RedQuorum

The First Democratic Cybersecurity

---

Overview

RedQuorum is a multi-agent AI security scanner that deploys a "Parliament of Attackers" - multiple AI security experts with different specialties who debate and vote on security threats. Only findings that achieve consensus (quorum) make it to your report.

Quick Start (5 Minutes)

Prerequisites

• Python 3.11+
• Node.js 18+

Step 1: Install Python Backend

This project uses uv for dependency management (recommended) but also works with pip:

Using uv (recommended - faster, pre-resolved dependencies):

# Install uv if you don't have it
pip install uv

# Create virtual environment and install
uv venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
uv pip install -e "."

Using pip:

pip install -e "."

Then copy the environment file:

cp .env.example .env

API keys are optional. Add for real AI analysis:

OPENAI_API_KEY=sk-your-key-here

Without API keys, the system runs in demo mode with simulated findings.

Step 2: Install Node Frontend

cd electron-app/src/renderer/angular-app
npm install
cd ../../..

Step 3: Run Both Services

./scripts/dev.sh

Or manually in two terminals:

# Terminal 1
redquorum server

# Terminal 2
cd electron-app/src/renderer/angular-app
npm start

Step 4: Open the UI

• Dashboard: http://localhost:4200
• API Docs: http://localhost:8000/docs

---

How to Run Your First Scan

Using the CLI (Recommended)

# DAST scan with AI analysis (requires API key)
redquorum scan https://example.com --type 5

# DAST scan without AI (faster, raw findings)
redquorum scan https://example.com --type 5 --no-ai

# Code scan
redquorum scan /path/to/code --type 2

Reports are saved to reports/YYYYMMDD_HHMMSS/target/report.json (and .md)

Using the Web UI

1. Open http://localhost:4200
2. Click "New Scan" button
3. Enter a target:
   • Code: Local folder /home/user/myproject or Git repo
   • API: https://api.example.com
   • Web App: https://website.com (DAST scanning)
   • Demo: Any text for simulation mode
4. Select Target Type:
   • "Code Directory" - Static code analysis
   • "🌐 Web Application (DAST)" - Dynamic security testing
5. Click "Start Scan"
6. View results in scan list

Code Scanning (SAST)

# Scan local code
curl -X POST http://localhost:8000/api/v1/scans \
  -H "Content-Type: application/json" \
  -d '{
    "target_type": "CODE_DIRECTORY",
    "location": "/path/to/code"
  }'

# Scan git repository
curl -X POST http://localhost:8000/api/v1/scans \
  -H "Content-Type: application/json" \
  -d '{
    "target_type": "CODE_REPOSITORY",
    "location": "https://github.com/user/repo"
  }'

Web Application Scanning (DAST) ⭐ NEW

# Full DAST scan with crawling
curl -X POST http://localhost:8000/api/v1/scans \
  -H "Content-Type: application/json" \
  -d '{
    "target_type": "WEB_APPLICATION",
    "location": "https://example.com",
    "dast_config": {
      "crawl_depth": 2,
      "max_pages": 50
    }
  }'

# Quick scan (no crawling, single URL)
curl -X POST http://localhost:8000/api/v1/scans \
  -H "Content-Type: application/json" \
  -d '{
    "target_type": "WEB_APPLICATION",
    "location": "https://example.com/login"
  }'

# List scans
curl http://localhost:8000/api/v1/scans

# Get details
curl http://localhost:8000/api/v1/scans/{scan_id}

---

Capabilities

Fully Working

• CLI Tool - Command-line scanning with --no-ai option
• DAST (Dynamic Analysis) - Full web application security testing
  • Spider crawler with authentication support
  • SQL Injection, XSS, Command Injection detection
  • Security headers analysis
  • ~12 different vulnerability detectors
• Parliament AI - 4-agent debate system (Opportunist, Insider, Professional, Moderator)
• Report Generation - JSON and Markdown reports with findings
• Demo mode (no API keys needed)
• Web Dashboard - Angular frontend with real-time progress
• Multiple LLM Support - OpenAI, Anthropic, Moonshot (Kimi)

DAST Capabilities

When scanning web applications (target_type: WEB_APPLICATION):

Detector	Finds
SQL Injection	Error-based, time-based, boolean-based SQLi
XSS	Reflected, DOM-based, stored XSS
Command Injection	Shell command execution vulnerabilities
SSTI	Server-side template injection
Authentication	Weak passwords, session fixation, JWT issues
Configuration	Missing security headers, CORS misconfig, SSL issues

DAST automatically:

1. Crawls the target to discover URLs
2. Tests forms and parameters
3. Analyzes responses for vulnerabilities
4. Sends findings to Parliament for validation

Demo Mode

When running without API keys:

• System generates realistic demo findings
• Parliament agents vote with simulated reasoning
• Full debate transcript included
• Ideal for UI testing and demonstrations

With API Keys

When API key is configured:

• Real LLM analysis
• Findings extracted from actual code
• Genuine AI debate

---

The Parliament

When you run a scan, findings go through the Parliament:

Finding: SQL Injection

Opportunist: "Easy to exploit! Severity 8/10"
Insider: "Can dump data from inside! Severity 9/10"
Professional: "Ransom-worthy data access! Severity 10/10"
Moderator: "Verified exploitable. PASS"

Consensus: 87% - APPROVED

Voting Weights:

• Opportunist: 20% (finds obvious issues)
• Insider: 25% (business logic perspective)
• Professional: 35% (APT/ransomware mindset)
• Moderator: Validates (pass/fail decision)

---

Project Structure

RedQuorum/
├── src/redquorum/              # Python Backend
│   ├── api/                    # FastAPI + static files
│   ├── agents/                 # Parliament (4 personas)
│   ├── scanners/               # Security scanners
│   └── services/               # Orchestration
│
├── electron-app/src/renderer/  # Angular Frontend
│   └── angular-app/
│       ├── src/app/            # Dashboard UI
│       └── src/app/services/   # API clients
│
└── scripts/
    ├── dev.sh                  # Run full stack
    └── build-frontend.sh       # Production build

---

Configuration

Edit .env file:

# Optional: API Keys
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...

# Parliament Settings
PARLIAMENT_QUORUM_THRESHOLD=75
PARLIAMENT_MAX_DEBATE_ROUNDS=3

# DAST Settings
DAST_MAX_REQUESTS=200           # Max HTTP requests per scan
DAST_MAX_FINDINGS=50            # Max findings to report
DAST_DEFAULT_CRAWL_DEPTH=2      # Default crawl depth
DAST_DEFAULT_MAX_PAGES=50       # Default max pages to crawl
DAST_ENABLE_AI_CONFIRMATION=true  # AI confirmation for ambiguous findings

# Server
API_PORT=8000
LOG_LEVEL=INFO

---

Troubleshooting

Port 8000 in use:

redquorum server --port 8001

Backend connection failed:

curl http://localhost:8000/health

Missing dependencies:

# Using uv (recommended)
uv pip install -e "."

# Or using pip
pip install -e "."

Node modules issues:

cd electron-app/src/renderer/angular-app
rm -rf node_modules && npm install

---

Philosophy

Traditional security scanners:

• 1 AI generates 500 alerts
• User drowns in false positives
• Misses creative attacks

RedQuorum approach:

• 4 specialists debate each finding
• Only consensus-approved alerts
• Full reasoning trail
• Focus on actionable threats

---

Built for security teams who want signal, not noise.