How ARTEX works:a planner, three workers and a guard, over two graphs.

The ARTEX loop:plan, work, guard, prove, then plan again.

1. 01

   Plan

   A change in the graph wakes the planner. It reads coverage and scope, updates its todolist and dispatches intents, each tied to an asset.

2. 02

   Work

   Three workers by default. Each claims one intent, runs real tools like nmap, curl and Playwright, writes facts and findings back, then stops.

3. 03

   Guard

   Every tool call passes intercept rules, then an LLM judge, then a human. All traffic runs through a recording proxy on port 8788 as evidence.

4. 04

   Prove

   Each write wakes the planner again until prove_goal closes the goal. A reporter merges duplicates, a retester checks fixes.

01Planner wakes and dispatches intents02Three workers run tools in parallel03Rules, then judge, then human04prove_goal closes the goal

REC :8788Rules>Judge>Human

1. 01A graph change wakes the planner (debounced, about 800 ms).
2. 02The planner reads graph_overview, coverage and scope.
3. 03It dispatches 0 to N intents into the frontier queue.
4. 04A worker claims one intent and loads its assets.
5. 05The worker runs tools through the guard and the recording proxy.
6. 06It writes facts, assets and findings back to both graphs.
7. 07The write wakes the planner again, until prove_goal.

1. 01

   Create a task

   A description, targets, an optional template, per-task allow and block rules, and an ordered chain of LLM profiles. A task can inherit facts from earlier tasks.

2. 02

   Load the assets

   Assets enter the shared asset graph, typed by the agent or imported from ScopeSentry. DNS and HTTP enrichment runs in the background.

3. 03

   Split into goals

   The goals agent breaks the task into goal nodes and pulls out the scope.

4. 04

   Plan

   The planner wakes, reads the graph overview, coverage and scope, updates its todolist and dispatches intents tied to assets. Blocked assets are refused here.

5. 05

   Work

   Workers, 3 by default, each claim one intent and run real tools through the guard and the recording proxy.

6. 06

   Write back

   Workers write facts, new assets, optional credentials and findings, each with evidence and the captured traffic.

7. 07

   Repeat

   Every write wakes the planner again, until the goals are proven or the budget or time runs out. A worker gets 1,200 seconds by default.

8. 08

   Report

   A reporter writes one report per finding, merges duplicates of the same defect into vuln folders and can push alerts to chat apps. A retester re-checks fixes.

9. 09

   Steer

   People can step in at any time: chat with the main agent, add hints, message a running worker, pause it, or ask a /btw side question.

• Engine

  server/engine.go

  One planner loop and N worker routines per task. Claims intents, handles timeouts, pause and drain.

• Goals agent

  agent/goals.go

  Breaks a task into goals and extracts the scope.

• Planner

  agent/planner.go

  The only agent that creates intents. Keeps a shared todolist across wake-ups so multi-step chains stay in order.

• Worker

  agent/worker.go

  Claims one intent, runs tools, writes results back to both graphs, then stops.

• Main agent

  agent/mainagent.go

  The chat agent inside a task. A person can talk to it and it can add intents and hints.

• Reporter and retester

  agent/finding_recorder.go

  Writes finding reports, merges duplicates into vuln folders and re-tests a finding as reproducible, fixed or unconfirmed.

• Guard

  guard/, intercept/

  Checks every tool call: intercept rules, then an LLM judge, then human approval. Keeps an audit log.

• Traffic recorder

  traffic/

  A recording proxy with its own certificate authority on port 8788. All worker HTTP and shell traffic is saved as evidence.

• Enrich

  enrich/enrich.go

  Resolves DNS and HTTP details for new assets in the background.

• LLM pool

  llmpool/, llmrec/

  Holds the model profiles, fails over between them and records raw requests and replies.

• Notify

  notify/

  Pushes findings to DingTalk, Feishu, WeCom, Telegram, email or a webhook, live or as a 30 minute digest.

• Self update

  selfupdate/

  One-click update from GitHub Releases with checksum, smoke test and rollback after 3 failed boots.

1. Intercept rules

   v0.3.15

   Allow and deny rules, plus built-in rules for destructive calls like HTTP DELETE and delete-like paths.

2. LLM judge

   v0.3.11

   Reviews calls the rules do not settle. Since v0.3.23 a judge failure falls back to human approval instead of letting the call through.

3. Asset blocklist

   v0.3.13

   Blocks .gov, .gov.cn, .edu and .edu.cn by default, with per-task allow and block lists on top.

4. Script review

   v0.3.18

   The judge sees a snapshot of each script: path, size and SHA-256. An incomplete snapshot forces human review.

5. Basic Auth

   v0.3.16

   Optional HTTP Basic Auth in front of the console, added by RuoJi6.

6. Recording proxy

   All tool traffic runs through the proxy on port 8788, so every request a worker makes is kept as evidence.

The open code once had a rules-of-engagement scope check. It was removed, and ThreatBook says the open edition has no built-in safety controls.

tools exposed to the LLM

31

PostgreSQL tables

60

LLM wire formats

4

workers per task by default

3

Backend

Go 1.26, one binary, REST API with server-sent events

Console

Next.js 16, React 19, Tailwind 4, embedded in the binary

Agent SDK

norma v0.4.3 by Autumn-27, Apache-2.0, still public

Main store

PostgreSQL 16: both graphs, tasks, findings, settings, 60 tables

Traffic store

SQLite under ./data

Port 8787

Web console, API and live stream

Port 8788

Recording proxy, bound to localhost in Docker Compose

Docker image

ruoji6/artex for amd64 and arm64. The original autumn27/artex is gone

Code size

173,504 lines in v0.3.25: Go 100,569, TypeScript 62,418

History

458 commits, first on 2026-07-26

License

AGPL-3.0