An offensive-security agent that runs on your machine. It recons, finds the flaw, proves it, then writes the fix — and stops at every point where a mistake would cost you something.
Most agents stop at writing code. REX runs the loop an operator runs: fingerprint the target, trace the tainted path, build the payload, prove the finding in a real browser, patch it, and run the test that proves the patch holds.
protocol_fingerprint identifies the stack. taint_analyze traces attacker-controlled input from source to dangerous sink and rates each path. payload encodes and chains the transform. honeypot_check tells you when the target is bait.
Streaming responses, native tool calling, automatic context compaction when the window fills, and append-only JSONL session history under ~/.rex/sessions/.
File writes are atomic and arrive as a diff you can edit before approving. Conflict detection catches a file that changed underneath, and every write drops a checkpoint you can roll back to.
API keys are encrypted with the platform credential store — DPAPI on Windows — rather than dropped in a dotfile. Environment variables still work as a fallback.
Screenshot, click, type and send keystrokes, with native backends per OS — Win32/PowerShell, AppleScript/cliclick, xdotool/ydotool/AT-SPI2. Never auto-allowed: every action asks, every time.
A real browser view composited into the window: navigate, snapshot the accessibility tree, click by reference, type, evaluate JavaScript, screenshot. You watch it happen.
A REX.md at the project root is read into every session, so what you explain once outlives the session, the restart and the model switch.
Sessions on the left, the transcript in the middle, the detail pane on the right. Machine text is always mono, colour only ever carries state, and hierarchy comes from weight and spacing rather than boxes inside boxes.
token.ts:41 verifies without pinning an algorithm, so a token
signed alg:none is accepted unsigned.
Type @ to pull a file straight into context. Paste an image and it goes in as an attachment.
Select any text and a toolbar offers to explain it, quote it back, or start a follow-up from it.
Ctrl K switches model, session, settings, or the browser pane.
Reads run freely. Writes show a diff. Anything that touches your machine, your screen or the network asks first — and the riskiest ask every single time, whatever rules you've set.
Every tool call walks the same ladder, top to bottom. The hard safety denylist sits above every rule you can write, so no setting, no "always allow", and no persuasive prompt gets underneath it.
Everything asks. Nothing is remembered.
Reads run. Writes and execution ask.
Fewest prompts. The denylist still holds.
Before you approve, the card shows the exact command, the exact path, and — if you click "always allow" — the precise rule that would be written. And approving is deliberately not a global shortcut: Y and N live on the focused card, so a stray keypress while reading can never run a command.
Electron rather than Tauri — the fastest path to a real desktop app — with the agent core in the main process. No Rust sidecar, no IPC bridge between the loop and the tools it calls.
The React renderer keeps no secrets and executes nothing. It sends intents over IPC and renders what streams back — so a compromised page has nothing worth stealing.
NSIS and portable builds for Windows, a hand-assembled .deb
that builds even from a Windows host, a distro-agnostic tarball, and
macOS targets wired up in package.json.