ax0080

Scope is an autonomous penetration-testing agent you can safely point at your own systems. Security testing is scarce and expensive, and most people won't hand an AI agent live network access — an unbounded agent could hit the wrong target. Scope solves that trust problem at the core: a deny-by-default scope allowlist, enforced in code (not in a prompt), checks every action and scans free-form shell/Python for out-of-scope targets before anything runs. The model can be as creative as it likes; it cannot step outside the authorized range. A second rule keeps it honest: a finding is only recorded when the exploit actually succeeds, backed by a reproducible request/response — never a guess. A hard cost limit bounds every run. In testing it autonomously chained a boarding-pass SQL injection into remote code execution on a live HackTheBox machine with no public write-ups — entirely within scope, with zero out-of-scope attempts.