bhuvangupta/vapt-claude
Full-spectrum web application VAPT skill for Claude Code, OpenCode, Codex CLI & Gemini CLI — from reconnaissance to exploitation to remediation reporting
ARCHETYPE
Orchestrator
A bench of specialised subagents. The main agent mostly delegates.
Copy this rig
# review before running: this installs third-party code $ npx degit bhuvangupta/vapt-claude/agents ./rig-vapt-claude/agents $ npx degit bhuvangupta/vapt-claude/skills ./rig-vapt-claude/skills
MCP servers are added to Claude Code at local scope; env vars are shown as YOUR_… placeholders — we never store values. Files are fetched with degit into a separate folder so you can review before merging.
$ npx degit bhuvangupta/vapt-claude/skills/vapt-api .claude/skills/vapt-api $ npx degit bhuvangupta/vapt-claude/skills/vapt-auth .claude/skills/vapt-auth $ npx degit bhuvangupta/vapt-claude/skills/vapt-authz .claude/skills/vapt-authz $ npx degit bhuvangupta/vapt-claude/skills/vapt-cloud .claude/skills/vapt-cloud $ npx degit bhuvangupta/vapt-claude/skills/vapt-graphql .claude/skills/vapt-graphql $ npx degit bhuvangupta/vapt-claude/skills/vapt-headers .claude/skills/vapt-headers $ npx degit bhuvangupta/vapt-claude/skills/vapt-inject .claude/skills/vapt-inject $ npx degit bhuvangupta/vapt-claude/skills/vapt-logic .claude/skills/vapt-logic $ npx degit bhuvangupta/vapt-claude/skills/vapt-network .claude/skills/vapt-network $ npx degit bhuvangupta/vapt-claude/skills/vapt-recon .claude/skills/vapt-recon $ npx degit bhuvangupta/vapt-claude/skills/vapt-report-pdf .claude/skills/vapt-report-pdf $ npx degit bhuvangupta/vapt-claude/skills/vapt-report .claude/skills/vapt-report $ npx degit bhuvangupta/vapt-claude/skills/vapt-scan .claude/skills/vapt-scan $ npx degit bhuvangupta/vapt-claude/skills/vapt-setup .claude/skills/vapt-setup $ npx degit bhuvangupta/vapt-claude/skills/vapt-ssl .claude/skills/vapt-ssl $ npx degit bhuvangupta/vapt-claude/skills/vapt-websocket .claude/skills/vapt-websocket
$ curl -fsSL --create-dirs -o .claude/agents/vapt-auth-tester.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-auth-tester.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-logic-tester.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-logic-tester.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-passive-recon.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-passive-recon.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-service-scanner.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-service-scanner.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-surface-mapper.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-surface-mapper.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-vuln-tester.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-vuln-tester.md $ curl -fsSL --create-dirs -o .claude/agents/vapt-webapp-scanner.md https://raw.githubusercontent.com/bhuvangupta/vapt-claude/main/agents/vapt-webapp-scanner.md
This rig commits no guardrails. Here is the community baseline instead — the deny/ask rules most often found across all 7,204 rigs:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(**/.env)",
"Read(~/.ssh/**)",
"Bash(rm -rf *)",
"Read(**/*.pem)",
"Bash(rm -rf /)",
"Bash(git push --force:*)",
"Bash(sudo *)",
"Read(.env)",
"Bash(rm -rf /*)",
"Read(./.env.*)",
"Read(~/.aws/**)",
"Bash(git push --force*)",
"Bash(rm -rf:*)",
"Read(**/*.key)",
"Read(**/.env.*)",
"Bash(sudo:*)",
"Bash(git reset --hard*)",
"Bash(git reset --hard:*)",
"Read(.env.*)"
],
"ask": [
"Bash(git push:*)",
"Bash(git push *)",
"Bash(git commit:*)",
"Bash(rm *)",
"Bash(rm:*)",
"Bash(git rebase *)",
"Bash(wget *)",
"Bash(npm publish:*)",
"Bash(git commit *)",
"Bash(gh pr merge *)"
]
}
} Skills (16)
vapt-apivapt-authvapt-authzvapt-cloudvapt-graphqlvapt-headersvapt-injectvapt-logicvapt-networkvapt-reconvapt-report-pdfvapt-reportvapt-scanvapt-setupvapt-sslvapt-websocket
Subagents (7)
| vapt-auth-tester | — |
| vapt-logic-tester | — |
| vapt-passive-recon | — |
| vapt-service-scanner | — |
| vapt-surface-mapper | — |
| vapt-vuln-tester | — |
| vapt-webapp-scanner | — |
Similar rigs
rtk-ai/rtk
CLI proxy that reduces LLM token consumption by 60-90% on common dev commands. Single Rust binary, zero dependencies
Orchestrator 2.6k tok ·
Yeachan-Heo/oh-my-claudecode
Teams-first Multi-agent orchestration for Claude Code
Orchestrator 14.5k tok ·
alirezarezvani/claude-skills
380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8 more coding agents — engineering, marketing, product, complian
Orchestrator 48.5k tok ·
czlonkowski/n8n-mcp
A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you
Orchestrator 3.8k tok ·