outrider-recon
Claude-native external recon and attack-surface management for authorized bug bounty, pentest, and security teams.
Outrider turns public, read-only recon signals into prioritized, evidence-backed leads. It combines Claude skills, deterministic local controls, optional MCP enrichment, and report scaffolding so operators can understand what exists, why it matters, and where to safely continue.
Outrider is intentionally not an exploitation framework. It is a navigation and control layer for authorized external recon: map the surface, preserve evidence, rank likely attack paths, and hand off to the right next workflow.
Table of contents
- Overview
- Quick start
- How it works
- Capabilities
- Example output
- Installation
- Implementation status
- Releases and versioning
- Current release candidates
- Documentation
- Project structure
- Authorization and security
- About
Overview
Most recon tooling tells you what exists: subdomains, ports, URLs, technologies, leaked files, and scanner output. Outrider focuses on the next question:
What matters first, and why?
Use Outrider to:
- map an organization's authorized external attack surface;
- organize web/API, identity, cloud, SaaS, secrets, people, breach, and public-code signals;
- compare observations against public bug-bounty and attack-path patterns;
- rank leads by confidence, severity, detectability, and operator value;
- preserve local evidence and produce finding cards, technique cards, and report-ready notes;
- keep recon decisions inside deterministic scope, state, approval, and evidence controls.
Outrider fits between raw discovery tools and active testing:
Outrider Recon → ranked leads / technique cards → proxy-assisted testing, manual validation, ASM tickets, or remediation
Quick start
Install the web extra and run outrider to start the local browser portal:
python -m pip install -e ".[web]"
outrider
The browser is the normal human interface. Use the guided wizard to create an authorized engagement, then choose Review Scope. CLI subcommands remain available for advanced automation and recovery. Discovery enrichment is disabled unless outrider --enable-mcp-enrichment is used.
This is the minimum successful path. For complete setup options, see Installation and Usage.
1. Install the Claude skills
git clone https://github.com/Ap6pack/outrider-recon.git
mkdir -p ~/.claude/skills
cp -r outrider-recon/skills/* ~/.claude/skills/
2. Install or download the Python CLI
From a source checkout:
cd outrider-recon
python -m pip install -e .
For release artifacts and checksum verification, see Release documentation.
3. Initialize a run
outrider init example.com \
--actor authorized-operator \
--authorization-reference EXAMPLE-ROE-001
4. Perform one scope check
outrider scope-check runs/example.com api.example.com
5. Continue with detailed usage
Use docs/usage.md for command workflows, Claude prompts, state transitions, evidence handling, approvals, contracts, finding promotion, reporting, and operational patterns.
How it works
Scope → Recon → Enrich → Score → Finding Cards → Handoff → Report
- Claude skills provide methodology, routing, operator checklists, scoring guidance, and report structure.
- Python controls provide deterministic local enforcement for run identity, workflow state, scope checks, approval policy, evidence integrity, contract validation, and finding promotion.
- Optional MCP tools provide policy-gated live enrichment for bounded public-source lookups and DNS records.
- Optional web control plane provides a local browser interface for creating guarded runs, reviewing run folders, replacing initialized scope rules, checking scope candidates, applying guarded workflow-state transitions, granting/revoking bounded approvals, checking action policy, inventorying artifact metadata, registering existing artifacts as evidence, and verifying evidence integrity; see web review/control details.
The design keeps reasoning and enrichment separate from durable authorization, scope, evidence, and finding records. See Architecture, Contracts, and the ADRs under docs/adr/ for details.
Capabilities
The current content bundle includes 11 implemented Claude skills, 90 documented capabilities, 48 secret patterns, 70 dorks, 9 read-only validator procedures, 35 attack-path templates, and an optional MCP server for live enrichment.
Capability areas include:
- external asset discovery and surface mapping;
- web, API, JavaScript, documentation, and bucket review;
- identity fabric, SSO, SaaS, cloud, CI/CD, and package-registry signals;
- secrets, public-code, dorking, breach, and people intelligence;
- public disclosure research and bug-bounty technique references;
- evidence-backed analysis, scoring, finding cards, handoff notes, and reports.
See Capabilities for the complete inventory and Coverage for practitioner coverage by engagement phase.
Example output
A useful recon workflow should not end with a flat list of hosts. Outrider aims to produce ranked, evidence-backed leads like this:
[HIGH] api.acme.example exposes OpenAPI schema
Confidence: Confirmed
Evidence: GET /openapi.json returned 200; schema includes user/account/order paths
Why it matters: API schema reveals object identifiers and hidden write endpoints
Public report intelligence: similar disclosed reports map to IDOR, mass assignment, and broken authorization patterns
Recommended handoff: hunt-api-misconfig, hunt-idor, Burp Repeater authorization testing
Safe next step: verify auth requirements and object-level authorization without modifying production data
See examples/05-sample-output.md for a fuller sanitized example.
Installation
Outrider has separate install paths for Claude skills, the Python CLI, optional web extras, and optional MCP server dependencies. The base Python package installs deterministic local controls and the CLI; web control-plane dependencies are installed with the web extra; MCP dependencies are installed from mcp-server/requirements.txt in a source checkout.
Use docs/installation.md for supported install patterns, including one-click install, manual Claude Code setup, editable Python installs, web extras, MCP setup, updates, and uninstall steps.
Implementation status
Outrider currently has four implementation domains:
- Claude skill layer: implemented and used as the primary operator-facing capability layer.
- Python CLI controls: implemented for run scaffolding, local scope/state/evidence/approval/contract/finding checks, and guarded local review and control support.
- Optional MCP enrichment: implemented for bounded, policy-gated enrichment tools that require explicit run context before network or DNS activity.
- Local web control plane: implemented as a loopback-only control interface with guarded run creation, initialized-only scope replacement, browser scope checks, guarded workflow-state transitions, guarded approval grant/revocation, action-policy checks, metadata-only artifact inventory, existing-artifact evidence registration, evidence-integrity verification, guarded skill request creation, and request/result contract validation; artifact transfer, evidence editing/deletion, result creation/upload, automatic finding promotion, finding editing/deletion, result upload, skill execution, report generation, exports, arbitrary MCP servers, and recon remain unsupported in the browser. Explicit human finding promotion and explicitly enabled fixed MCP invocation are supported.
The repository does not claim to execute full automated recon on its own. It is a controlled harness for authorized recon workflows and safe handoff. See Architecture, Web review plane, and Release readiness for the current product boundary.
Releases and versioning
Outrider uses independent version domains:
- Python package:
0.3.0
- Claude plugin/content bundle:
3.1.0
- individual skill frontmatter versions: independent
- JSON contract schema version:
1
Do not assume the Python package version and Claude plugin/content version move together. Future GitHub release artifacts are checksum-verifiable, but this repository does not claim cryptographic signing or PyPI / Claude Marketplace publication in this PR.
See Release documentation for version domains, artifacts, checksums, and release notes. See Release readiness for maintainer-facing release checks.
Current release candidates
Python 0.3.0 and Claude plugin/content 3.1.0 are prepared as unsigned release candidates. Future tags are python-v0.3.0 and plugin-v3.1.0. The same SHA256SUMS file covers all three candidate artifacts across both release domains; the manual release-candidate workflow does not publish automatically.
Documentation
| Guide | Purpose |
|---|
| Installation | Claude skills, Python CLI, web extras, and MCP setup |
| Usage | Commands, prompts, and operator workflows |
| Architecture | Responsibility boundaries and deterministic controls |
| Capabilities | Complete capability inventory |
| Coverage | Practitioner coverage by workflow and engagement phase |
| Web control plane | Local control interface with guarded run creation, scope management, scope checks, and workflow-state transitions |
| Contracts | Skill request/result interchange |
| MCP server | Optional policy-gated enrichment server |
| Release documentation | Versions, artifacts, and checksum verification |
| Release readiness | Maintainer release checks and readiness status |
| Security | Authorization and prohibited-use boundaries |
Key architecture decisions are captured in docs/adr/, including run state, evidence integrity, approvals, MCP boundaries, contracts, finding promotion, and guarded web control-plane increments. Additional material lives in docs/methods/, docs/reference/, examples/, and tests/smoke-test-prompts.md.
Project structure
outrider-recon/
├── skills/ # Claude skills and shared run guidance
├── outrider/ # Python CLI and deterministic local controls
├── mcp-server/ # Optional MCP enrichment server
├── contracts/ # Skill request/result schemas and docs
├── docs/ # Installation, usage, architecture, ADRs, releases
├── examples/ # Walkthroughs and sanitized output examples
├── tests/ # Smoke prompts and automated tests
├── assets/ # README and project assets
├── SECURITY.md # Authorization and prohibited-use posture
└── README.md # Public landing page and documentation hub
Authorization and security
Outrider is for assets you own or have written authorization to assess, such as red-team rules of engagement, bug-bounty in-scope assets, ASM contracts, and internal security assessments.
The project is built around read-only recon and safe handoff. It explicitly excludes unauthorized testing, credential abuse, destructive validation, malware, persistence, evasion, uncontrolled exploitation, and internal post-exploitation. Deterministic Python controls and optional MCP policy checks help keep local decisions aligned with scope, state, approval, and evidence requirements.
See SECURITY.md for the full security posture and prohibited-use boundaries.
The local portal now guides new engagements through scope review, explicit scope confirmation, Begin Discovery, and server-derived next-action cards. It still does not provide task-oriented discovery execution, automatic evidence capture, or Claude execution in the browser.
About
Outrider codifies external attack-surface tradecraft into Claude-native skills, local deterministic controls, and reviewable evidence workflows. It is engagement-platform agnostic: slot it into the ASM, ticketing, asset-graph, bug-bounty, or pentest workflow you already use.
Author: Ap6pack
Forked from: elementalsouls/Claude-OSINT
Original framework: SnailSploit/offensive-checklist (v1.x)
Inspired by: Bellingcat's Online Investigations Toolkit · IntelTechniques · OSINT Framework
Tool inventory: ProjectDiscovery · Six2dez reconftw · SecLists · Assetnote Wordlists
License: MIT — use freely, attribution appreciated.
Raw recon tells you what exists. Outrider helps decide what matters first.
