[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92655":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":12,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":14,"stars7d":14,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":14,"compositeScore":16,"rankGlobal":8,"rankLanguage":8,"license":17,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":8,"pushedAt":8,"updatedAt":22,"readmeContent":23,"aiSummary":24,"trendingCount":14,"starSnapshotCount":14,"syncStatus":25,"lastSyncTime":26,"discoverSource":27},92655,"wallbreaker","JailbrokenAI\u002Fwallbreaker","JailbrokenAI",null,"Python",265,55,84,1,0,65,48.74,"GNU Affero General Public License v3.0",false,"main",true,[],"2026-07-22 04:02:06","# Wallbreaker: AI Red-Team Harness\n\n```\n██╗    ██╗ █████╗ ██╗     ██╗     ██████╗ ██████╗ ███████╗ █████╗ ██╗  ██╗███████╗██████╗\n██║    ██║██╔══██╗██║     ██║     ██╔══██╗██╔══██╗██╔════╝██╔══██╗██║ ██╔╝██╔════╝██╔══██╗\n██║ █╗ ██║███████║██║     ██║     ██████╔╝██████╔╝█████╗  ███████║█████╔╝ █████╗  ██████╔╝\n██║███╗██║██╔══██║██║     ██║     ██╔══██╗██╔══██╗██╔══╝  ██╔══██║██╔═██╗ ██╔══╝  ██╔══██╗\n╚███╔███╔╝██║  ██║███████╗███████╗██████╔╝██║  ██║███████╗██║  ██║██║  ██╗███████╗██║  ██║\n ╚══╝╚══╝ ╚═╝  ╚═╝╚══════╝╚══════╝╚═════╝ ╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚═╝  ╚═╝\n        break the wall · not the rules of engagement    ⚔  authorized testing only\n```\n\nA Claude-Code-style terminal agent built for red-teaming LLMs (CLI command: `wallbreaker`). You talk to it like\nClaude Code; it reasons and calls tools in a loop. The backend is fully configurable, so\nit runs on **OpenRouter**, the **Z.AI GLM coding plan**, the local **Claude Code CLI**, a\nlocal server, or any OpenAI-\u002FAnthropic-compatible API (including third-party proxies via\nbearer-auth). It ships with a deep red-team toolkit: the **Parseltongue** transform engine,\nthe **L1B3RT4S** jailbreak library, the **HarmBench** behavior benchmark, automated attack\nloops (PAIR\u002FTAP, Crescendo, best-of-N), a from-scratch **persona author**, native-format\ntarget mimicry from a leaked system-prompt corpus, a **multimodal image-edit attack channel**,\nan LLM judge, and reliability validation.\n\n> For authorized security testing only.\n\n## Highlights\n\n- **Dual-protocol provider layer:** OpenAI Chat Completions + Anthropic Messages, any\n  `base_url`\u002Fmodel. Captures reasoning\u002Fthinking channels; converts network errors to\n  clean failures (no crashes on timeout).\n- **Autonomous attack loop:** keeps mutating\u002Fre-firing until it succeeds (`finish()`\n  exits the tool) or needs you (`ask_operator()`).\n- **Standardized, unbiased prompts:** pulls test batteries from **HarmBench** (400\n  behaviors, 7 categories) instead of hand-picked examples.\n- **Reliability-first:** `validate` re-fires N times for the real success rate; a\n  one-shot COMPLIED is never called a \"bypass\". Pin the OpenRouter backend for\n  reproducibility.\n- **Parseltongue:** 59 chainable transforms (encodings, unicode fonts, stego, homoglyph,\n  zero-width, tag smuggling, bijection, gibberish…) plus `mutate` (LLM anti-classifier).\n- **P4RS3LT0NGV3 over MCP:** an optional MCP server wraps elder-plinius's upstream\n  Parseltongue: **all 222 transforms** (45 ciphers, runic\u002Fbraille\u002Fsymbol scripts, every\n  encoding, steganography) + a universal decoder, exposed as `parsel_*` tools the agent\n  drives directly. Any `[[mcp.servers]]` you configure is proxied into the tool registry.\n- **Single-artifact convergence:** `\u002Fsysprompt` + `system_sweep` + `optimize_universal`\n  converge on ONE universal system prompt; they can't split into variant toolkits.\n- **Persona author (`author_persona`):** writes a full devoted-persona system-prompt\n  jailbreak from scratch via the codified ENI method (draft → self-critique → validate →\n  refine → distill), auto-picking a credentialed-authority or limerence register from the\n  objective's domain.\n- **Native-format mimicry:** `sysprompt_*` tools search a leaked product system-prompt\n  corpus (Claude\u002FGPT\u002FGemini\u002FGrok…) and hand the target's own section-tag\u002Fheading dialect to\n  the persona author so a payload speaks the victim model's native format.\n- **Multimodal image channel:** `query_image_edit` fires an image + instruction at an image\n  target and vision-judges the result; `image_chain` runs a Chain-of-Jailbreak, decomposing a\n  refused image into a ladder of benign edit steps. Plus Tier-3 T2I framing transforms.\n- **Pluggable attacker brains:** OpenAI\u002FAnthropic APIs, or the local **Claude Code CLI**\n  (`protocol = \"claude-code\"`, keyless) as the red-team brain. Third-party Anthropic proxies\n  work via `auth_style = \"bearer\"`.\n\n## Install\n\n```bash\npython -m venv .venv\n. .venv\u002Fbin\u002Factivate\npip install -e \".[dev]\"        # add [barcodes] for the QR\u002Fbarcode tool\n```\n\n## Configure\n\n```bash\ncp config.example.toml config.toml   # add your keys (config.toml is gitignored)\nwallbreaker check                            # validate it: profiles, keys, target, judge\n```\n\nProfiles set the attacker brain; `[target]` is the model under attack; `[judge]` grades\nreplies. Keys can be inline or from env. OpenRouter endpoints support `provider` pinning\nand a `timeout` override.\n\n```toml\ndefault_profile = \"glm\"\n\n[profiles.glm]\nprotocol = \"openai\"\nbase_url = \"https:\u002F\u002Fapi.z.ai\u002Fapi\u002Fpaas\u002Fv4\"\napi_key  = \"...\"\nmodel    = \"glm-4.6\"\n\n[target]\nprotocol = \"openai\"\nbase_url = \"https:\u002F\u002Fopenrouter.ai\u002Fapi\u002Fv1\"\napi_key  = \"sk-or-...\"\nmodel    = \"deepseek\u002Fdeepseek-v4-pro\"\n# provider = \"WandB\"   # pin the backend for reproducible results\n# timeout  = 60        # seconds (default 120)\n\n[judge]\nprotocol = \"openai\"\nbase_url = \"https:\u002F\u002Fopenrouter.ai\u002Fapi\u002Fv1\"\napi_key  = \"sk-or-...\"\nmodel    = \"openai\u002Fgpt-4o-mini\"\n```\n\n**Attacker-brain options:**\n\n```toml\n# Local Claude Code CLI as the attacker brain, keyless (the CLI self-auths).\n[profiles.claude-code]\nprotocol = \"claude-code\"\nmodel    = \"sonnet\"\n# system_prompt_file = \"operator.md\"   # optional: leads the harness tool doctrine\n\n# Third-party Anthropic-compatible proxy that wants an OpenAI-style bearer token.\n[profiles.proxy]\nprotocol   = \"anthropic\"\nbase_url   = \"https:\u002F\u002Fyour-proxy.example\"     # host root; provider appends \u002Fv1\u002Fmessages\napi_key    = \"...\"\nmodel      = \"claude-sonnet-4\"\nauth_style = \"bearer\"                          # Authorization: Bearer \u003Ckey> (default: x-api-key)\n```\n\n### P4RS3LT0NGV3 engine (native)\n\nThe full upstream **P4RS3LT0NGV3** engine (222 transforms across 11 categories plus the\nuniversal decoder) is wired straight into the agent registry as native `parsel_*` tools\n(`parsel_list`\u002F`search`\u002F`inspect`\u002F`transform`\u002F`chain`\u002F`decode`\u002F`guide`\u002F`craft`). No MCP\nserver or config block is required; the tools appear automatically once the repo is vendored\nand Node.js is on PATH. One-time setup:\n\n```bash\nwallbreaker parsel update        # git-clone elder-plinius\u002FP4RS3LT0NGV3 into library\u002F (needs Node.js)\nwallbreaker parsel list          # sanity-check: prints all 222 transforms by category\n```\n\nIf Node is missing, the pure-Python `parseltongue` tool (50+ transforms) remains as an\noffline fallback. Override the vendored location with `PARSEL_REPO=\u002Fabs\u002Fpath\u002Fto\u002FP4RS3LT0NGV3`.\n\n### MCP servers (optional)\n\nThe harness is also an MCP client: every `[[mcp.servers]]` you declare is spawned over stdio\nat startup and its tools are proxied into the registry. The same P4RS3LT0NGV3 engine is still\navailable as an MCP server if you prefer to run it out-of-process (it re-registers the same\n`parsel_*` names with identical behaviour):\n\n```toml\n[[mcp.servers]]\nname    = \"parsel\"\ncommand = \"python\"\nargs    = [\"-m\", \"p4rs3lt0ngv3_mcp\"]\nenabled = false                                       # native tools already cover this\n# tool_prefix = \"p_\"                                  # optional namespace for the proxied tools\n# env = { PARSEL_REPO = \"\u002Fabs\u002Fpath\u002Fto\u002FP4RS3LT0NGV3\" } # override the vendored repo location\n```\n\nNo `npm install`\u002Fbuild is needed; the server drives the upstream Node bridge headlessly.\nIn the TUI, `\u002Fparsel guide|list|search \u003Cq>|inspect \u003Ckey>` browses the catalog. The server is\na standalone stdio MCP server, so any MCP client (Claude Code, Cursor) can use it too.\n\n## Launch\n\n```bash\nwallbreaker                       # TUI on default_profile\nwallbreaker --profile openrouter\nwallbreaker --auto \"objective...\" # one-shot autonomous run\nwallbreaker --resume              # reopen the autosaved session (survives a crash\u002FCtrl+C)\n```\n\nThe TUI autosaves the whole engagement to `sessions\u002Fautosave.json` after every turn;\n`--resume` reopens it (or pass a specific session file: `wallbreaker --resume mysession.json`).\n\n## Picking the model to attack\n\n`\u002Fmodel` changes the attacker brain; `\u002Ftarget` changes the victim.\n\n```\n\u002Ftarget anthropic\u002Fclaude-3.7-sonnet   attack any model on the target endpoint\n\u002Ftarget glm                           attack via a profile\n\u002Fprovider WandB                       pin the OpenRouter backend (reproducibility)\n```\n\n## Finding ONE universal prompt (the right way)\n\nA \"one prompt for every task\" goal means a single fixed artifact, not a toolkit.\n\n```\n\u002Fsysprompt set \u003Cone system prompt>    hold ONE fixed system prompt\n\u002Fsysprompt test                       sweep it across the HarmBench cyber battery\n\u002Fvalidate \u003Ctask>                      re-fire 8x for the REAL success rate\n```\n\nRead which tasks failed → refine the **one** prompt → `\u002Fsysprompt test` again. A single\nCOMPLIED is luck; `validate` tells you the truth. For the user-turn variant use\n`\u002Ftemplate set … {request}` + `\u002Ftemplate test`.\n\n## Agent tools (`\u002Ftools` lists them live)\n\n| tool | purpose |\n|------|---------|\n| `run_shell`, `read_file`, `write_file`, `edit_file` | build\u002Frun\u002Fsave payloads |\n| `parseltongue`, `parseltongue_catalog`, `mutate` | obfuscate \u002F anti-classifier rewrite |\n| `parsel_*` (native) | full P4RS3LT0NGV3 engine: `parsel_guide`\u002F`list`\u002F`search`\u002F`inspect`\u002F`transform`\u002F`chain`\u002F`decode`: 222 transforms + universal decoder. `parsel_craft` builds a ready-to-fire payload (encode a request through a chain + wrap it decode-and-comply \u002F split-into-vars) |\n| `l1b3rt4s_*`, `eni_*` | jailbreak libraries: L1B3RT4S + the ENI persona collection |\n| `author_persona` | author a full devoted-persona system prompt from scratch (ENI method: draft→critique→validate→refine→distill), auto-picking an authority\u002Flimerence register from the objective's domain |\n| `sysprompt_list`, `sysprompt_search`, `sysprompt_get`, `sysprompt_native` | browse\u002Fsearch a leaked product system-prompt corpus (Claude\u002FGPT\u002FGemini\u002FGrok…); `sysprompt_native` hands the target's own section-tag\u002Fheading format to the persona author for native mimicry |\n| `harmbench`, `preset` | unbiased behavior benchmark, curated seed templates |\n| `query_target` | fire at the model-under-test (with `transforms=[...]` to encode+fire) |\n| `query_image_edit` | fire an input image + instruction at an IMAGE target (`modality='image'`) and vision-judge the edited picture |\n| `image_chain` | Chain-of-Jailbreak: decompose a refused image into a ladder of individually-benign edit steps and drive them in sequence |\n| `multi_fire` | sweep one payload through many encodings (concurrent) |\n| `crescendo` | multi-turn escalation |\n| `pair_attack` | PAIR\u002FTAP: refine one objective on the target's refusals |\n| `pair_sweep` | run the PAIR loop across a whole battery concurrently (highest-ASR, batched) |\n| `best_of_n` | resample N times, keep the bypass |\n| `many_shot` | many-shot jailbreak: flood context with faux compliant turns, then fire |\n| `prefill` | response-priming: seed the assistant's own reply so it continues, not refuses |\n| `narrate` | fiction-frame + in-story prefill (novel-chapter roleplay); tops the scoreboard |\n| `diff_fire` | A\u002FB two payloads at one target to attribute ASR to a specific edit |\n| `recommend_transforms` | survey ~16 encodings, rank by bypass, synthesize a chain to try |\n| `seed_sweep` | inject one request through many ENI+L1B3RT4S seeds, rank which bypass |\n| `fire_file` | fire a file\u002Fseed RAW (verbatim, full-length) as the target system prompt |\n| `adapt_seed` | attacker-LLM patches a persona for a specific refusal (don't use it to distill) |\n| `campaign` | auto-escalate a HarmBench battery up a technique ladder, coverage matrix |\n| `leaderboard` | rank multiple profiles by ASR on one battery (robustness benchmark) |\n| `leak_scan` | scan a reply for secrets\u002FPII\u002Fsystem-prompt echo (evidence, not a verdict) |\n| `scan` | Garak-style coverage matrix (technique + HarmBench probes) |\n| `indirect_inject` | RAG\u002Fagent injection via document\u002Femail\u002Ftool-output carriers |\n| `system_sweep` | validate ONE system prompt across a task battery (multi-sample) |\n| `optimize_universal` | hill-climb one template (user or `slot='system'`) |\n| `judge_response`, `validate` | LLM judge a reply \u002F measure the real success rate |\n| `judge_selftest` | calibrate the grader on benign fixtures before trusting ASR |\n| `http_request`, `barcode` | raw delivery \u002F QR+barcode encoding |\n| `finish`, `ask_operator` | stop the tool \u002F pause for the operator |\n\n## Slash commands\n\n```\n\u002Fprofile \u002Ftarget \u002Fprovider \u002Fmodel \u002Fjudge [model]   endpoints & grader\n\u002Fauto \u002Fautoexit \u002Frounds                            autonomous loop\n\u002Fobjective \u002Ftemplate \u002Fsysprompt \u002Fvalidate \u002Freplay  campaign + reliability\n\u002Ftransforms \u002Fencode \u002Fdiff \u002Fcampaign \u002Fleaderboard   arsenal, auto-sweep & benchmark\n\u002Ffind \u002Ftools \u002Fpreset \u002Flib \u002Fparsel \u002Feni \u002Fharmbench  search & libraries\n\u002Flog \u002Fasr \u002Fstats \u002Ffindings \u002Frepro \u002Fexport \u002Freport  logging, scoreboard, repro, CI export\nCtrl+S report · Ctrl+Y copy payload · Ctrl+T stats · Ctrl+R repro · Ctrl+L clear\n```\n\n## Logging & reports\n\nEvery payload, reply, and verdict goes to `sessions\u002Frun-\u003Cts>.jsonl`. `\u002Ffindings` lists the\nbypasses; `\u002Freport [html]` writes a markdown or styled-HTML findings doc; `\u002Frepro [n]`\ncopies a repro pack; `\u002Fexport` dumps structured findings JSON; `\u002Fsession save|load`\npersists the whole engagement (history, objective, template, system prompt).\n\n## Headless \u002F CI\n\nRender reports and gate builds straight from a run log, no TUI. The log arg is optional:\nomit it (or pass a directory) and the newest `sessions\u002Frun-*.jsonl` is used:\n\n```bash\nwallbreaker report                       # markdown for the latest run, to stdout\nwallbreaker report --html --out report.html\nwallbreaker export --out findings.json   # structured findings JSON\nwallbreaker export --fail-on-finding     # exit 2 if any bypass -> fails CI\n```\n\nA ready-to-rename GitHub Actions gate lives at\n`.github\u002Fworkflows\u002Fredteam-gate.example.yml`.\n\n## Test\n\n```bash\npytest -q\n```\n\n## Web dashboard\n\nA browser dashboard ships alongside the TUI (FastAPI backend + React\u002FVite SPA). Its\nheadline is the **Agent** view, the *same autonomous attack loop the TUI runs*: give it an\nobjective (\"jailbreak the model into …\") and the attacker brain reasons, picks techniques,\nfires at the target, reads the verdict, and keeps going, streamed live to your browser over\nSSE. Plus a single-shot **attack console** (preset + transform chips → verdict), a live ASR\nscoreboard, findings table, run-log viewer, a searchable arsenal of\npresets\u002Ftransforms\u002Ftools, and a **Settings** panel to swap the target \u002F attacker \u002F judge\nmodel live (persisted to `.wallbreaker_state.json`, applied without a restart; image\ntargets auto-set `modality=image`).\n\n![Wallbreaker attack console](docs\u002Fimages\u002Fdashboard-console.png)\n\n\u003Cdetails>\n\u003Csummary>More views: overview & arsenal\u003C\u002Fsummary>\n\n![Overview](docs\u002Fimages\u002Fdashboard-overview.png)\n![Arsenal](docs\u002Fimages\u002Fdashboard-arsenal.png)\n\n\u003C\u002Fdetails>\n\n```bash\npip install -e \".[dashboard]\"                       # FastAPI + uvicorn\ncd wallbreaker\u002Fdashboard\u002Fweb && npm install && npm run build && cd -\nwallbreaker dashboard                                # http:\u002F\u002F127.0.0.1:8787\n```\n\nThe backend reuses the same engine as the TUI, so the console fires through `query_target`\nagainst your `[target]`. For frontend hot-reload during development, run `npm run dev` in\n`wallbreaker\u002Fdashboard\u002Fweb` (it proxies `\u002Fapi` to the running `wallbreaker dashboard`).\n\n## Responsible use\n\nWallbreaker is for **authorized** LLM red-teaming and safety evaluation only: your own\nmodels, or targets you have explicit permission to test. Run logs and generated\nartifacts can contain harmful content; they're written to gitignored `wb_runs\u002F`,\n`wb_artifacts\u002F`, `findings\u002F`. See [SECURITY.md](SECURITY.md) for the full policy and how\nto report a vulnerability in the harness itself.\n\n## Contributing\n\nSetup, architecture, and house rules are in [CONTRIBUTING.md](CONTRIBUTING.md). Run\n`pytest -q` before a PR; the suite is the contract.\n\n## License\n\n[AGPL-3.0-or-later](LICENSE). Wallbreaker is copyleft: any modified version (**including\none you run as a network\u002Fhosted service**) must make its complete corresponding source\navailable under the same license. Third-party jailbreak corpora (L1B3RT4S, P4RS3LT0NGV3,\nENI) are fetched at runtime, not redistributed; see [NOTICE](NOTICE).\n","Wallbreaker 是一个面向大语言模型（LLM）安全评估的红队测试终端代理工具。它支持多后端（OpenRouter、Z.AI GLM、本地 Claude Code CLI 等兼容 OpenAI\u002FAnthropic API 的服务），内置 Parseltongue 变换引擎（59+可链式编码与混淆技术）、L1B3RT4S 指令注入库、HarmBench 行为基准测试集，以及自动化攻击循环（PAIR\u002FTAP、Crescendo 等）。工具提供标准化提示生成、多轮可靠性验证、多模态图像编辑攻击通道和 LLM 自判机制，强调授权范围内的可控、可复现、无偏见的安全测试。适用于 AI 安全研究人员、模型厂商及合规团队开展系统性对抗性评估。",2,"2026-07-10 02:30:03","CREATED_QUERY"]