Yoseph's Tools

Running conversations

-

Total vulnerabilities

-

No new risks

Tool call count

-

Tool execution success rate

-

Running smoothly

Vulnerability severity distribution

View all →

Risk level Security

Weighted risk score 0

Pending

0 Critical

0 High

Recent discoveries None

0

Total vulnerabilities

Critical 0 0%

High 0 0%

Medium 0 0%

Low 0 0%

Info 0 0%

0 Pending

0 Confirmed

0 Fixed

0 Ignored

0 False positive

Fix rate 0% (0 / 0)

Fixed Confirmed Pending

View all →

No recent vulnerabilities

Batch task queue

View all →

-

- Pending execution

- Running

- Completed

Tool executions

View all →

No data

Capability overview

MCP Tools - Skills - Knowledge - Roles - Agents -

Start your security journey

Describe the target in a conversation andAI will help run scans and vulnerability analysis

Conversation groups

Recent conversations

AI Channel, reasoning settings and human-machine collaboration only affect subsequent messages.

AI

AI Channel

Mode

Reasoning intensity

Human-machine collaboration

Mode

Approver

can switch between manual and audit Agent at any time; rules and whitelist stay unchanged. It can also be preselected when human-machine collaboration is "off".

Whitelisted tools (no approval needed, comma-separated)

One per line or comma-separated; merged with the config global whitelist in

Current approver

Applies to the currently selected conversation; saved locally when none is selected and reused for new conversations. Takes effect immediately after switching.

Search

Loading...

Latest execution records

Tool search Filter by status

Loading...

MCP Tool configuration

External MCP Configuration

Total knowledge items -

Category count -

Total content -

Filter by category

Search

Loading...

Total retrievals -

Successful retrievals -

Success rate -

Knowledge items retrieved -

ConversationsID MessageID

Loading...

Total assets

Assets currently under continuous monitoring

0

IP Count0

Domain count0

Port count0

ProtocolAsset shareCountShare

No data

7 DAYS

last 7 days discovered0

—

Trend changes

Observe asset and risk changes over the selected period

Asset growth/decline trend

New discoveries and currently disabled assets

New assetsDisabled assets

Loading...

Risk discovery trend

New vulnerabilities and the high-risk & critical risks among them

New vulnerabilitiesHigh and critical

Loading...

Scan coverage

Identify asset gaps that are unscanned or not rechecked for a long time

—

0%Overall coverage

Scanned assets0Completed at least one scan

last 30 day coverage00%

Never scanned0Recommended for scanning

over 30 days without a scan0Scan results may be outdated

	Target	Service	Project	Ownership	Last scan	Related vulnerabilities	Risk level	Status	Actions
No data

01 Data source

Support FOFA、ZoomEye、Quake、Shodan;API Key can be configured in System Settings or environment variables.

02

Query method

Natural language (optional,AI parses into query syntax)

After parsing, a popup shows the corresponding data source syntax (editable); once confirmed, it is filled into the query box and executed.

Query syntax (editable, queryable directly)

After selecting a data source, the corresponding query syntax hint is shown.

03

Return configuration

Return count

Page number

full

Different data sources may have different per-request return limits.

04 Return field names (comma-separated)

Query results

-

No data

Select or create a project

Projects share a "fact blackboard" across conversations: target, environment, authentication and other info is auto-injected into conversations bound to the project.

Projects

In progress

0 facts 0 vulnerabilities 0 conversations

Key	Category	Summary	Relationships	Body	Confidence	Update	Actions

Node TARGET · Target INFRA · Infrastructure FINDING · Discovery VULN · Vulnerability EXPLOIT · Exploit MISSING · Missing

Edges discovered_on leads_to exploits Pending confirmation (dashed)

Target	Service	Title/Fingerprint	Source	Recent discoveries	Status	Actions

Title	Update	Actions

Title	Severity	Status	Actions

Project settings

Configure project metadata and Agent authorization boundaries; takes effect immediately on bound conversations after saving.

Basic info

Name and description are shown in the project details

Project name

Status

Pinned project (shown first in the list)

Description For team members only;Agent will not read it. Keep it brief (up to 4000 characters). Anything the Agent must know goes into the fact blackboard

Test scope

JSON format for the Agent to understand authorization boundaries and target assets

Support targets、exclude、notes fields; leave empty to set no scope restrictions.

Dangerous actions

After archiving, tick "Show archived" in the list to view it; deleting clears all facts and is irreversible.

Total vulnerabilities

-

Critical

-

High

-

Medium

-

Low

-

Info

-

Loading...

Select a connection from the left, or add a new WebShell Connection

Manage files uploaded in conversations. Drag files into the list area below, or click "Upload file" to select files (multiple selection supported). To have AI reference a file, click "Copy path" in the list and paste it into the conversation.

Conversation ID Projects ID File name Source Grouping

Loading…

Quick

Status Type Conversation ID

One-line Payload

Quickly generate a reverse-shell command executable on the target, supporting Bash / Python / PowerShell / Curl

Listeners

Type

callback address (Optional)

Compile Beacon binary

Cross-compile a complete multi-platform Beacon executable, supporting Linux / Windows / macOS

Listeners

Callback address (optional)

Target system

Target architecture

Quick

Level Category Conversation ID

Workflow list

Loading...

Node library

Untitled workflow

Drag nodes from the left onto the canvas, or generate a workflow in natural language

Properties

Select a node or edge to edit its properties

Loading...

Call statistics

Loading...

SkillsCall statistics

Loading...

Skills 0

Current page 0

Files 0

Scripts 0

Loading...

sub- Agent maintained only under the agents directory as .md files.

Loading...

Basic settings

Human-machine collaboration

Asset management

Knowledge base

C2

Robot settings

Terminal

Security settings

Log audit

Basic settings

AI Channel configuration

Switch saved channels via the dropdown; on save it is written to ai.channels. The default channel is used for new conversations and tasks without a specified channel.

Current channel

Edit the currently selected channel

-

Connection info

Confirm the provider, address, key and model first; the connection test uses this information.

Channel name

API Provider

Base URL *

API Key *

Model *

Fetch list

Quota settings

Token limits control the context window and single-turn output.

Max context Token count Memory compaction and attack-chain construction share this setting, default 120000

Max output Token count Max output for a single model reply, default 16384

Reasoning settings Acts as the default reasoning settings for this AI channel; the chat page "Conversation settings" can override them.

Mode

Intensity

Routing

Allow the chat page to override reasoning options

Visual analysis (analyze_image）

Enable the analyze_image Registers the MCP tool when enabled; images only appear in a single VL call, whileAgent context keeps a text summary only.

Provider

Base URL

API Key

Vision model *

Fetch list

Advanced: preprocessing & limits

Raw file limit (bytes)

Long-edge scale (pixels)

JPEG quality

sent API size limit (bytes)

Files below this byte size are uploaded as-is 0 always means JPEG compression; both the long-edge and payload limits must be satisfied.

Image detail

Timeout (seconds)

Test connection

Agent Configuration

Max iterations

External MCP per-round wait (seconds) Agent Per-round limit for waiting on a tool; when it expires, an execution_id，worker is returned and the worker keeps running in the background. Use wait_tool_execution to keep waiting.0 waits until completion.

per- MCP concurrency limit Tools running simultaneously per external MCP server ;0 Use default 2，-1 unlimited.

External MCP global concurrency limit Total concurrency across all external MCP tools;0 Use default 16，-1 unlimited.

MCP circuit-breaker failure threshold The same MCP server temporarily breaks the circuit after consecutive failures past the threshold;0 Use default 3，-1 disables the circuit breaker.

MCP circuit-breaker cooldown (seconds) server cooldown wait time after a circuit break;0 Use default 60 seconds.

Enable Eino multi-agent When enabled, the chat page offers "multi-agent" mode; sub-agents are configured under config.yaml’s multi_agent.sub_agents or in the agents directory.

plan_execute outer loop limit only orchestration=plan_execute takes effect;execute and replan maximum rounds between

Default robot conversation mode WeCom (WeChat Work) / DingTalk / robots use this execution mode for every message;Deep / Plan-Execute / Supervisor requires multi-agent mode enabled.

Advanced settings

User raw-text ledger total character limit Total limit of the raw user-input ledger injected into the model context after compression;0 uses the backend default.DB raw messages are never trimmed.

Per-message user raw text limit Model-visible limit for a single user message in the ledger;0 uses the backend default and does not affect the raw DB text.

Latest user input character limit The latest user entering the model context this round; when exceeded, the full text is persisted and only a preview is injected.0 uses the backend default.

Latest user input head preview overlong latest user Head characters kept for the model.

Latest user input tail preview overlong latest user Tail characters kept for the model.

Human-machine collaboration

Approval configuration

Global default approver Unselected conversations and new conversations use this approver by default; the conversation sidebar can still override it temporarily.

Audit Agent model

API Provider

Base URL

API Key

Approval model

Fetch list

audit-only Agent is used during approval; manual approval does not consume the model.

Test audit model

Audit log retention days for decided items 0 disables auto-cleanup; leave empty for the default of 90 days.

No-approval tool whitelist One per line or comma-separated; whitelisted tools do not trigger human-machine collaboration approval.

Audit Agent policy

Approval mode prompt Leave empty to use the backend built-in default policy.

Review-edit mode prompt Review-edit mode can editedArguments narrow parameters before allowing.

Asset management

FOFA Configuration

Used for asset discovery and import; only the API Key。

Base URL Leave empty to use the default address.

API Key Only stored in the server configuration (`config.yaml`）。

ZoomEye Configuration

Used by the info collection page to call ZoomEye API; the environment variable ZOOMEYE_API_KEY。

Base URL Leave empty to use the default address.

API Key Only stored in the server configuration (config.yaml）。

Quake Configuration

Used by the info collection page to call 360 Quake API; the environment variable QUAKE_API_KEY。

Base URL Leave empty to use the default address.

API Token Only stored in the server configuration (config.yaml）。

Shodan Configuration

Used by the info collection page to call Shodan API; the environment variable SHODAN_API_KEY。

Base URL Leave empty to use the default address.

API Key Only stored in the server configuration (config.yaml）。

Knowledge base settings

Knowledge base configuration

Enable knowledge retrieval

Knowledge base path Path relative to the directory of the configuration file

Embedding model configuration

Provider

Base URL Leave empty to useOpenAIconfiguredbase_url

API Key Leave empty to useOpenAIconfiguredapi_key

Model name

Fetch list

Retrieval configuration

Top-K result count Top-K results returned by retrievalTop-Kresult count

Similarity threshold Similarity threshold (0-1); results below it are filtered out

Sub-index filter (optional) Leave empty to not filter; when set, only vector rows whose sub_indexes contain the tag are retrieved (legacy untagged data still matches).

RAG pipeline (MultiQuery + Rerank）

MultiQuery and reranking are always enabled:LLM rewrite & multi-route retrieval → vector prefetch & fusion → HTTP Rerank → dedup & budget truncation.

MultiQuery rewrite variant limit LLM Maximum number of generated retrieval variants (covers the original query semantics); 3~4recommended, max 8。

Rerank provider DashScope uses gte-rerank; other compatible endpoints use /v1/rerank. When empty, it is inferred automatically from the Base URL below.

Rerank model (optional)

Rerank Base URL（Optional）

Rerank API Key（Optional） On rerank failure, automatically falls back to fusion ranking; retrieval still works.

Post-retrieval processing (dedup / budget)

Retrieval results are automatically deduplicated by normalized content (merging duplicates that differ only in whitespace); no configuration needed.

Prefetch candidates (vector stage) per MultiQuery variant;0 uses the built-in max(top_k×4, 20)(cap 200）。

Max returned content characters (Unicode） 0 means unlimited; chunks are kept whole in retrieval order, chunklater chunks are dropped once the limit is exceeded.

Max returned content Token count 0 means unlimited;tiktoken estimation (matches the embedding model name, falls back to cl100k_base）。

Index configuration

Chunking strategy Consistent with the official Eino index chain: Markdown heading + recursive is recommended for technical docs; plain text can use recursive only.

Embedding HTTP Timeout (seconds) 0 uses the default of 120 seconds; consistent with the OpenAI embedding client.

Embedding batch size Max texts per embedding request (SQLite index writes are batched).

Indexing prefers reading from on-disk source files (Eino FileLoader） When enabled, file_path takes precedence; falls back to the content。

Eino sub-indexes (comma-separated) Pass indexer.WithSubIndexesto write the sub_indexes field of the vector row (logical partition marker).

Chunk size (Chunk Size） Max token count (default 512per chunk (default 512); long texts are split into multiple chunks

Chunk overlap (Chunk Overlap） Overlapping token count (default 50between chunks (default 50) to keep context coherent

Max chunks per knowledge item Maximum chunks per knowledge item (0 = unlimited), preventing a single file from consuming too much API quota

Max requests per minute (Max RPM） Max requests per minute (default 0 = unlimited), e.g. OpenAI Default 200 RPM

Request interval delay (ms) Request interval in milliseconds (default 300) to avoid API rate limits; set to 0 unlimited

Max retries Max retries (default 3); retries automatically on rate limits or server errors

Retry interval (ms) Retry interval in milliseconds (default 1000); the delay increases with each retry

C2 Settings

built-in C2

Enable built-in C2(listeners, sessions,Payload、MCP tools, etc.) When disabled, listeners are not started and C2 -related MCP tools are not registered; the sidebar C2 entry is hidden. Turn it off to save resources when you only use chat and the knowledge base locally.

Robot settings

Configure WeCom, DingTalk, Feishu and other robots to chat with Yoseph's Tools directly on your phone, without opening a web page on the server.

Robot vulnerability alerts Push newly discovered vulnerabilities by severity level to the robot bound to the current account.

Enable reminders

Minimum level

Push newly discovered vulnerabilities matching the level through the bound robot account.

Select a robot to start configuring

Click an existing platform in the list above, or click“New robot”to create by type.

Robot command reference

View the Chinese/English commands available in robot conversations, including identity auth, conversations, roles, modes, projects and security diagnostics.

Terminal

Execute commands on the server for operations and debugging. Commands run server-side; do not run sensitive or destructive operations.

Terminal 1

Log audit

Quick

Event type

Result

Start time

End time

Keyword

Security settings

Change password

After changing the login password, you must sign in again with the new password.

Current password

New password

Confirm new password

0 accounts

0 enabled accounts

0 roles

0 grants

User

Manage roles and resource scopes after selecting an account.

0

Loading...

Select user

After selecting a platform user, edit roles, status and resource authorizations.

Sign in Yoseph'sTools

Dashboard

Vulnerability severity distribution

Recommended actions

Batch task queue

Tool executions

Recent events

Capability overview

Select project

Select role

Conversation mode

Human-machine collaboration approval

MCP Status monitoring

Latest execution records

MCP Management

MCP Tool configuration

External MCP Configuration

Knowledge management

Retrieval history

Asset overview

Protocol distribution

Trend changes

Asset growth/decline trend

Risk discovery trend

Scan coverage

Asset library

Info collection

Project management

Select or create a project

Basic info

Test scope

Dangerous actions

Vulnerability management

WebShell Management

File management

Task management

Listener management

Conversation management

Task management

Payload Generate

One-line Payload

Compile Beacon binary

Event audit

Traffic masking

Workflows

Untitled workflow

Role management

SkillsStatus monitoring

Call statistics

SkillsCall statistics

Skills Management

Agent Management

Edit Agent

System settings

Basic settings

AI Channel configuration

Connection info

Quota settings

Visual analysis (analyze_image）

Agent Configuration

Human-machine collaboration

Approval configuration

Audit Agent model

Audit Agent policy

Asset management

FOFA Configuration

ZoomEye Configuration

Quake Configuration

Shodan Configuration

Knowledge base settings

Knowledge base configuration

Embedding model configuration

Retrieval configuration

RAG pipeline (MultiQuery + Rerank）

Post-retrieval processing (dedup / budget)

Index configuration

C2 Settings

built-in C2

Robot settings

Robot management