AutoBB Analyst

🇷🇺 Русская версия

Autonomous bug bounty agent driven by autobb reconnaissance. A Telegram bot forwards alerts and chat messages to Claude Code CLI, which actively pentests targets using recon data from autobbmcp and a persistent knowledge wiki.

The agent doesn't just summarize — it picks targets, runs real probes, reports only verified findings, and keeps its own wiki of programs, hosts, tech, techniques, findings and dead-ends across sessions.

Requirements

• Docker + Docker Compose
• autobbmcp checked out as a sibling directory (../autobbmcp)
• MongoDB with database autobbdb (populated by autobb) reachable from the host
• Claude Code CLI — installed and authenticated
• Telegram Bot Token (via @BotFather)

Quick Start

1. Clone and configure

git clone https://github.com/rivalsec/autobb-analyst && cd autobb-analyst
cp config.dist.yaml config.yaml

Edit config.yaml:

telegram:
  token: "123456:ABC-DEF..."        # token from BotFather
  chat_id: "-1001234567890"         # chat/group ID
  autobb_bot_id: 1871687898         # autobb bot user ID
  ignore_patterns:                  # optional: skip noisy messages
    - "Is something wrong with nuclei templates?"

claude:
  cli_path: "claude"
  timeout: 300

2. Generate Claude Code auth token

claude setup-token
echo "CLAUDE_CODE_OAUTH_TOKEN=<your-token>" > .env

Alternative: a non-Anthropic model (z.ai / GLM, etc.)

The bot can drive the CLI through any Anthropic-compatible endpoint instead of Anthropic — e.g. z.ai's GLM coding models. Set claude.base_url in config.yaml, use the provider's own model IDs, and put the provider key in .env under the name you reference via auth_token_env:

claude:
  model: "glm-5.3"                    # provider model ID (not an opus/sonnet alias)
  effort: "high"                      # GLM supports high / max
  base_url: "https://api.z.ai/api/anthropic"
  auth_token_env: "ZAI_API_KEY"       # env var (in .env) holding the provider key
  small_model: "glm-5.3-flash"        # optional: model for the CLI's background calls

echo "ZAI_API_KEY=<your-zai-key>" >> .env

When base_url is set, the subscription CLAUDE_CODE_OAUTH_TOKEN is dropped from the CLI's environment so it's never sent to the third-party endpoint. Leave base_url empty to use Anthropic (step 2 above).

3. Configure MongoDB (optional)

Edit .env.autobbmcp if your MongoDB is not on the default port:

MONGO_URI=mongodb://host.docker.internal:27017
MONGO_DB=autobbdb

4. Build and run

docker compose up -d
docker compose logs -f

autobbmcp is built from ../autobbmcp and runs in its own container. It connects to host MongoDB via host.docker.internal. The analyst container only talks to autobbmcp over the internal compose network.

claude_workdir is mounted from the host so agent instructions, slash commands, persistent memory and the knowledge wiki survive restarts and are editable without rebuilding the image.

Running without Docker

python -m venv venv
source venv/bin/activate
pip install -r requirements.txt
python bot.py

When running without Docker, start autobbmcp separately and update claude_workdir/.mcp.json with the correct URL.

How it works

1. Alert from autobb → the bot automatically invokes Claude Code with /analyze-alert <alert text>. The agent consults the wiki, queries the MCP server, actively pentests, and reports only verified findings.
2. Free-form user message → passed to Claude Code as-is.
3. Reply / quoted message → the quoted content is included as context in the user prompt.
4. On startup → any pending Telegram updates accumulated while the bot was offline are batched into one /analyze-alert call (avoids spamming the chat with one response per queued alert).
5. .txt attachments → downloaded and used as the message text (caption is ignored).

The agent uses stream-json Claude CLI output to log every tool use, thinking, and result in real time, and sends a "typing…" indicator in Telegram while working.

Included system tools inside the container

For active reconnaissance: nmap, dig / nslookup, whois, curl, wget, httpie, openssl, netcat, traceroute, ping, jq.

For JS-rendered pages, SPA apps, login flows and screenshots: Playwright (Python) with a bundled Chromium browser. The agent can drive a headless browser via inline Python when static HTTP tools aren't enough.

Agent workspace: claude_workdir/

Mounted from the host — persistent across container restarts. Contents:

• CLAUDE.md — the agent's system prompt (role, principles, available tools, wiki rules, response format).
• .mcp.json — MCP server config (autobbmcp endpoint).
• .claude/commands/ — slash commands:
  • /analyze-alert <text> — triggered on autobb alerts (wiki-first pentest flow).
  • /hunt [scope] — autonomous hunt cycle (pick a target, test, record).
• .memory/ — behavior rules (preferences, feedback).
• .wiki/ — domain knowledge base the agent maintains itself:
  • programs/ — per bug bounty program
  • hosts/ — per target host (tech stack, tested vectors, status)
  • tech/ — per technology (CVE status, common misconfigs)
  • techniques/ — reusable pentest playbooks
  • findings/ — archive of confirmed vulnerabilities (PoC required)
  • dead-ends/ — thoroughly tested hosts with nothing found (revisit rules)
  • INDEX.md — always-loaded root index with counts and rules

See claude_workdir/.wiki/<category>/README.md for each page template.

Configuration reference

telegram:
  token: "..."
  chat_id: "..."
  autobb_bot_id: 1871687898
  ignore_patterns:                 # substrings (case-insensitive) to ignore from autobb
    - "Is something wrong with nuclei templates?"

claude:
  cli_path: "claude"
  timeout: 300                     # Claude CLI timeout (seconds)
  model: "opus"                    # alias (opus/sonnet/haiku/fable) or full model ID; empty = default
  effort: "high"                   # low | medium | high | xhigh | max; empty = default

  # Optional — route through an Anthropic-compatible third-party provider (z.ai/GLM).
  # Empty base_url = normal Anthropic via CLAUDE_CODE_OAUTH_TOKEN.
  # base_url: "https://api.z.ai/api/anthropic"
  # auth_token_env: "ZAI_API_KEY"  # env var (in .env) holding the provider key
  # small_model: "glm-5.3-flash"   # model for the CLI's background calls (empty = model)

MongoDB connection is configured via .env.autobbmcp (for the autobbmcp container). Default values: MONGO_URI=mongodb://host.docker.internal:27017, MONGO_DB=autobbdb.