h5i

One interface for the entire web test.

terminalauthorized target
Browseoperate the application
Reconmap endpoints with evidence
Testinspect · edit · replay
One session. One policy. One evidence trail.

Browse the application like a user.
Compact snapshots. Shared session state.

terminalexample session

Discover the attack surface.
Keep the evidence behind every endpoint.

recon · the same authenticated sessionbounded crawl
Recon says what exists — and which captured message proves it.

The agent drifts out of scope.
The network policy stops it.

terminalthe same session
The limit is enforced. The attempt is reviewable.

Test captured traffic directly.
No proxy handoff. No lost browser state.

websec · illustrative access-control testsame browser session
Access-control flaw found: Alice can read Bob's private invoice.
Let agents test like professional hackers.
Keep every action contained and auditable.
h5i. The red-teaming browser for AI agents.
Apache 2.0  ·  local-first  ·  no hosted service
0:00