kamikos

Kosa is an agentic Attack/Defense CTF toolkit. In a typical eight-hour ad ctf, a team has to repeat the same loop every minute: watch scoreboard, inspect suspicious network flows, reconstruct working exploits, patch vulnerable services without breaking the checker, and attack dozens of other teams before they fix the bug. At that pace, the challenge becomes less about individual hacking skill and more about keeping the whole workflow synchronized. Kosa wraps that loop around a Claude Opus 4.7 dispatcher. It ingests scoreboards from FAUST, Enoflag, and ATKLAB; consumes traffic from Tulip, pcaps, and JSON logs; reconstructs exploit candidates from observed flag-stealing flows; proposes patches; validates them against the live checker; and deploys through gated approval. Every action is auditable and constrained by explicit allowlists. Kosa supports two modes: manual mode, where Kosa acts as a dashboard and gated submitter, and autonomous mode, where the dispatcher drives the loop end to end. It is designed to complement existing A/D tooling such as Tulip for traffic capture and Ataka for exploit farming, rather than replacing them. Kosa also ships with a fully Dockerized three-team A/D lab, letting you run the entire workflow locally in about five minutes.