A transparent discovery signal based on current public GitHub metadata.
Recent activity35% weight
100
Community adoption25% weight
28
Maintenance state20% weight
40
License clarity10% weight
100
Project information10% weight
100
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
README preview
AI-Powered Offensive Security Research Engine
A desktop-native security testing platform built on Rust and Tauri with native Model Context Protocol (MCP) integration for AI-driven vulnerability research.
WonderSuite is a desktop native offensive security engine that combines Burp Suite-class tooling with autonomous AI agent capabilities. It provides a fully integrated environment for web application security testing, network reconnaissance, and exploit development — all orchestrated through an MCP-compatible AI interface.
The platform ships with 91 purpose-built security tools accessible via JSON-RPC (trimmed from 100 in v0.3.11 — the standalone OAST tools were folded into active_scan(with_oast: true) to keep the AI's context budget lean), a full MITM proxy with Chrome 137 JA3/JA4 + HTTP/2 fingerprint impersonation (defeats Cloudflare, Akamai Bot Manager, DataDome, PerimeterX), a bundled Chrome-for-Testing 148 with stealth extension and per-version isolation, a pentest-grade browser MCP surface with stable element refs and OAST-integrated blind-vuln detection, and automated vulnerability scanning across SQLi, XSS, SSTI, LFI, CRLF, Open Redirect, plus blind cmdi / SSRF / Log4Shell via the bundled OAST listener.
See it in action
Claude Opus 4.7 driving WonderSuite end-to-end: opens WonderBrowser, walks through a registration form on its own (fills email + password fields, presses Sign up), and watches the resulting traffic stream through the proxy live — auth POST captured, JWT/CSRF surfaced, ready to fuzz. Zero scripted steps, the agent picks the tool sequence itself (browser_open → browser_snapshot → browser_fill_form → browser_click → proxy_get_traffic → analyze_jwt).
Full man-in-the-middle proxy with TLS interception and dynamic certificate authority generation. Supports real time request and response modification, match-and-replace rules with regex (5 targets: request_header/body/url, response_header/body), WebSocket message capture, upstream proxy chaining (HTTP/SOCKS5), traffic annotation with color highlighting, and proper HAR/JSON export (headers, queryString, statusText all populated). Upstream requests can be re-originated through a BoringSSL stack tuned to match Chrome 137's exact ClientHello, JA3/JA4 fingerprint and HTTP/2 SETTINGS frame ordering — bypasses Cloudflare, Akamai Bot Manager, DataDome, and PerimeterX.
WonderBrowser — Bundled Chrome-for-Testing 148
A pinned Chromium build (CfT 148.0.7778.97) shipped inside WonderSuite — version-locked, SHA-256-verified, never auto-updates, per-version cached. Uses a separate .wondersuite/ profile so it doesn't touch the user's system Chrome. The bundled WonderSuite extension applies minimal stealth at document_start (deletes navigator.webdriver from the prototype, purges automation globals) — verified isBot: false on all 18 deviceandbrowserinfo.com checks. All outbound requests flow through the WonderSuite proxy for capture and TLS impersonation.
Cache behaviour (v0.3.28+): By default, WonderSuite wipes the browser's on-disk HTTP cache (Cache/, Code Cache/, Service Worker/, etc.) before every launch. This ensures every resource is fetched fresh through the proxy so it appears in the Sitemap and Code Audit — without this, Chrome would serve previously-cached JS/CSS/images directly from disk, bypassing capture entirely. Toggle off in Settings → Browser → Clear HTTP cache on browser start if you need a warmed cache for a specific test.
Out of the box, no per-target tuning, no manual evasion: WonderBrowser plus the impersonating proxy passes every signal on third-party bot-detection fingerprinting suites. Live test against the public detector at deviceandbrowserinfo.com/are_you_a_bot:
WonderSuite stacks three orthogonal layers, each defeating a different class of fingerprinting:
TLS layer (proxy upstream). Every outbound TLS handshake is re-originated through a BoringSSL stack tuned to Chrome 137's exact ClientHello — cipher suite order, ALPN, GREASE bytes, extensions, key shares — plus HTTP/2 SETTINGS frame ordering. The resulting JA3/JA4 fingerprint is byte-identical to a real Chrome. Cloudflare, Akamai Bot Manager, DataDome and PerimeterX classify the request as a real browser at the TCP/TLS layer before any JS even runs.
Browser layer (binary + extension). WonderBrowser is Chrome-for-Testing 148 — not a fork, not CEF, not Electron. It runs an isolated .wondersuite/ profile separate from your system Chrome. A bundled MV3 extension hooks document_start (before any page JS) to delete navigator.webdriver directly off Navigator.prototype (no easy override-leak) and purges automation globals (window.cdc_*, CDP-injection artifacts). The binary is SHA-256-verified, version-pinned, never auto-updates.
Input layer (agent automation). When the AI agent drives the browser via MCP tools, every click / keystroke / scroll goes through Chrome's real input pipeline via CDP.Input.dispatchMouseEvent / dispatchKeyEvent / insertText — resulting DOM events carry event.isTrusted === true, indistinguishable from a physical keyboard and mouse. Mouse paths are humanlike Bezier trajectories with Gaussian jitter; typing cadence is drawn per-character from a normal distribution; pre-action dwell time and document.hasFocus() emulation are configurable per stealth profile (fast / human / paranoid). The AI cursor overlay lives in a closed Shadow DOM — visible to the operator, completely invisible to page JS. Fraud SDKs like FriendlyCaptcha, DataDome, Cloudflare Bot Management and Imperva — which silently drop programmatic form submissions when isTrusted: false — let WonderSuite traffic through.
How it flows — browser, proxy, optional impersonation
