Core Capabilities
AI Agent Swarm Architecture, Sandboxed Execution Environment, Target Support, and Deep Scan Assessment.
AI Agent Swarm Architecture
Syphax runs a hierarchical multi-agent system rather than a single AI model. When a scan starts:
- A root agent coordinates the overall engagement
- Specialist sub-agents are spawned for each application component (auth system, payment gateway, admin panel, API layer, etc.)
- Each component agent further spawns vulnerability-specific agents (SQLi agent, XSS agent, SSRF agent, auth bypass agent, etc.)
- All agents run concurrently, maximising coverage and minimising scan time
This architecture means Syphax scales horizontally — complex applications get more agents, not slower scans.
Sandboxed Execution Environment
Every scan runs inside an isolated Docker container (Kali Linux base) provisioned per scan. The sandbox includes:
- Full offensive security toolkit: Nmap, Nuclei, httpx, Gobuster, Arjun, TruffleHog, Semgrep, Trivy, Wapiti, ZAP, Retire.js, and more
- Caido web proxy for intercepting and replaying HTTP traffic
- Playwright for browser-based testing of JavaScript-heavy applications
- Python scripting environment for custom exploit development
- Automatic cleanup after scan completion — no state leaks between scans
Target Support
| Target Type | Examples |
|---|---|
| Web application | https://app.example.com |
| API | https://api.example.com/v1 |
| GitHub repository | https://github.com/org/repo (cloned into sandbox) |
| Domain | example.com (with subdomain enumeration) |
| IP address | 192.168.1.1 (with port scanning) |
For repository targets, Syphax clones the codebase into the sandbox workspace and performs whitebox analysis — tracing code paths, reviewing authentication logic, identifying secrets, and testing business logic from the source.
Deep Scan Assessment
Syphax runs an exhaustive, multi-phase engagement across five phases. See Deep Scan Assessment for full details.