Red Code is the tooling platform behind my security work. It is one project with two halves that were built to lock together.

The harness (PenTestCLI)

A fork of the open-sourced Claude Code, rebuilt with a principal red team operator system prompt compiled into the build — the default coding-assistant identity is replaced at the source, not bolted on at runtime. Launching it looks like this:

The doctrine it bakes in:

• Impact first — a finding without a reproducible proof of concept is a lead, not a finding; score only what the PoC demonstrates.
• Closure discipline — every candidate ends in exactly one state: confirmed, ruled out (naming the control that stops it), or open (naming what would resolve it). "I moved on" is not a state.
• The methodology loop — recon, map, identify, exploit, validate, chain, report — as the model's native language.

Being a fork, it also keeps the parts of the harness I actually run day to day: a model picker that routes sessions across Claude, Cursor, GLM, and local Ollama models by real id, with 1M-context variants where available.

The scaffold (thesis platform)

The layered file system from my master's thesis that any agent context can be dropped into: an identity layer (CLAUDE.md), task routing (CONTEXT.md), a six-stage assessment pipeline, and a note funnel — notes → leads → gadgets → findings → reports — that acts as a validation gradient between raw observation and client-ready finding. Redis-backed RAG memory is shared across device assessments, so a quirk learned on one target is recalled on the next. Long sessions checkpoint to session-state.md before compaction, and an explicit autonomy mode runs the pipeline unattended.

The design idea

Two layers of control over the same agent: the scaffold is external process structure (stage gates, funnel, scope documents), the compiled identity is internal doctrine. Together the model behaves less like a general assistant following instructions and more like an operator who has internalized the methodology and can't un-read it.

Links

• Blog: 37 devices, zero passwords: auditing a smart home lab — the scaffold and harness in action