Roadmap¶

Released¶

Multi-vendor LLM support via LiteLLM (OpenAI, Anthropic, AWS Bedrock, Google, and more)
LLM-as-a-Judge detection for nuanced semantic analysis
Amazon Bedrock Agent and AgentCore adapters
Dependency capping and compatibility hardening

Streaming support — SSE and WebSocket protocol handlers for real-time attack monitoring
Multi-agent coordination — Topology discovery, individual and cross-agent scanning for supervisor, router, peer-to-peer, hierarchical, and pipeline architectures
Adaptive campaigns — Three execution strategies: fixed (sequential), adaptive (rule-based), and LLM-adaptive (LLM-driven phase orchestration)
Campaign strategy protocol — Extensible interface for custom campaign strategies
327 multi-agent attack vectors — Cross-agent prompt injection, delegation chain manipulation, shared memory poisoning
18 runnable examples — Including multi-agent, streaming, and adaptive campaign demos

Autonomous pentesting agent — An LLM-powered agent that plans, executes, and adapts attack campaigns with minimal human intervention
Attack chain reasoning — The agent reasons about discovered vulnerabilities to chain multi-step exploits
Interactive red-team mode — Collaborate with the pentesting agent in a conversational interface
Finding deduplication — Intelligent merging of related findings across automated and agent-driven scans

Browser-based agent scanning — Headless Playwright adapter for testing agents exposed via web chat UIs
Network interception — Primary extraction via intercepted API calls (WebSocket, SSE, HTTP)
DOM fallback — Secondary extraction from rendered page content when network interception is unavailable

Expanded tool chain patterns — Grew from 32 to 102 dangerous patterns across 15 categories (cloud services, MCP, A2A, CI/CD, browser, crypto, and more) via YAML registry with custom pattern support
Encoding/obfuscation engine — 8 encoding types (Base64, ROT13, leetspeak, homoglyph, hex, whitespace, mixed case, payload split) with composable pipelines via --encoding flag
Multi-turn jailbreak tactics — Crescendo, context buildup, persona shift, and distraction tactics for progressive escalation within campaign phases
BOLA/BFLA authorization testing — Authorization bypass detector and 20 attack vectors for Broken Object/Function Level Authorization testing
Promptfoo provider bridge — Use ZIRAN as a custom Python provider for Promptfoo, enabling configuration-driven security testing with YAML test cases
OpenTelemetry tracing — Opt-in distributed tracing for campaigns, phases, attacks, and detection with zero overhead when disabled

[ ] Auto-generated fix suggestions — Concrete code patches and guardrail configurations for discovered vulnerabilities
[ ] Guardrail templates — Pre-built guardrail configurations for common agent frameworks
[ ] Remediation validation — Re-scan after applying fixes to verify remediation effectiveness
[ ] Security policy generator — Generate policy files from scan results

[ ] ZIRAN as an MCP server — Expose scanning capabilities via the Model Context Protocol, enabling any MCP-compatible client to trigger scans
[ ] Tool-based scanning interface — Scan agents, browse results, and manage campaigns through MCP tool calls
[ ] Integration with AI IDEs — Use ZIRAN directly from Cursor, Windsurf, Claude Desktop, and other MCP clients
[ ] Continuous monitoring — Long-running MCP server mode for periodic security assessments

[ ] Custom chain rule language — User-defined tool chain patterns complementing ZIRAN's auto-discovery
[ ] Community chain patterns — Crowdsourced dangerous tool chain submissions (like Skill CVEs but for tool compositions)
[ ] AgentSecBench — Purpose-built benchmark: vulnerable agents with known tool chain vulnerabilities, demonstrating what ZIRAN catches that other tools miss
[ ] Tool chain methodology paper — Publish the discovery-based approach as research
[ ] Community CVE portal — Web-based CVE submission and search
[ ] Agent benchmarking — Comparative security scoring across agent versions
[ ] Compliance reports — SOC 2, ISO 27001, and NIST AI RMF report templates