mirror of
https://github.com/yogeshojha/rengine.git
synced 2026-10-20 07:11:28 +02:00
Yogesh OjhaandClaude Opus 5
28fc09b6c8
A connector is a pipe between a web proxy and reNgine. It records what a person browses while testing, says what they missed without sending a packet, and scans only what they agree to. connectors/ is a top-level package mounted into the api, plug-and-play the way stages, report sections and MCP tools are: one directory per proxy, auto-discovered. Burp and Caido ship. Auth reuses the MCP service-token model (rngconn_, SHA-256 at rest, project-bound, revocable) behind the per-endpoint failure limiter as well as the global throttle. Scope belongs to the moment of testing, not to the connection, so the proxy carries a Working on picker filled from reNgine. A chosen target wins over hostname matching; an unmatched request is kept and marked unassigned rather than discarded, and adding the target later attaches everything already recorded under it. The bridge runs both ways. reNgine hands back queued work the proxy collects and opens in Repeater, the scope rules for a target or a whole bug bounty program, what it already knows about the host being tested, and notices worth hearing while the tester is still testing. A finding confirmed by hand is reported from the proxy and stored with its own provenance, so triage, is:new, reports and compliance all apply to it. Out-of-scope detection is the one that matters: any request to a host a bug bounty program forbids is flagged loud, and reNgine refuses to offer it as a target. clients/burp is the Montoya extension, Java with no runtime dependencies, in-tree while the ingest contract is still moving. Everything it uses is on Burp's free tier. Verified by scripts/connector_e2e.py (95 assertions) and walked as a pentester by scripts/connector_journey.py. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017t7ysDm1v8bzyc9945cd3Z