Wreck It Ralph

Wreck-It Ralph


Autonomous web application security testing agent powered by Claude.

Wreck-It Ralph orchestrates Claude CLI with browser automation (Playwright MCP) to methodically test web applications for security vulnerabilities. It runs in iterations — each one a full Claude session that picks up where the last left off — with hook-based enforcement of scope, rate limits, and safety controls.

How It Works

flowchart TD
    A["@targets.md + SECURITY_BRIEF.md"] --> B["Wreck-It Ralph Orchestrator"]
    B --> C["Claude CLI + Playwright Browser"]

    C --> D{"Testing Phase"}
    D --> E["Reconnaissance"]
    D --> F["Auth Testing"]
    D --> G["Input Validation"]
    D --> H["Access Control"]
    D --> I["Business Logic"]
    D --> J["API Security"]

    E & F & G & H & I & J --> K["WRECK_STATUS + WRECK_FINDING + WRECK_LEARNED"]

    K --> L{"More phases?"}
    L -- Yes --> M["Next Iteration"]
    M --> C
    L -- No --> N["HTML + Markdown Reports"]

    subgraph Hooks ["Safety Hooks (enforce on every action)"]
        direction LR
        S1["Scope Enforcer"]
        S2["Rate Limiter"]
        S3["Payload Validator"]
        S4["Stop Validator"]
    end

    C -. "every tool call" .-> Hooks
    Hooks -. "block or allow" .-> C

    subgraph Memory ["Persisted Across Iterations"]
        direction LR
        M1["Learned Skills"]
        M2["Findings"]
        M3["Checkpoints"]
        M4["Scope Learning"]
    end

    K --> Memory
    Memory --> B

Features

Core Testing Loop

• Phase-based testing — Reconnaissance, Authentication, Input Validation, Access Control, Business Logic, API Security
• Iteration continuity — Context injected at each iteration start so Claude knows what was done, what's left, and what failed
• *Checkpoint recovery