and science
  • Advanced
  View prompt

  Using RiftX identities, compare access to the restricted endpoints of <target-url> for the anonymous, low-privilege, and high-privilege accounts I authorize. Produce a table of endpoint, identity, status, and captured evidence. Verify that each identity used its own isolated cookies and storage before you report a result.

  Share Email me this

• Research known vulnerabilities for a fingerprinted product

  Look up public CVEs and advisories for a product version found during testing, with queries screened first.

  • REPO Ch1nfo/RiftX
  • Security and science
  • Intermediate
  View prompt

  In RiftX, research known vulnerabilities for <product-name> version <version-string> using web_search and web_fetch. Return a list of CVE ids, sources, and whether each one matches the fingerprint. Verify that no query contains credentials, tokens, or target-specific secrets.

  Share Email me this

Quick start with RiftX

1. Check you have what it needs: Written authorization from the owner of the target system, with a defined scope; A local machine where you can run the RiftX app (the README badges reference Node.js, Next.js, and React); A model provider key for OpenAI, Anthropic, Google, or a compatible endpoint.
2. Open Ch1nfo/RiftX on GitHub and read the README and license.
3. Set up RiftX and add a model provider key in settings.
4. Create a session and define the browser scope for the authorized target, using host, wildcard domain, or URL rules.
5. Ask the Agent to navigate the target and test the suspected issue, watching tool calls and approvals in the workbench.
6. Review the browser requests, console output, and screenshots the Agent collected for each claim.

These steps come from our top use case, Validate web app findings with linked browser evidence, which also has a copy-paste agent prompt.

Using the Deduped MCP, get the setup steps for Ch1nfo/RiftX

claude mcp add --transport http deduped https://dedupedai.com/mcp

RiftX alternatives · Best AI repos for Security and science

About this repo

• Who it is forWeb security testers and penetration testers who hold written authorization for the target and want an agent to do browser-backed validation with reviewable evidence.
• Why it is hot105 stars, launched 68 days ago
• LanguageTypeScript
• Sourcegithub.com/Ch1nfo/RiftX · Back to Hot repos

Requirements

• Written authorization from the owner of the target system, with a defined scope
• A local machine where you can run the RiftX app (the README badges reference Node.js, Next.js, and React)
• A model provider key for OpenAI, Anthropic, Google, or a compatible endpoint
• Playwright and Chromium available for the browser tool

Related repos

• Trended earlier REPO Elite588/Hacker Hacker Elite588/Hacker is a curated collection of cybersecurity references, scripts, tools, labs, and training material, maintained by Omar Santos as supplemental material for his books, courses, and live training.
• Trended earlier REPO inin-zou/codex-privacy-hud Codex Privacy Hud A local-first Codex plugin that records hook observations in a session ledger, shows a privacy HUD for each session, and can deny or rewrite tool input before it runs.
• Trended earlier REPO Mah3Sec/ForgeGuardian Forge Guardian ForgeGuardian is a local-first, Go-based software supply chain security scanner that checks project dependencies across 9 ecosystems with 8 scan engines.