Adaptive investigation with your AI coding agent.
Hunt is ShakerScan’s AI-assisted investigation workflow. Your current Codex, Claude Code, or OpenCode session plans the investigation of one registered, authorized target, while ShakerScan fixes the scope, capabilities, budgets, approvals, execution, and evidence collection. The agent session is the planner, so no separate LLM API key is stored in ShakerScan.
Hunt ships in the current release. Its measured investigation efficacy is still release-gated and documented in the repository; treat AI-generated leads as hypotheses until deterministic proof confirms them.
Who it is for. Penetration testers and security engineers who want an AI research partner inside a controlled execution environment, not an unattended scanner.
What problem it solves
Traditional automated scanners are good at repeatable checks but do not adapt to what they see. AI agents adapt to context but need boundaries, tools, and evidence, or their conclusions cannot be trusted.
Hunt combines both. The human owns scope, objectives, and final judgment. The AI observes, hypothesizes, investigates, and proposes the next action. ShakerScan decides whether an action is allowed, executes it safely, keeps the target model durable across context windows, and records proof.
The goal is to make a skilled human tester materially more effective, not to replace expert judgment.
How it works
- 01Register the authorized target and confirm authorization. Active Hunt capabilities also need a target-bound approval, either a standing, revocable target authorization or an expiring one, revalidated on every call.
- 02Launch your coding agent inside the ShakerScan runtime with shakerscan agent codex, claude, or opencode, then ask it to run a Hunt on the registered target.
- 03The agent reads a redacted target context, composes its own same-origin probes, queries stored endpoints, findings, leads, and principal state, and runs bounded active scanner templates when authorized.
- 04When managed principals are configured, it can compare responses across controls and principals, for example anonymous versus authenticated behavior.
- 05The agent records only findings backed by tool-output evidence. Suspected findings become Verified only through ShakerScan’s deterministic proof workflows.
- 06Hunt is methodology-first: it starts with no methodology, asks for at most three metadata-only suggestions drawn from shared target knowledge, reads exactly one, and binds it only when used. Methodology never changes target, approval, or budget authority.
What you get
- Leads: a hypothesis backlog the agent and the verifier work from.
- Evidence-backed investigation candidates, which become Verified findings only through deterministic proof, including persisted cross-principal (BOLA) authorization proof.
- A durable investigation record that survives any single AI context window, searchable in Hunt history.
- A Hunt record export with explicit capability decisions and the final debrief, never hidden model chain-of-thought.
- Separate exports of Hunt HTTP transactions, redacted by default.
Example workflow
$ shakerscan agent claude> Run a Hunt on this registered staging target.> Show active high findings from this hunt.> Send the SQL injection lead to deterministic verification.
Security and authorization
- Hunt requires explicit confirmation that the target is owned or authorized, plus a live target-bound approval that is revalidated on every call.
- Every Hunt keeps hard ceilings for capability calls, requests, active actions, wall time, ports, hosts, browser actions, device fragility, and candidates.
- Arbitrary state-changing HTTP is blocked in the free-form loop. Controlled mutations belong to typed workflows with cleanup, restoration, and proof contracts.
- Credentials stay server-side. The agent never sees stored secrets.
- Data handling for the AI side depends on the coding agent and model provider you configure. An administrator can disable every gated AI execution path with a single environment setting.
Limitations
- Hunt needs an installed and signed-in Codex, Claude Code, or OpenCode session. It does not run without a coding agent.
- AI leads are evidence-cited hypotheses, not findings, until deterministic proof promotes them.
- The repository documents Hunt’s measured investigation quality and the pending release acceptance for that quality bar. Read that material before relying on Hunt for coverage claims.
- An investigation can run for minutes or hours and consumes the agent provider’s tokens. Budgets bound the work, not the wall clock of your review.
Get started
- 01Install ShakerScan and add the authorized target under Targets.
- 02Run shakerscan agent codex (or claude, or opencode) so the agent loads ShakerScan’s instructions and skills.
- 03Ask: “Run a Hunt on this authorized target.” Confirm the approval prompt.
- 04Review leads and findings in AI Investigator → Hunt, then send claims to deterministic verification.