Introduction

Your agent tests. Red Clippy keeps the record.

Red Clippy is open-source pentest management built to be operated by an AI agent. Connect it to Claude Code, Codex, or any other client that supports MCP, and it runs the engagement alongside you: scope and assets, recon observations, methodology coverage, and findings with CVSS and evidence.

Everything it writes goes into a SQLite database and shows up in the web panel straight away, where you can edit or delete any of it. The panel, the REST API and the MCP server all work on the same data.

It ships as a single binary. No installer, no runtime to set up, and no database server to run.

Who this manual is for

Testers who want an agent’s speed without giving up the discipline of a real engagement: work that does not get repeated, findings that do not evaporate between sessions, and nothing reaching the report that was never proved. The agent is the intended operator, but nothing here requires one, and everything it writes you can write yourself.

Working with an agent comes first, because that is what Red Clippy is for. Using the panel then covers the browser side screen by screen, for the work you do yourself and for reviewing what the agent did. Administration holds the things you set up once: members, the config file, the command line. Developer reference documents the API, the MCP tools and the data model, for anyone building against Red Clippy rather than using it.

If you just want the server running, start with Install and first run.

Background

A coding agent with a shell is a genuinely capable tester. It runs the same tools you do and it covers ground quickly. What it does not have is a memory that outlives its context window. When the window fills, the engagement goes with it: the next session rescans hosts it already cleared, re-tests what it already ruled out, and cannot tell you which parts of the scope were ever touched. A confirmed SQL injection ends up somewhere in a transcript nobody kept.

Red Clippy gives an agent two things it does not have on its own.

Somewhere to put the work. Every asset, observation, check and finding is written to the database as testing happens. Coverage becomes something you query rather than something you remember: which assets exist, which checks are cleared on each, what has already been reported. Tomorrow’s session starts where the last one stopped.

Rules to work by. A Red Team Instructions document is handed to the agent during the MCP handshake, before it does anything: verify before reporting, prove every claim, take the minimum access needed to show impact, leave third-party systems alone. You can override that document per organization and per engagement, because house rules differ between teams and clients.

You stay in the loop throughout. Everything the agent writes is an ordinary row you can read, correct, reclassify or delete in the browser.

Warning

Authorised testing only. Red Clippy is a tool for testers working under an engagement. Test only systems you own or have explicit written permission to assess. Scope marking and the Red Team Instructions exist to keep an agent inside the rules of engagement, but they are guardrails, not authorisation. An agent acts on your authority, and you remain responsible for everything it does.

Disclaimer

The screenshots here come from a demonstration database. “Northwind Retail” is not a real customer. Its hostnames use the reserved .test and example.com domains (RFC 2606) and its addresses come from the ranges reserved for documentation, 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737). None of them is allocated to anyone or routable on the internet. Nothing in this documentation describes a real target, a real engagement, or a real vulnerability.