Invalru

An autonomous, agentic Bug Bounty and vulnerability orchestration pipeline powered by eBPF telemetry, high-fidelity Abstract Syntax Tree (AST) mutation, and reinforcement learning-guided execution.

Invalru operates not as a sequence of fragile automation scripts, but as a closed-loop, low-latency concurrent system. It bridges the gap between kernel-level traffic instrumentation, deep semantic code comprehension, and autonomous validation.

---

1. Architectural Blueprint: "Eyes, Hands, Brain"

Invalru decouples data ingestion, structural analysis, and exploit orchestration into three distinct layers interconnected via low-latency communication channels.

+------------------------------------------------------------+
|                  INGESTION LAYER (Go)                      |
|  - eBPF / XDP Network Ingestion                            |
|  - Raw TCP/HTTP Stream Capture                             |
|  - Zero-Copy Ring Buffers                                  |
+-----------------------------+------------------------------+
|
| gRPC over Unix Domain Sockets
v
+------------------------------------------------------------+
|                    ANALYSIS LAYER (Rust)                   |
|  - tree-sitter AST & CFG/DFG Construction                  |
|  - WASM-Isolated Execution Sandbox                         |
|  - Speed Web Compiler (SWC) Indexing                       |
+-----------------------------+------------------------------+
|
| gRPC over Unix Domain Sockets
v
+------------------------------------------------------------+
|                    DECISION LAYER (Python)                 |
|  - Multi-Agent Orchestration (LangGraph)                   |
|  - Fine-Tuned Mistral-Nemo-12B Semantic Audit              |
|  - gVisor Containerized Sandbox Exploitation               |
+------------------------------------------------------------+

Eyes: Ingestion Layer (Go)

Engineered for ultra-low CPU overhead. Utilizing eBPF at the XDP (eXpress Data Path) layer, it intercepts and filters raw network traffic directly inside kernel space. It maps hidden API endpoints, records microservice interactions, and streams telemetry upstream via cilium/ebpf ring buffers without context switching overhead.

Hands: Analysis Layer (Rust)

Built for deterministic speed. Built on tokio and tonic, it ingests runtime code artifacts and transpiled JS/TS bundles, converting them into Abstract Syntax Trees (AST), Control Flow Graphs (CFG), and Data Flow Graphs (DFG). It tracks state flow from user-controlled inputs down to critical code execution points (sinks).

Brain: Decision Layer (Python)

An asynchronous multi-agent system built on top of LangGraph. It leverages specialized LLMs and reinforcement learning to synthesize findings, evaluate potential exploit paths, mutate payloads, and safely execute Proofs of Concept (PoC).

---

2. Core Technical Stack

Layer	Technologies	Functional Responsibility
Data Ingestion (Go)	ebpf-go (cilium/ebpf), gopacket, NATS JetStream	Kernel-space XDP telemetry, high-throughput event streaming.
Static & Dataflow Analysis (Rust)	tonic, prost, swc_core, tree-sitter, wasmer	AST parsing, DFG/CFG mapping, gRPC engine, safe execution of untrusted hooks.
Orchestration & AI (Python)	LangGraph, vLLM, Pydantic	Agent execution trees, LLM serving, payload validation logic.
Intelligence Core	Fine-tuned Mistral-Nemo-12B	Local inference specialized in vulnerability patterns & semantics.
Interconnect	gRPC over Unix Domain Sockets	Zero-copy shared memory boundaries and structured protobuf streams (unix://).

---

3. Engineering Requirements & Guarantees

• Immutability: Every payload, telemetry log, and intermediate AST state is versioned and cryptographically indexed to guarantee strict exploit reproducibility.
• Zero-Copy Memory Boundary: Telemetry transport from the Go kernel space utilizes BPF_MAP_TYPE_RINGBUF memory-mapped ring buffers, minimizing latency and CPU overhead.
• Cross-Platform Compatibility: Features strict conditional build tags (GOOS=windows stubs vs. Linux native eBPF) allowing seamless local cross-development while maintaining full kernel performance on deployment.
• Strict Isolation: Dynamic evaluation of code and validation of exploits are executed within hard-isolated cgroup spaces and ephemeral gVisor runtimes, preventing side-channel contamination or defensive evasions from targeting the scanner itself.
• Asynchronous Concurrency: System resource quotas are enforced per scan-thread using native asynchronous task-scheduling mechanics (goroutines in Go, tokio loop in Rust).

---

4. Development Roadmap & Phases

Phase 1: Core Transport, eBPF Ingestion & IPC Mechanics

• Initialize full project workspace structure, Docker configs, and build scripts.
• Define Protobuf IDL and establish end-to-end gRPC communication between Go and Rust.
• Implement eBPF/XDP kernel programs for zero-copy TCP/HTTP packet interception.
• Configure cilium/ebpf bindings with BPF_MAP_TYPE_RINGBUF for low-overhead user-space streaming.
• Transition gRPC transport layer to Unix Domain Sockets (unix:///var/run/invalru.sock) for high-throughput zero-copy boundaries.

Phase 2: Static & Dataflow Analysis Engine (Rust Plane)

• Implement initial JSON parser and static signature rules for Path Traversal & XSS detection.
• Setup compile-time Protocol Buffers code generation pipeline via tonic-build / prost.
• Integrate tree-sitter for full JS/TS Abstract Syntax Tree (AST) construction.
• Build Data Flow Graph (DFG) primitives and Taint Engine to track state from sources to dangerous sinks.
• Integrate swc_core for advanced scope analysis, variable aliasing, and JS/TS transpilation.
• Build Control Flow Graph (CFG) engine for evaluation of conditional branches and loops.
• Integrate wasmer execution environment for safe sandboxed execution of dynamic inspection rules.
• Implement memory-mapped payload buffer serialization for streaming analysis outputs to gRPC.

Phase 3: Decision Brain & Multi-Agent Orchestration (Python)

• Set up asynchronous multi-agent execution pipeline using LangGraph (AuditorAgent, PayloadMutator, VerifierAgent).
• Integrate vLLM inference server hosting local fine-tuned Mistral-Nemo-12B weights.
• Implement FAISS vector storage for semantic indexing and clustering of vulnerability patterns.
• Design structured Pydantic schemas for LLM agent function calling and vulnerability hypothesis output.

Phase 4: Sandbox Isolation & Autonomous PoC Verification

• Integrate gVisor (runsc) container runtime driver for fast ephemeral sandbox instantiation.
• Implement target state replication module to mirror environment variables, headers, and endpoints.
• Develop dynamic Proof of Concept (PoC) synthesizer and runner (Curl/Python payloads).
• Implement runtime telemetry monitoring within sandbox to verify state corruption, OOB traffic, or side effects.

Phase 5: RL-Guided Fuzzing & Mutation Engine

• Implement Proximal Policy Optimization (PPO) reinforcement learning loop using Stable-Baselines3 / Ray RLlib.
• Build state mutation engine targeting WAF bypass patterns and dynamic encoding schemes.
• Formulate multi-variable reward function based on HTTP status codes, response timing shifts, and runtime coverage metrics.
• Implement backpressure control and request rate limiters to prevent target server denial-of-service.

Phase 6: Tooling, Hardening & Benchmarking

• Develop invalctl native CLI utility for status monitoring, Agent graph visualization, and PoC export.
• Set up end-to-end automated benchmarking harness for measuring ring buffer throughput, AST parsing latency, and VRAM usage.
• Enforce cgroup v2 resource limits and memory quotas across parallel scan workers.
• Package release binaries with static eBPF bytecode compilation and zero-dependency deployments.

---

5. Getting Started

Prerequisites

• Linux Kernel >= 5.15 with eBPF enabled (CONFIG_DEBUG_INFO_BTF=y)
• Go 1.22+
• Rust (Edition 2021)
• Python 3.11+
• Docker & gVisor (runsc) runtime

Installation

Clone the repository and submodules:

git clone --recursive [https://github.com/itsVentie/Invalru.git](https://github.com/itsVentie/Invalru.git)
cd Invalru

Compile the eBPF drivers and Ingestion Engine:

make build-ingestion

Compile the Rust Analysis Plane:

make build-analysis

Initialize the Python Orchestration Environment:

make init-brain

---

6. Configuration

Invalru is configured using a unified topology file.

engine:
  interface: eth0
  shared_memory_buffer_mb: 512
  grpc_socket_path: /var/run/invalru.sock

analysis:
  max_ast_depth: 128
  enable_wasm_hooks: true

agents:
  llm_endpoint: http://localhost:8000/v1
  model_name: mistral-nemo-12b-bounty
  max_thought_iterations: 5
  sandbox_runtime: runsc

---

7. Operational Workflow

To spin up the continuous passive/active pipeline against an authorized target environment:

sudo ./bin/invalru --config ./config.yaml --live

Stream Pipeline Controls

You can interact with the running orchestration loop using the native CLI client:

./bin/invalctl status --socket /var/run/invalru.sock

./bin/invalctl agents dump-graph --session-id current

./bin/invalctl export-poc --vuln-id VULN-2026-0912

---

8. License

Distributed under the Apache License 2.0. See LICENSE for details.