BugXHunter
The BugXHunter security-testing agent runner: a web UI for the
OpenCode coding agent, running on open-weight models (GLM-5.3 by default)
through SCX.ai. The UI follows bugxhunter.com's design system — a
macOS-style terminal window, the red-team palette (GitHub-dark surfaces with red, amber, cyan and
green accents) and Fira Code throughout. Started from the sovgov-poc chatbot designer.
- Runner — point it at a project folder and drive OpenCode's
build (edits + shell) or
plan (read-only) agent. Every file edit and shell command waits for your approval.
Markdown replies, collapsible tool calls and reasoning, per-turn token counts, and a
Changes view of what the agent edited (git repos only — OpenCode tracks changes via git).
- Playground — chat with any SCX, Anthropic (Claude), NVIDIA or OpenRouter model directly (no agent), with
tool-calling, JSON mode, an embeddings-backed knowledge base and browser voice. Also:
- Security presets (code review, threat modelling, AI system review, pentest planning,
diagram review, diagram drawing, tabletop exercises, CTF coaching, phishing, log triage,
vulnerability explaining) and compare mode (2–3 models side by side, with speed and tokens).
Every preset, the canvas and the agent work from one catalogue (
web/src/intel): OWASP Top
10:2025, API Security Top 10:2023, Top 10 for LLM Applications 2025, Top 10 for Agentic
Applications 2026, Mobile Top 10 2024, ASVS 5.0, WSTG 4.2, STRIDE, and MITRE ATLAS tactics,
techniques and mitigations for attacks on AI systems, so findings cite the same ids everywhere.
- Flag highlighting for CTFs and labs: anything matching the flag format (a regular expression
in the sidebar, default
flag{...} and the like) is marked in replies and tool output, in both modes.
- Images for vision models, and draw.io files (
.drawio, compressed or not, and
.drawio.svg) for any model: the file becomes an exact text outline of its zones, boxes,
legend colours and arrows, so labels are never misread.
- Diagrams in replies: a model writes a
```drawio spec and the app draws it as an
editable .drawio.svg (drawgen), checks it, and
can send the problems back for a fix.
- Threat-model canvas: build a model from a diagram or description, track findings,
scope and coverage, zoom and pan, export JSON,
findings.md, SVG or draw.io.
- Saved sessions: chats and canvases are sealed with the vault key on the runner
(Docker: the
runner-data volume), never in browser storage.
- Retired NVIDIA models (their endpoints answer 404) are found and hidden automatically.
Screenshots
The agent working in a project — live tool calls, reasoning, and a markdown summary:
Point it at any folder; resume past sessions; approve edits and commands as they happen. The key
vault's state and lock live in the sidebar footer:
Playground — compare SCX models directly with full generation controls:
Install
The quickest way, with Node 22+ installed, is the npm package (OpenCode comes with it):
npx bugxhunter # runs the agent on this machine; UI opens at http://localhost:8790
npx bugxhunter docker # the sandboxed stack instead (needs Docker Desktop): pulls the signed
# images for this version into ~/.config/bugxhunter/docker and starts them
npm i -g bugxhunter makes it a plain bugxhunter command; bugxhunter --help lists the
options (--port, --dir, --no-open; docker --slim|--full, docker down|logs|ps,
docker export <path> [dest]; vault reset). The current
folder becomes the default project. Then, in the sidebar: set up the vault with a
passkey, add your SCX.ai key as SCX_API, and connect GitHub.
The package is published by the release workflow with npm provenance: npm audit signatures
confirms it was built from this repository.
Requirements (from source)
- Node 22+
- OpenCode on
PATH: npm install here provides it, or npm i -g opencode-ai
- An SCX.ai key: in the vault (preferred), else
opencode auth login (choose
Other, provider id scx) or SCX_API in a .env here.
Run from source
npm install
npm run dev # backend :8790 + web :5190, with hot reload
npm start # or: the compiled app, the same way `npx bugxhunter` runs it (npm run build first)
Open http://localhost:5190 (dev) or http://localhost:8790 (npm start).
The backend starts its own OpenCode server on 127.0.0.1:8791 (it stops a stale one left on
that port by a previous run). Everything listens on localhost only. There are no passwords:
until you set up the vault the app is open, and from then on you sign in with the
vault's passkey.
Docker (sandboxed agent + login)
npx bugxhunter docker does all of this (any OS). By hand, from a checkout:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
