Struct RunConfig 

pub struct RunConfig {

    pub replay_stable_check: bool,
    pub allow_state_changing_live_probes: bool,
    pub browser_checks_enabled: bool,
    pub exploit_mode_enabled: bool,
    pub exploit_dry_run: bool,
    pub business_logic_templates_enabled: bool,
    pub research_mode_enabled: bool,
    pub unsafe_attack_agent_enabled: bool,
    pub business_logic_template_ids: Vec<String>,
    pub exploit_request_cap: Option<u32>,
    pub exploit_requests_per_second: Option<u32>,
    pub exploit_reset_after_state_changing: bool,
    pub enable_zap_baseline: bool,
    pub enable_nuclei: bool,
    pub enable_trivy: bool,
    pub enable_osv_scanner: bool,
    pub enable_secret_scanning: bool,
    pub enable_katana: bool,
    pub enable_httpx: bool,
    pub enable_aggressive_sqlmap: bool,
}

[run] section: verifier knobs.

Fields

replay_stable_check: bool

When true, the deterministic payload runner re-executes each (vuln, benign) pair a second time and stamps replay_stable on the resulting VerifyResult. Adds ~2× cost per verify; default is false so the verifier stays fast on the happy path.

allow_state_changing_live_probes: bool

Allow live verification plans to send methods that are likely to mutate target state (POST, PUT, PATCH, DELETE). Defaults to false so Nyx Agent only runs safe probes unless the operator explicitly opts in for their local app.

browser_checks_enabled: bool

Opt in to browser-driven checks when a local Playwright runtime is available. When false, browser plans are recorded as skipped with an explicit reason.

exploit_mode_enabled: bool

Master opt-in for exploit mode. Defaults to false; when false, live verification stays non-destructive even if an older config sets allow_state_changing_live_probes = true.

exploit_dry_run: bool

Evaluate guarded live probes and write audit records without sending HTTP/browser traffic. Static analysis and source-only scanners still run normally.

business_logic_templates_enabled: bool

Generate first-class business-logic pentest candidates from the route/auth model. The generated plans still pass through the normal live-verifier safety gates.

research_mode_enabled: bool

Enable deeper authorized product-logic research. This adds invariant-focused candidate hypotheses and gives AI planning / exploration a broader product-logic brief. It does not relax live execution safety gates.

unsafe_attack_agent_enabled: bool

Enable the pre-MVP unsafe local attack-agent phase. Once this final phase is invoked it does not route actions through the guarded live-verifier policy; it relies on the configured local development environment and CLI-backed sandbox boundary.

business_logic_template_ids: Vec<String>

Optional allowlist of business-logic template ids. Empty means every registered template is considered.

exploit_request_cap: Option<u32>

Per-candidate cap on guarded live HTTP/browser actions. None falls back to RunConfig::DEFAULT_EXPLOIT_REQUEST_CAP; a configured 0 is floored to 1.

exploit_requests_per_second: Option<u32>

Per-candidate rate limit for guarded live requests/actions. None falls back to RunConfig::DEFAULT_EXPLOIT_REQUESTS_PER_SECOND; 0 floors to 1.

exploit_reset_after_state_changing: bool

After an allowed state-changing probe, ask the environment orchestration layer to reset/rollback when it supports that operation. Defaults true so opt-in exploit runs clean up after themselves when docker-compose orchestration is available.

enable_zap_baseline: bool

Optional passive ZAP baseline orchestration. Enabled by default, but the binary is only used when present on PATH; findings become candidates.

enable_nuclei: bool

Optional Nuclei orchestration. Enabled by default, but the binary is only used when present on PATH; findings become candidates.

enable_trivy: bool

Optional Trivy repository/filesystem scan. Enabled by default, but the binary is only used when present on PATH; findings become source-context candidates for AI exploration.

enable_osv_scanner: bool

Optional OSV-Scanner dependency scan. Enabled by default, but the binary is only used when present on PATH; findings become source-context candidates for AI exploration.

enable_secret_scanning: bool

Optional secret scanning. Enabled by default; Nyx Agent prefers gitleaks when present and falls back to detect-secrets.

enable_katana: bool

Optional Katana crawler orchestration. Enabled by default, but the binary is only used when present on PATH; sensitive routes become live-test candidates.

enable_httpx: bool

Optional ProjectDiscovery httpx probe orchestration. Enabled by default, but the binary is only used when present on PATH; interesting live metadata becomes candidates.

enable_aggressive_sqlmap: bool

Aggressive external tooling is off unless this explicit gate is true. Nyx Agent does not run sqlmap by default.

Implementations

impl RunConfig

pub const DEFAULT_EXPLOIT_REQUEST_CAP: u32 = 10

Default request/action cap for one candidate live-verification attempt. This keeps malformed or model-generated workflows from fanning out indefinitely.

pub const DEFAULT_EXPLOIT_REQUESTS_PER_SECOND: u32 = 5

Default per-candidate live request/action rate. Optional scanners have their own CLI-level throttles; this cap covers the built-in verifier.

pub fn exploit_request_cap_resolved(&self) -> u32

pub fn exploit_requests_per_second_resolved(&self) -> u32

pub fn state_changing_live_probes_allowed(&self) -> bool

Trait Implementations

impl Clone for RunConfig

fn clone(&self) -> RunConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RunConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for RunConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for RunConfig

where RunConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for RunConfig

fn eq(&self, other: &RunConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for RunConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for RunConfig

impl StructuralPartialEq for RunConfig