bugb
bugb points guardlink and cxg at the same repository and runs them in a loop: an agent annotates the threats it can see, guardlink turns those annotations into an export, cxg attacks each one against a running target, and every threat ends with a verdict — confirmed, refuted, mitigation held, or an honest not tested with the reason recorded.
It is not a wrapper that shortens two commands. It is the part between them: the loop, the identities, the ordering, the deduplication, and the ledger that says what was actually proven.
The two tiers
Section titled “The two tiers”Everything bugb does falls on one side of a line, and the line is whether packets leave your machine.
| Model tier | Verify tier | |
|---|---|---|
| What it does | Reads code, writes and reads annotations, builds the threat model | Stands up a target, logs identities in, fires real exploit traffic |
| Sends traffic | No | Yes |
| Edits your repository | Annotations only, on a branch | Annotations only, on a branch |
| Needs | guardlink |
cxg, Docker, and a coding-agent CLI |
| Commands | model, inspect, annotate, plan, ledger, ci, dashboard, mcp |
auto, run, round, replay, env |
The model tier is where to start: it needs one dependency, sends nothing anywhere, and produces the threat model that the verify tier later attacks. See Build your first threat model.
The verify tier sends real exploit traffic and lets a coding agent edit the target repository. It is only for systems you are authorised to test — see Authorization and blast radius.
Four surfaces, one engine
Section titled “Four surfaces, one engine”The CLI is the only thing that executes a run. Everything else reads what it produced, or hands you the command to run.
These pages link into cxg and guardlink — they do not restate them
Section titled “These pages link into cxg and guardlink — they do not restate them”bugb drives two documented products. Most of what a reader needs about a scan
flag, an annotation, or a SARIF field is already under /cxg/ and
/guardlink/. Copying it here would cost three things:
- Accuracy. A copy has no build step tying it to the original. cxg’s reference is generated from the shipped binary; a paraphrase of it here is stale the next time a flag changes.
- Search ranking. Two pages competing for one query split their signal, and the search engine picks one — often the wrong one.
- Reader trust. Two similar pages with different details means neither is believed.
So a page here covers what is genuinely bugb’s — the loop, the ledger, the verdicts, the ordering — and links out for the rest:
Each goal becomes a
cxg pentestinvocation. For what those flags do, seecxg pentest.
If a cxg page is not good enough to link to, the fix is to that page.