PAGES
← all tools
◆ Exploitation & C2

redeye

v1.4.1 open-source

Pentest data management platform for organizing servers, users, vulnerabilities, files, and attack vectors during engagements.

source ↗ rss ↗ What is a cyber toolchain?

Summary

redeye is an open-source desktop application that helps pentest teams organize the data they generate during an engagement, tracking compromised servers, discovered users, vulnerabilities, files, and attack vectors in one place. It runs locally, installed via Docker or from source, and presents the information through panels for servers, users, and files, plus a graph view mapping relationships between compromised hosts and accounts and an API for pulling data programmatically. It is built for red teamers and pentest operators who need a shared record of an operation rather than scattered notes, and it sits in the operation-management corner of the exploitation tooling space, alongside the collaboration tools such engagements typically require. First committed in 2022 with five contributors and four tracked releases, the project has had no commits in the past year.

Pentest data management platform for organizing servers, users, vulnerabilities, files, and attack vectors during engagements.

How redeye helps

Which servers in this engagement have already been compromised, and what got us in?

the server panel marks each host's owned status alongside its open ports, so anyone joining the operation can see pwned state at a glance instead of asking teammates

Which users have we found across all these hosts, and what access do they actually have?

the users panel pools every discovered account from every server and groups them by permission level and type, editable inline as credentials get confirmed or escalated

How do the accounts and servers we've compromised connect to each other?

the graph panel plots every server and user as nodes and draws the relationships between them, so a path from an initial foothold to a domain admin account is visible rather than reconstructed from notes

Which attack vectors are worth chasing first?

the attack vector panel lists each discovered vector with severity, plausibility, and risk plotted, so operators can compare paths instead of relying on memory of what looked promising

Where are the screenshots and files a teammate collected during this engagement?

the files panel holds everything uploaded during the pentest for any team member to pull down, and the pre-report panel collects the screenshots gathered so far in one place

Can another tool or script pull our current engagement data out programmatically?

a token-authenticated API exposes the same servers, users, and files data as simple requests, so a report generator or dashboard can read the operation's state without opening the desktop app

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities

Built from redeye's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What redeye offers you

  • REST API1
All capabilities 3 capabilities
Programmatic API access shipped Provides endpoints for creating and reading servers, users, and exploits via HTTP. 4 releases · first seen Jun 2023

Also counts toward: REST API

release

  • POST /api/exploits endpoint added to create exploits by sending name and data fields v1.4.1 · Jun 2023 · source · release history
  • POST /api/users endpoint added to create users by sending username and password fields v1.4.1 · Jun 2023 · source · release history
  • POST /api/servers endpoint added to create servers by sending ip, name, and vendor fields v1.4.1 · Jun 2023 · source · release history
  • GET /api/servers, GET /api/users, and GET /api/exploits endpoints added for reading data using a Personal Access Token (PAT) header v1.4.1 · Jun 2023 · source · release history
Server inventory automation shipped Allows programmatic retrieval of managed servers and addition of new server entries. 2 other sources · first seen Jun 2023

example

  • Programmatically add a new server entry to the inventory. curl -X POST redeye.local:8443/api/servers -q --silent -H 'Token: …' -d 'ip=1.1.1.1&name=redeye&vendor=redeye' v1.4.1 · Jun 2023 · source
  • Retrieve the list of servers managed by this cyber tooling via automation. curl redeye.local:8443/api/servers --silent -H 'Token: …' v1.4.1 · Jun 2023 · source
Pentest data management platform documented Organizes servers, users, vulnerabilities, files, and attack vectors during engagements. 1 other source

docs

  • Pentest data management platform for organizing servers, users, vulnerabilities, files, and attack vectors during engagements.

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for redeye, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail redeye puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

2 entries

  1. June 20232

    2 entries

    1. v1.4.1 Jun 30, 2023 · release notes

      New READ/WRITE REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for servers, users, and exploits accessible via PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. authentication

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.1 https://github.com/redeye-framework/Redeye.git
# already have the repo? check out this version:
$ git checkout v1.4.1
      └──▷ TRY IT
      Retrieve the list of servers managed by this cyber tooling via automation.
      $ curl redeye.local:8443/api/servers --silent -H 'Token: …'
      Programmatically add a new server entry to the inventory.
      $ curl -X POST redeye.local:8443/api/servers -q --silent -H 'Token: …' -d 'ip=1.1.1.1&name=redeye&vendor=redeye'
      • GET /api/servers, GET /api/users, and GET /api/exploits endpoints added for reading data using a Personal Access Token (PAT) header
      • POST /api/servers endpoint added to create servers by sending ip, name, and vendor fields
      • POST /api/users endpoint added to create users by sending username and password fields
      • POST /api/exploits endpoint added to create exploits by sending name and data fields

      4 details in Everything

    2. v1.4.0 Jun 25, 2023 · release notes

      Redeye v1.4.0 introduces the Redeye API and read APIs

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.0 https://github.com/redeye-framework/Redeye.git
# already have the repo? check out this version:
$ git checkout v1.4.0

    Project health

    Issue, contributor and maintainer activity in redeye-framework/Redeye, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 4 of 14 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 4
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 473
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Ships a vulnerable library

    What its latest release locks, checked against known advisories.

    certifi 2021.10.8 in its image

    critical

    redeye 1.4.2 builds its image from requirements.txt, which locks certifi 2021.10.8. That version has GHSA-6q48-6c7w-9gw2 and 1 other high or critical flaw.

    Fixed in certifi 2026.10.18. No redeye release includes it yet.

    GHSA-6q48-6c7w-9gw2 advisory Checked Nov 3 against redeye 1.4.2

    pyjwt 1.7.1 in its image

    critical

    redeye 1.4.2 builds its image from requirements.txt, which locks pyjwt 1.7.1. That version has GHSA-ffc3-869f-jxw9 and 5 other high or critical flaws.

    Fixed in pyjwt 2.14.0. No redeye release includes it yet.

    GHSA-ffc3-869f-jxw9 advisory Checked Nov 3 against redeye 1.4.2

    dnspython 2.2.1 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks dnspython 2.2.1. That version has GHSA-45c3-73f7-pv4m.

    Fixed in dnspython 2.9.0. No redeye release includes it yet.

    GHSA-45c3-73f7-pv4m advisory Checked Nov 3 against redeye 1.4.2

    flask 2.0.3 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks flask 2.0.3. That version has GHSA-m2qf-hxjv-5gpq.

    Fixed in flask 2.2.5. No redeye release includes it yet.

    GHSA-m2qf-hxjv-5gpq advisory Checked Nov 3 against redeye 1.4.2

    lxml 4.8.0 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks lxml 4.8.0. That version has GHSA-vfmq-68hx-4jfw.

    Fixed in lxml 6.1.0. No redeye release includes it yet.

    GHSA-vfmq-68hx-4jfw advisory Checked Nov 3 against redeye 1.4.2

    python-engineio 4.3.1 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks python-engineio 4.3.1. That version has GHSA-cgwc-pv48-fhj5 and 1 other high or critical flaw.

    Fixed in python-engineio 4.13.2. No redeye release includes it yet.

    GHSA-cgwc-pv48-fhj5 advisory Checked Nov 3 against redeye 1.4.2

    python-socketio 5.5.2 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks python-socketio 5.5.2. That version has GHSA-5w7q-77mv-v69f.

    Fixed in python-socketio 5.16.2. No redeye release includes it yet.

    GHSA-5w7q-77mv-v69f advisory Checked Nov 3 against redeye 1.4.2

    urllib3 1.26.9 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks urllib3 1.26.9. That version has GHSA-2xpw-w6gg-jr37 and 6 other high or critical flaws.

    Fixed in urllib3 2.8.0. No redeye release includes it yet.

    GHSA-2xpw-w6gg-jr37 advisory Checked Nov 3 against redeye 1.4.2

    werkzeug 2.1.0 in its image

    high

    redeye 1.4.2 builds its image from requirements.txt, which locks werkzeug 2.1.0. That version has GHSA-2g68-c3qc-8985 and 1 other high or critical flaw.

    Fixed in werkzeug 3.0.3. No redeye release includes it yet.

    GHSA-2g68-c3qc-8985 advisory Checked Nov 3 against redeye 1.4.2

    We check the lockfiles its release builds images from: 1 Python. Go modules, other lockfiles and vendored code aren't checked.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback