Reaper: The First Security Proxy Built for AI Agents to Hunt Vulnerabilities

Hook

While security teams debate whether AI can replace penetration testers, Ghost Security quietly shipped a proxy that lets both work together—with the AI driving the testing workflow.

Context

Security proxies have looked remarkably similar for two decades. Tools like Burp Suite and mitmproxy intercept HTTP traffic, let humans poke at requests, maybe run some automated scans. The workflow is fundamentally human-centered: you click through a GUI, manually mark interesting requests, build attacks by hand. Even the scriptable proxies assume a human is orchestrating the testing strategy.

Reaper breaks this mold by treating AI agents as first-class users alongside security engineers. It's not just another MITM proxy with a Python API bolted on—it's architecturally designed for programmatic control through the Ghost Security Skills framework, while maintaining full CLI access for humans. The bet is that the future of AppSec isn't humans OR agents, but collaborative workflows where agents handle the grinding repetition of vulnerability validation while humans provide strategy and context. In a world where security teams face exponentially growing attack surfaces and static headcount, this architectural choice matters more than any individual feature.

Technical Insight

Reaper is fundamentally a transparent HTTPS proxy with three distinguishing characteristics: scope-aware traffic filtering, persistent storage with queryable history, and dual interfaces optimized for both human operators and autonomous agents.

The scope filtering happens at the proxy layer itself. Rather than capturing everything and filtering later (the traditional approach), Reaper accepts scope definitions upfront—typically domains, URL patterns, or IP ranges—and discards out-of-scope traffic immediately. This matters because modern web applications make hundreds of third-party requests (analytics, CDNs, ads), and capturing all of it creates noise that obscures actual application traffic. For AI agents especially, this pre-filtering prevents the context window from filling with irrelevant requests when analyzing traffic patterns.

Here's how you'd configure scope and start capturing traffic:

# Install and initialize Reaper
reaper init --database ./reaper.db

# Define scope for your target application
reaper scope add --domain app.example.com
reaper scope add --pattern "^https://api\\.example\\.com/v[0-9]+/.*"

# Start the proxy on port 8080
reaper proxy --port 8080 --tls-cert ./cert.pem --tls-key ./key.pem

# In another terminal, query captured traffic
reaper requests list --limit 50
reaper requests search --method POST --status 200
reaper requests export --format json --output captured.json

The local database storage (SQLite by default, based on common Go proxy patterns) creates a persistent audit trail. Unlike session-based tools that lose history on restart, Reaper maintains a queryable archive of all in-scope traffic. This enables temporal analysis—finding requests that only appear after authentication, correlating parameter patterns across endpoints, identifying changes in API responses over time. For AI agents, this historical context is crucial for vulnerability chaining, where exploiting one weakness depends on understanding how the application behaved in previous states.

The dual interface design is where Reaper diverges most sharply from traditional proxies. The CLI commands (reaper requests, reaper scope, etc.) provide human-friendly interaction for security engineers who want direct control. But the same functionality exposes through the Ghost Security Skills API, designed specifically for Large Language Model consumption. An AI agent can call functions like capture_traffic(), search_requests(criteria), or test_payload(request_id, injection) without parsing CLI output or scraping GUI elements.

This matters because most security tool APIs were designed for scripts, not AI. They return structured data that's easy for code to parse but requires significant prompt engineering for LLMs to understand. Skills APIs flip this—they're designed to be semantically clear to language models, with natural language descriptions, type hints, and error messages that explain context rather than just returning status codes. Here's what a hypothetical agent interaction looks like:

# AI agent using Ghost Security Skills SDK
from ghost_skills import Reaper

reaper = Reaper(proxy_url="http://localhost:8080")

# Agent searches for authentication endpoints
auth_requests = reaper.search_requests(
    description="Find all login or authentication requests",
    filters={"path_contains": ["login", "auth", "session"]}
)

# Agent tests for SQL injection on each parameter
for req in auth_requests:
    for param in req.parameters:
        result = reaper.test_vulnerability(
            request_id=req.id,
            parameter=param.name,
            attack_type="sql_injection",
            validation="check for database errors or timing differences"
        )
        if result.vulnerable:
            reaper.generate_report(finding=result)

The 'live validation' aspect means Reaper doesn't just capture and store—it actively tests as traffic flows. When configured with testing rules (either human-defined or agent-generated), it can automatically inject payloads, observe responses, and flag potential vulnerabilities in real-time. This is the 'active' part of active scanning, but scoped to actual application behavior rather than blindly fuzzing every input.

Under the hood, Reaper likely uses Go's net/http package with custom RoundTripper implementations for HTTPS interception, similar to how mitmproxy uses Python's async I/O. The TLS interception requires generating certificates on-the-fly for each domain (standard MITM technique), which is why you provide a CA certificate during setup. Client applications need to trust this CA, which is the fundamental trust trade-off of any security proxy.

Gotcha

The most immediate limitation is platform support—Reaper only runs on Linux and macOS. Windows support isn't just missing, it's architecturally complicated because Go's TLS implementation and system proxy configuration work differently on Windows. If your security team is Windows-based or you're testing Windows-specific applications, you'll need a Linux VM or Docker container, adding deployment friction.

The documentation situation is problematic for an open-source tool. The GitHub README is barely 20 lines with installation commands and a link to external docs at ghostsecurity.ai. This creates several issues: you can't evaluate the tool's actual capabilities without installing it first, the external docs could change or disappear without repo history tracking those changes, and contributors can't easily understand the codebase without documentation context. For a tool that positions itself as infrastructure for AI agents—where transparency and auditability matter—this opacity is concerning. The sparse documentation also suggests Reaper might be either very new (features still being built) or intentionally limited (a gateway to Ghost Security's commercial offerings). Either way, expect to read the source code to understand behavior, which given Go's readability isn't impossible but adds evaluation time.

Verdict

Use Reaper if you're building AI-driven security testing pipelines, experimenting with autonomous agent workflows for AppSec, or need a lightweight proxy with persistent traffic storage and programmatic control that doesn't require running a full Burp Suite instance. It's especially valuable for teams already invested in the Ghost Security ecosystem or those who want CLI-first workflows instead of GUI-heavy tools. The scope-aware filtering and queryable database make it solid for targeted API security testing even without the AI agent features. Skip it if you need Windows support, require extensive built-in vulnerability detection without writing custom logic, prefer comprehensive in-repo documentation before committing to a tool, or need the mature ecosystem and extensive plugin library of established proxies like Burp or ZAP. The minimal public documentation means you're betting on Ghost Security's roadmap rather than evaluating a feature-complete tool today.