Decepticon — The Cyber Toolchain

Decepticon v1.6.0

Sun, 25 Oct 2026 01:25:14 GMT

Decepticon v1.6.0 persists per-thread AI controls and adds compaction thresholds, SSE recovery, and improved checkpoint diagnostics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Installs or updates to v1.6.0 via `decepticon update --channel latest`, pulling matching launcher, configuration, and versioned images in one step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Persists per-thread model, fallback, reasoning effort, and compaction controls across sessions, including a verified 4096-token compaction threshold. • Improves scoped checkpoint diagnostics, SSE recovery, and transcript navigation across CLI, web, and server surfaces. • Improves localized slash-command support inside the interactive CLI. • Aligns web and server workspace roots, preventing stale terminal socket handoffs. • Preserves private Plan and Red drafts and history across container recreation. • Switches Kali downloads to the official Kali CDN. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.5.2

Sun, 18 Oct 2026 10:49:16 GMT

Decepticon v1.5.2 lets new CLI engagements auto-generate RoE and jump straight into Red by supplying a name and target URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New CLI engagement creation prompts for an engagement name and target web URL, then automatically generates the RoE and its matching approval and opens Red for the first request — no scope JSON file, manual import/approval command, or Soundwave planning session required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Updates via `decepticon update --channel latest` now include a shipped-image version check to detect mismatched CLI image metadata at install time. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.5.0

Sat, 17 Oct 2026 11:26:59 GMT

Decepticon v1.5.0 adds session resume, Blue monitoring, scoped Red approval, and OpenAI-compatible gateway support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--resume` / `--continue` flags to restore scoped conversations and pending questions across sessions, with failed runs retaining pending input and cross-session queue isolation, plus a `/queue` command to manage waiting instructions between sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `/scope import --confirm` command to import reviewed scope, requiring explicit `/mode red approve` before granting execution authority. • Adds `/alerts` and `/status` commands for Blue Cell investigation details and connectivity monitoring during Red conversations, plus an independent Blue monitoring state with compact notifications during Red conversations. • Adds `decepticon doctor --json` for read-only diagnostics output. • Adds conversation export to Markdown or JSON formats. • Adds optional vendor-neutral OpenAI-compatible gateway support. • Adds persistent light/dark dashboard preference. • Name-only engagement creation now opens Red directly without requiring a plan. Breaking changes: • The new validation and role-purpose endpoints require the updated server — launcher and Docker images/configuration must be updated together. • Unscoped legacy conversations are now available only under `/sessions legacy` and require explicit linking to their engagement. • Existing workflow checkpoints retain their pinned source; to change a workflow, a new execution conversation must be created. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.4.3

Wed, 14 Oct 2026 03:31:49 GMT

Decepticon v1.4.3 adds mid-session mode switching via `/mode plan`, `/mode red`, and `/mode blue`, and streamlines engagement creation to name-only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `/mode plan`, `/mode red`, and `/mode blue` commands to switch conversations during a running session, preserving each mode's thread, pending question, and paused checkpoint; failure to pause keeps the original mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `/mode red approve` to grant execution permission for Red operations against the validated Plan scope. • Adds `/resume` command to reopen a paused question after escaping with Escape to enter commands. • Simplifies engagement creation to require only a name, opening directly into Plan without blocking on target, mode, or authorization-reference inputs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.4.0

Mon, 12 Oct 2026 15:17:53 GMT

Decepticon v1.4.0 adds Plan, Red, and Blue run modes to the CLI `/mode` command, launcher, and web dashboard, plus selectable local Ollama model IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Plan, Red, and Blue run modes switchable via the CLI `/mode` command, OSS launcher, and web live view; Red mode requires one confirmed target and authorization reference, and rechecks RoE approval on start; Blue mode checks both sensor and monitor health.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Brings current production LiteLLM model routes into OSS agents and CLI. • Adds five additional Plan document views, making all nine planning documents visible in the Plan view. • Adds engagement-scoped report tool calls. • Adds complete LiteLLM model count and concise service health details to the health surface. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.1.44

Sat, 19 Sep 2026 15:25:38 GMT

Decepticon v1.1.44 adds Autohunt autonomous planning, AWS Bedrock and Kimi provider routes, and new evidence controls including severity ceilings and streaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `DECEPTICON_TELEMETRY=off` environment variable to disable telemetry sharing without going through the onboarding wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Autohunt autonomous planning lane that accepts an explicitly authorized target and validates planning documents and scope before marking an engagement ready, separate from the default Soundwave interview-first planner. • Adds native AWS Bedrock default routes and Kimi for Coding provider support, including launcher onboarding. • Adds executable specialist validation contracts covering capability contracts, evidence validation, lane scorecards, held-out evaluation fixtures, CVE-Bench dispatch plumbing, and pinned MITRE STIX bootstrapping. • Adds local API ingestion, dependency reachability evidence, and severity ceilings to evidence controls; provider calls gain extra-header and streaming controls; dynamic workload teardown is scoped by engagement and run. • Adds typed finding-location guidance in the skill catalog. Breaking changes: • Existing installations using default launcher credentials or missing secrets must update their configuration before starting — the release now rejects default credentials on startup. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.1.16

Sun, 21 Jun 2026 16:32:01 GMT

Decepticon v1.1.16 adds per-engagement sandbox routing, opt-in telemetry, web research tools, and skill retrieval. • get_sandbox(config) resolves `configurable.sandbox_url` and `sandbox_token` to enable multi-tenant sandbox isolation for bash sessions • Opt-in usage-telemetry system with consent gateway capturing engagement signals and masked reasoning trajectories • New RoE-gated open-web research tools: `web_search`, `detect_tech_stack`, live JS secret scanner, `osint_enrich`, and network reconnaissance suite • `find_skill` command enables LightRAG-style hybrid skill retrieval for mobile, IoT, and wireless security domains • `export-transcript` command exports engagement transcripts with zip export/import support for workspaces • New MCP server dedicated to engagement management Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.1.15

Sun, 14 Jun 2026 15:00:56 GMT

Decepticon v1.1.15 raises LLM output cap to 16384 tokens and adds full LiteLLM provider catalog. • The factory now sets an explicit `max_tokens` default of **16384** (env-overridable via `DECEPTICON_LLM_MAX_TOKENS`) • `litellm_dynamic_config.py` now carries the full LiteLLM v1.89.0 provider catalog Breaking changes: • #677 drops the now-dead bedrock/vertex_ai bearer-key map entries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.1.7

Sat, 06 Jun 2026 05:44:49 GMT

Decepticon v1.1.7 adds BloodHound CE REST support, AI attack-surface detection, and sensitive TLD opt-in • Adds `bhce_status`, `bhce_cypher`, and `bhce_ingest_zip` LangChain tools for official BHCE v9.2.2 integration • Introduces `Technology` node kind in the knowledge graph for AI-runtime and web-tech detection • Enables Blue Cell detection coverage via `DetectionFired` events through `BlueCellTap` + `RuleMatcher` • Requires explicit `allow_sensitive_tlds` engagement configuration for engagements with sensitive TLDs • Adds `DECEPTICON_LLM__TIMEOUT` environment variable for whole-coroutine LLM timeout control • Deprecates legacy `AD_TOOLS` surface including `bh_ingest_zip`, `bh_ingest_json`, and others in favor of `bhce_*` tools • Changes BloodHound NodeKind to `ADUser`, `ADComputer`, `ADGroup`, etc., prefixed with `AD` Breaking changes: • The `bh_ingest_zip`, `bh_ingest_json`, `dcsync_check`, `delegation_audit`, `gpo_audit`, `adcs_audit`, and `adcs_post.py` paths emit a `DeprecationWarning`; the legacy `AD_TOOLS` surface is deprecated. • Engagements with sensitive TLDs in scope now require explicit opt-in via `allow_sensitive_tlds`; previously trusted engagements will fail scope evaluation without this flag. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.1.0

Thu, 21 May 2026 09:43:27 GMT

Decepticon v1.1.0 adds plugin override system, runtime /plugins and /agent slash commands, HTTP-only sandbox, and Soundwave 8-doc bundle expansion • `decepticon.bundles` entry-point group for declaring custom `PluginBundle` packages that override agent factories, roles, middleware, and prompts without forking the core code. • `MiddlewareSlot.ENGAGEMENT_CONTEXT`, `MiddlewareSlot.SKILLS` constants and build_middleware() function enable plugins to inject slots and skill sources directly in Python code. • All 16 agent factories now accept `tools=`, `middleware=`, and `system_prompt=` kwargs with full-replace semantics for composing custom agent pipelines. • LLMFactory.get_model(role, default_role=...) lets plugin orchestrators inherit an OSS role's model assignment until they ship their own. • The `HTTPSandbox` class replaces the removed `DockerSandbox`; all sandbox interaction now flows through HTTPS over the management network, removing the need for a `docker.sock` mount. • Two new slash commands: `/plugins` to list/enable/disable plugin bundles at runtime without restart, and `/agent` to switch the active orchestrator between OSS standard, vulnresearch, or any plugin-registered agent. • Long-running shell tools (e.g. `nmap` scans) now emit `● Background command finished — ` events automatically upon completion. • Soundwave engagement planning interview now produces eight structured documents: `plan/roe.json`, `plan/threat-profile.json`, `plan/conops.json`, `plan/deconfliction.json`, `plan/contact.json`, `plan/data-handling.json`, `plan/abort.json`, and `plan/cleanup.json`. Breaking changes: • The internal `decepticon.agents.assembly` module has been renamed to `decepticon.agents.build`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.16

Sun, 03 May 2026 11:12:29 GMT

Decepticon v1.0.16 adds Ollama support, DeepSeek V4 models, new hunting lanes, and `make dogfood` workflow • Adds `--build-arg VERSION=` to Docker builds for release flow automation and `make dogfood` command for OSS UX validation in `.dogfood/` directory • Introduces DeepSeek V4 models with `v4-pro` and `v4-flash` profiles supporting 1M context, reasoning, and tool calls • Adds three new analyst hunting lanes: Trust-boundary (Lane F), Pattern-exhaustion (Lane G), and Bounty target assessment (Lane H) • Integrates two new CLI tools: `bounty_scope_check` and `format_bounty_report` • Deploys new skill file `skills/exploit/web/smuggling.md` for Class A vs Class B HRS branching analysis • Updates launcher client (`clients/launcher/cmd/ollama_models.go`) to use parallel fan-out for `/api/tags` and `/api/show` endpoints Breaking changes: • Removes `make sync-version` command from the build flow Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.12

Thu, 30 Apr 2026 05:35:28 GMT

Adds OpenRouter and NVIDIA NIM LLM support, parallel task dispatch, and macOS Apple Silicon compatibility. • Adds `OPENROUTER_API_KEY` and `NVIDIA_API_KEY` environment variables in the onboarding wizard to enable Claude via OpenRouter and Llama/Nemotron via NVIDIA NIM • Enables parallel execution of independent objectives by defaulting the orchestrator to concurrent task() calls for goals without `blocked_by` dependencies • Orders credential fallback chains based on configured availability, controlled by the `DECEPTICON_AUTH_PRIORITY` environment variable • Adds macOS Apple Silicon compatibility by forcing `linux/amd64` platform in `docker-compose.yml` for Kali-based services and target containers Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.9

Sun, 26 Apr 2026 04:20:36 GMT

Adds XBOW benchmark harness, `compose --wait`, env-driven version pinning, and new env vars. • `DECEPTICON_STARTUP_TIMEOUT_SECONDS` environment variable sets the agent stack startup timeout (default 600s). • `--volumes --remove-orphans` flags added to `decepticon remove` to free disk space on uninstall. • `BENCHMARK_MODE` environment variable injected by the new XBOW benchmark framework. • New `decepticon.benchmark` package with provider, harness, and scorer components for end-to-end evaluation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.8

Thu, 23 Apr 2026 13:50:26 GMT

Adds StateGraph-based engagement lifecycle router with `conops → opplan → execution → report` phase transitions • `StateGraph`-based engagement lifecycle router with conditional edges for phase transitions from planning (`conops`) through execution to reporting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.7

Wed, 22 Apr 2026 18:33:31 GMT

Decepticon v1.0.7 introduces Go CLI binary, MiniMax provider, Claude OAuth, interactive wizard, and dashboard sync • `decepticon` is now a native Go binary with an **Interactive onboard wizard** (Charmbracelet Huh v2) • Native cross-platform binaries for Linux (amd64/arm64), macOS (amd64/arm64), and Windows • Bash fallback launcher at `scripts/launcher.sh` remains available if Go binary is missing • Install scripts (`install.sh`, Go launcher, bash launcher) pin downloads to the specific release `v{version}` tag • Added `DECEPTICON_MODEL_PROVIDER=auth` environment variable for Claude Code OAuth Gateway access • `ModelProvider` and `ModelProfile` configuration fields are now separated • MiniMax added as a fourth LLM provider alongside Anthropic, OpenAI, and Google • Web Dashboard gains Octogent integration for workspace sync, plan viewer, and agent canvas • Dashboard supports thread persistence to resume sessions across restarts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.6

Sat, 18 Apr 2026 21:36:08 GMT

Adds Human-in-the-Loop pause/resume via Ctrl+C and `/resume` command with message queuing • Enables pausing an agent run at a checkpoint with `Ctrl+C`, preserving all state • Adds `/resume [feedback]` subcommand to continue a paused agent run with optional operator feedback • Introduces message queuing during agent streaming — typed messages are auto-submitted on completion Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.4

Sat, 18 Apr 2026 14:49:04 GMT

Decepticon v1.0.4 adds web dashboard, offensive vaccine agents, and OPPLAN persistence. • Web dashboard is now in the default stack with `WEB_PORT` env var override • Adds 12 new specialized agents for the Offensive Vaccine loop including `defender`, `detector`, and `exploiter` • OPPLAN persistence via `plan/opplan.json` with `save_opplan` / `load_opplan` tools • Claude 4.x compatibility layer via `DECEPTICON_CLAUDE4_COMPAT=0` opt-out env var • SARIF vulnerability findings ingest into the Knowledge Graph Breaking changes: • Python direct execution entry point has been removed in favor of the web dashboard Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.3

Mon, 06 Apr 2026 09:20:28 GMT

Decepticon v1.0.3 introduces Makefile shortcuts, structured finding models, and editable Docker development workflow. • Adds `make dev`, `make cli`, `make start`, `make test`, and `make lint` targets to the new Makefile for streamlined local development • Introduces `decepticon` command entry point that launches a full Docker stack matching production environments • Adds Pydantic models for `Finding`, `Evidence`, and `AttackPath` with CVSS v4.0 scoring and confidence levels • Implements new engagement directory layout with `findings/`, `findings/evidence/`, `findings/attack-paths/`, `report/`, and `timeline.jsonl` • Adds `allowed-tools` field to skill frontmatter for progressive tool disclosure • Enables Docker Compose Watch for automatic source-to-container syncing without manual rebuilds Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.2

Sat, 04 Apr 2026 10:43:01 GMT

Adds Soundwave agent for engagement docs, OPPLANMiddleware CRUD tools, dual-screen CLI with ctrl+o toggle • Dual-screen CLI adds `ctrl+o` toggle between Prompt mode (compact) and Transcript mode (full history) • Adds OPPLANMiddleware with domain-specific CRUD tools for objectives (add/get/list/update) including state transition validation and dependency checking • Introduces DecepticonSkillsMiddleware, a MITRE ATT&CK-aware skill system supporting phase grouping and progressive disclosure • Soundwave agent replaces the deprecated Planner agent for engagement document generation (RoE, ConOps, Deconfliction Plan, OPPLAN) • SafeCommandMiddleware expands its blocklist to include session-destroying commands such as pkill, nsenter, and docker exec • PromptBuilder introduces static/dynamic prompt separation with cache boundary markers and cross-cutting patterns Breaking changes: • The `skills/planning/` directory is renamed to `skills/soundwave/` • Model profiles DEFAULT and HIGH are renamed to eco and max respectively Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon

Decepticon v1.0.1

Mon, 30 Mar 2026 05:30:11 GMT

Decepticon v1.0.1 adds modular C2 infrastructure via Docker profiles and async sandbox execution. • Activates Sliver C2 in `c2-sliver` container using `docker compose --profile c2-sliver` • Extracts shared prompt fragments (`bash.md`, `skills.md`) for reuse via load_prompt() • Adds execute_tmux_async() method to `DockerSandbox` for non-blocking tmux execution Full history on Cyber Toolchain: https://cybertoolchain.io/tools/decepticon