JC·HARNESS
dry-run first · protected real runs

Multi-model penetration testing harness for the AI era

A staged Hunt → Validate → Score cockpit wraps the real Jean-Claude runner across 44 attack classes spanning 9 security frameworks — from OWASP Top 10:2025 and MITRE ATLAS to MCP, RAG, and agentic threats.

Start Authorized Assessment View coverage matrix
Fable 5Claude Opus 4.8GPT-5.5
Total Runs
118$3.25 spend to date
Findings
1612 confirmed by validator
Class Coverage
100%44 / 44 classes scanned
Avg Run Cost
$0.0276per pipeline execution
Severity Distribution
Critical0
High0
Medium6
Low10
Info0
Framework Coverage
OWASP
7 / 11
MCP
0 / 8
RAG
0 / 4
Agentic
4 / 7
ATLAS
0 / 2
API
0 / 5
BLA
0 / 1
NHI
2 / 4
LLM
3 / 2
Recent Runs
View all →
pentest-2026-06-14-a39c81cdmbarbine/jc-pentest-harness
0 findings
pentest-2026-06-13-d1bca080mbarbine/jc-pentest-harness
0 findings
pentest-2026-06-13-a8865ae5mbarbine/jc-pentest-harness
0 findings
pentest-2026-06-13-a17614cembarbine/jc-pentest-harness
0 findings
pentest-2026-06-13-6dadaeaembarbine/jc-pentest-harness
0 findings
Top Findings
View all →
MEDIUMconfirmedf6b87aaf
tier1Gate TOCTOU: non-atomic check-then-reset enables concurrent runsExcessive Agency
MEDIUMconfirmed96087558
Auto-gapfill routes around model safety refusals with no human checkpointAgent Identity Abuse
MEDIUMconfirmed0e4cb3fc
tier1Gate reset swallows failure silently — gate can remain armedAgent Goal Hijacking
MEDIUMconfirmedc0ad509a
Boot prompt YES/NO natural-language flow has no provenance bindingInjection
LOWconfirmed9dde3a1c
Default executionMode in example config is api-multi-model (live API)Security Misconfiguration
LOWconfirmed491f5285
Example budget caps default to $5/$25 — should default to $0Security Misconfiguration