Felix1Catus/CatusMythos-Lounge

A merged Claude Code security toolkit: one pipeline, 24 skills, a doctrine engine, and a multi-seat collaboration protocol.
> Authorized security testing only. Unauthorized access to computer
> systems is illegal. Read DISCLAIMER.md before use.
## What this is
Three real projects, combined so each covers what the others miss:
1. Felix1Catus/claude-code-pentest
(fork of Orizon-eu/claude-code-pentest)
— a 6-skill, 43-script, zero-dependency pipeline that takes a domain from
recon through exploitation to a bug-bounty-ready report. Its workflow is
this repo's execution backbone, unchanged.
2. Masriyan/Claude-Code-CyberSecurity-Skill
— 22 skills covering the rest of security work the pipeline doesn't touch:
malware analysis, reverse engineering, incident response, mobile, OT/ICS,
cryptography, GRC/compliance, supply chain, threat intel, purple team,
blue team defense, AI/LLM security, and more. Its domain breadth is
added wholesale, and the four places it overlaps the pipeline had their
scripts folded in rather than shipping a redundant second tool.
3. mythos-lounge — a doctrine engine (evidence-first discipline, probe
budgets, report-only-when-real) and a multi-seat collaboration protocol
(seatlib.py) that lets several agents hunt one target in the same
window without duplicating work. This is the governance and
coordination layer that sits above both skill sets, usable solo or as
a table of seats.
See MERGE_MAP.md for the exact, file-by-file account of what
was combined, what was kept separate, and why — nothing was silently
dropped. See NOTICE.md and CREDITS.md for
attribution, which this repo is contractually obligated to preserve under
the MIT terms each source shipped with.
## Architecture
┌─────────────────────────────┐
│ doctrine/ (governance) │
│ P01-P14 protocols, bootkit │
│ role cards, probe budgets, │
│ evidence-first, resume hooks │
└───────────────┬───────────────┘
│ enforced on every seat
┌───────────────▼───────────────┐
│ lounge/ (coordination) │
│ seatlib.py claim/token/push │
│ — solo seat, or a table of │
│ several seats on one target │
└───────────────┬───────────────┘
│ drives
┌─────────────────────────┼─────────────────────────┐
▼ ▼ ▼
┌─────────────────────┐ ┌───────────────────────┐ ┌───────────────────────┐
│ skills/ pipeline │ │ skills/ domain breadth │ │ agents/ entry points │
│ (Felix1Catus) │ │ (Masriyan, 18 skills) │ │ swarm-operator, etc. │
│ │ │ │ │ │
│ recon-dominator │ │ 03 exploit-dev ... │ └───────────────────────┘
│ -> webapp-exploit- │ │ 22 purple-team │
│ hunter │ │ │
│ -> api-breaker │ │ (03-22 minus the 4 │
│ -> cloud-pivot- │ │ the pipeline overlaps; │
│ finder │ │ their scripts were │
│ -> attack-path- │ │ folded into the │
│ architect │ │ pipeline instead) │
│ -> vuln-chain- │ │ │
│ composer │ │ │
└─────────────────────┘ └───────────────────────┘
## The pipeline (unchanged from Felix1Catus / Orizon-eu)
DOMAIN INPUT
recon-dominator subdomain enum, port scan, OSINT, dorking, Wayback
│ + Masriyan's WAF/CDN/analytics detection merged into tech_fingerprint.py
│ + Masriyan's wildcard-DNS suppression merged into active_recon.py
│ + folded-in as-is: dns_recon.py (SPF/DMARC/reverse-DNS, zero overlap)