Reptor

AI-powered pentest reporting assistant. Merge, deduplicate, estimate CVSS, generate evidence screenshots, and populate SysReptor — all from two PDFs.

Quick Start · Features · How It Works · Environment Variables · Contributing

---

✨ Features

• Dual report parsing — LLM-driven extraction from any format (Klue autonomous or manual pentester). Finds fields by content, not header position. Works with PDF, DOCX, Markdown, and TXT.

• Smart merge — LLM matches findings across both reports by semantic meaning, not just keyword overlap. Field-level authority rules: Klue wins for PoC/CVSS/CWE, Manual wins for impact/recommendation.

• Conflict resolution — LLM resolves severity and title conflicts with reasoning. Each resolution shows Klue vs Manual vs LLM choice — override any field with one click.

• CVSS estimation — LLM estimates the attack-context metrics, then a full brute-force search of all 5,184 vector combinations guarantees the computed score matches the source score. 100% match rate.

• Screenshot generation — One LLM call per finding generates custom SVG mockups (terminal + Burp Suite styles), converted to PNG via sharp. Not templates — each screenshot is unique and tailored to the PoC.

• SysReptor populate — Creates a project, maps findings to the target design family (VAPT 12 fields / SysRaptor 9 fields), uploads screenshots as embedded evidence, writes an LLM-generated executive summary, and fills report metadata.

🏗 How It Works

Klue PDF + Manual PDF
       │
       ▼
  ┌─────────────────────────────────────────┐
  │              /api/agent (SSE)            │
  │                                          │
  │  1. Extract text (PDF/DOCX/MD/TXT)     │
  │  2. Parse findings (LLM structured)     │
  │  3. Merge + dedup (LLM matching)        │
  │  4. Resolve conflicts (LLM + override)  │
  │  5. Estimate CVSS (LLM + brute-force)   │
  │  6. Generate screenshots (SVG → PNG)    │
  └─────────────────────────────────────────┘
       │
       ▼
  Findings table + CVSS vectors + screenshots
       │
       ▼  (user clicks "Populate SysReptor")
       │
  ┌─────────────────────────────────────────┐
  │              /api/populate               │
  │                                          │
  │  1. Map to design family (VAPT/Raptor)  │
  │  2. Upload screenshots                   │
  │  3. Create findings via REST API         │
  │  4. Write executive summary (LLM)        │
  │  5. Write report metadata + sections    │
  └─────────────────────────────────────────┘

🚀 Quick Start

git clone https://github.com/el-noir/reptor.git
cd reptor
npm install

cp .env.example .env.local
# Edit .env.local — add your Anthropic + SysReptor credentials

npm run dev
# Open http://localhost:3000

Upload a Klue report + a manual pentest report, pick a SysReptor design, click Run Agent, review the findings table, then click Populate SysReptor.

🔧 Environment Variables

See .env.example for the full reference.

Variable	Required	Description
ANTHROPIC_API_KEY	Yes	Claude API key (sk-ant-...)
ANTHROPIC_MODEL	No	Model name (default: claude-sonnet-4-5-20250929)
ANTHROPIC_CVSS_MODEL	No	CVSS estimation model (default: claude-opus-4-1-20250805)
SYSREPTOR_URL	Yes	SysReptor instance URL
SYSREPTOR_TOKEN	Yes	SysReptor API token (Bearer auth)

🛠 Tech Stack

Technology	Purpose
Next.js 16	App Router, SSR + API routes, TypeScript
Anthropic SDK	Structured outputs via Zod (zodOutputFormat)
Zod	Schema validation — shared by LLM, API, and UI
pdfjs-dist	PDF text extraction
mammoth	DOCX text extraction
sharp	SVG → PNG conversion for evidence screenshots

📁 Project Structure

src/
  app/
    page.tsx                # Main UI — agent + populate
    api/
      agent/route.ts        # SSE: extract → parse → merge → cvss → screenshots
      populate/route.ts     # POST: create SysReptor project + upload
      designs/route.ts      # GET: list supported SysReptor designs
  lib/
    llm/
      client.ts             # Anthropic client + structured output parser
      prompts.ts            # All LLM prompt strings
      calls.ts              # All LLM call functions
    cvss.ts                 # CVSS estimation + brute-force score matching
    merge.ts                # Code-based merge + LLM merge orchestration
    screenshot.ts           # SVG screenshot generation + PNG conversion
    verify.ts               # LLM conflict resolution
    parsers/report.ts       # Report text extraction + LLM parsing
    reports/extract-text.ts # File → text (PDF/DOCX/MD/TXT)
    sysreptor.ts            # SysReptor REST API client
    sysreptor/client.ts     # Design listing + fetching
    designs.ts              # Finding family identification + field mapping
    types.ts                # CanonicalFinding Zod schema (shared)

💻 Development

npm run dev        # Dev server
npm run build      # Production build
npm run typecheck  # TypeScript check
npm run lint       # ESLint

🤝 Contributing

Contributions are welcome. See CONTRIBUTING.md for setup, code style, commit conventions, and the PR process.

Before submitting a PR, all three must pass:

npm run typecheck && npm run lint && npm run build

📄 License

MIT — Copyright (c) 2026 el-noir