Riciplay

Inspiration

My inspiration spins from multiple things.

The first is the fact that AI can be used greatly to help bug hunters, but we don't have many tools for that.

The rate at which vulnerabilities are found doesn't match the patch speed.

So I drew inspiration from CLI tools like Codex and Kilo, but instead of just code, you can use it to find bugs outside of code and inside it too.

The tool itself, just like many other AI tools, is meant to help solo workers.

What it does

Riciplay lets you run reconnaissance, scanning, and vulnerability hunting from your terminal — with AI autonomously chaining tools based on natural language commands. Type /recon example.com and the AI orchestrates subfinder, httpx, nmap, and katana.

How we built it

We first started out by building a web platform with scanner tools and AI integrated as another layer for smarter usage.

But we soon realized that any work done isn't usually done in a web interface, it's done in a terminal, and we moved our focus there, where we built a CLI and developed a credits system.

Challenges we ran into

At the beginning, the challenges we ran into were numerous — spanning from scanners not working properly, AI hallucinations, false positives, and even credits not deducting properly.

Accomplishments that we're proud of

We're proud of building the CLI system — it's certainly unique, with multiple tools directly accessible to AI and multiple systems to make it more efficient. For instance, a notebook meant for the AI to track facts for each target, which can be reused on another target; a /learn command that creates a skill from multiple successful sessions; a scheduler meant for security teams who want a routine check on their code for flaws; and its ability to write decently secure code. Safe to say, we've been able to bring out the most potential from a model in cybersecurity workflows.

What we learned

A lot of things were learned, including that no single model can do it all. That's why, even after a finding, the user (or the system automatically) calls a second model to verify reports. This model can't invent a finding, but will follow the exact details of a report to confirm its validity — it can mark inconsistencies, hallucinated inputs, and outright false claims, hugely reducing false positives from the main research engine. Once flagged, the system sends the results back for another re-evaluation, where the model can either discard the claim or do more work to prove the report. Along with that, we also discovered that AI isn't always good with TUI design, and it requires multiple iterations to get to something decent.

What's next for Riciplay

For now, Riciplay is going toward finding users — security teams, bug hunters, and even normal users who use AI in other work like coding.

We plan to train our own model in the future for more intuition into our CLI, and to be better overall at cybersecurity and workflows, along with finding out what works best for this niche of people and their workflows.

Built With

• css
• fastapi
• postgresql
• python
• react
• redis
• tailwind