# AI use cases for Redcell (martian56/redcell) Repo: [martian56/redcell](https://github.com/martian56/redcell) | Use cases: 3 | Page: https://dedupedai.com/use-cases/martian56-redcell/ REDCELL is an open-source platform where LLM agents run a penetration test end to end inside a Kali container and write the report. This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL. - Run an authorized pentest and export the report: https://dedupedai.com/use-cases/martian56-redcell/run-authorized-pentest-and-export-report/ - Practice web pentesting on vulnerable apps: https://dedupedai.com/use-cases/martian56-redcell/practice-web-pentesting-on-vulnerable-apps/ - Triage source code findings and export SARIF: https://dedupedai.com/use-cases/martian56-redcell/triage-code-scan-findings-to-sarif/ ## How to run an authorized pentest and export the report with Redcell Repo: [martian56/redcell](https://github.com/martian56/redcell) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Let REDCELL's agents test an approved target and export a PDF, JSON, and SARIF report. **Who it is for:** A security consultant with a signed scope who needs a first-pass engagement run and a draft report to review before handing it to the client. **The problem:** Running recon, scanning, and write-up by hand takes days, and findings often get lost between tools and notes. **The outcome:** An engagement run where the agents record hosts, findings, and loot, followed by a PDF, JSON, and SARIF export with an executive summary, methodology, findings, and prioritized remediation. ### Steps 1. Start the infrastructure with `docker compose -f docker-compose.dev.yml up -d`. 2. Install dependencies and set up the database with `uv sync --group live`, `uv run rc db upgrade`, and `uv run rc seed`. 3. Copy the env template with `cp .env.example .env`, then start the API with `cd apps/api && uv run uvicorn app.main:app --host 127.0.0.1 --port 8080`, the worker with `cd apps/worker && uv run arq worker.settings.WorkerSettings`, and the web app with `cd apps/web && bun install && bun run dev`. 4. Open http://localhost:5183, sign in with `admin` / `admin`, change that password, and add a provider API key in Settings. 5. Create a session for the approved target, set its execution server, model, and optional egress proxy, and start the run. 6. When the run finishes, triage findings (verify or dismiss, merge duplicates) and export the PDF, JSON, and SARIF report. ### Prompt to paste into your agent ```text Using the repo martian56/redcell, set up the local stack and run an engagement against only if written authorization for that exact scope is confirmed. Expected output: a PDF, JSON, and SARIF report exported from the session. Verify that dismissed findings are absent from the report and verified findings are marked. ``` ### Caveat The README warns that REDCELL runs real tools by default, so use REMOTE or sim mode (REDCELL_RUN_MODE=sim) for dry runs and confirm scope before any live run. Risk, credentials: The provider API key and any server credentials are stored in the database, so keep them out of shared logs and change the default admin password before use. Risk, reverse engineering: Agents open listeners and catch reverse shells on targets, so only run this against systems you are authorized to test. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/martian56-redcell/run-authorized-pentest-and-export-report/ ## How to practice web pentesting on vulnerable apps with Redcell Repo: [martian56/redcell](https://github.com/martian56/redcell) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README Aim REDCELL at local intentionally vulnerable apps to learn how agent-driven testing works. **Who it is for:** A student or CTF player who wants to see how an agent works through a web app without touching any real system. **The problem:** Practice labs are useful, but learning how a full engagement flows from recon to report is hard to see on your own. **The outcome:** A completed practice run against DVWA, Juice Shop, or WebGoat with a recorded attack surface, findings, and an exported report to compare with the known weaknesses. ### Steps 1. Start the infrastructure with `docker compose -f docker-compose.dev.yml up -d` and complete the setup commands in the Quickstart. 2. Start the local practice targets with `docker compose -f docker-compose.targets.yml up -d`. 3. Open http://localhost:5183, sign in with `admin` / `admin`, and add a provider API key in Settings. 4. Create a session with a target such as DVWA http://localhost:8081, Juice Shop http://localhost:3000, or WebGoat http://localhost:8082, and start the run. 5. Use the live console to watch the agent graph, activity feed, and browser, then compare the recorded findings against the known weaknesses of the app. ### Prompt to paste into your agent ```text Using the repo martian56/redcell, start the local practice targets from docker-compose.targets.yml and run a session against the Juice Shop at http://localhost:3000. Expected output: a list of recorded findings and an exported JSON report. Verify that the findings reference the local target and not any external host. ``` ### Caveat The practice targets are intentionally vulnerable, so keep them on localhost and do not expose them to a network you do not control. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/martian56-redcell/practice-web-pentesting-on-vulnerable-apps/ ## How to triage source code findings and export SARIF with Redcell Repo: [martian56/redcell](https://github.com/martian56/redcell) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README Review code-scan findings mapped to file and line, then export them as SARIF. **Who it is for:** An application security engineer reviewing a public git repo or a local folder before a release. **The problem:** Source code review findings arrive as a long list with duplicates, and the ones that matter need to reach the CI or issue tracker in a standard format. **The outcome:** A cleaned-up set of code findings, each tied to a file and line, with duplicates merged and dismissed items removed, exported as SARIF. ### Steps 1. Start the stack by completing the Quickstart: `docker compose -f docker-compose.dev.yml up -d`, `uv sync --group live`, `uv run rc db upgrade`, and `uv run rc seed`. 2. Start the API, worker, and web app, then open http://localhost:5183 and sign in with `admin` / `admin`. 3. Create a code-scan session that points at a public git repo URL or a local folder. 4. Verify the findings that are real, dismiss the false positives, and merge duplicates the agent recorded twice. 5. Export the report in SARIF format from the session. ### Prompt to paste into your agent ```text Using the repo martian56/redcell, create a code-scan session for and run it. Expected output: a SARIF file where each finding has a file and line. Verify that no dismissed finding appears in the export. ``` ### Caveat The README describes code-scan sessions only for public git repos or local folders, so private repos need a local copy first. Dual-use notice: only use this on software, sites and systems you own or are authorized to test. Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/ URL: https://dedupedai.com/use-cases/martian56-redcell/triage-code-scan-findings-to-sarif/