internal/

Package audit is the append-only audit log: every tool invocation is recorded as one JSON line before it runs and a second when it completes.

Package config holds all server settings, read once from the environment at startup.

Package files provides sandboxed file access for the engagement working area.

Package findings is the engagement deliverable store (feature #1).

Package jobs surfaces background-job status (feature #2).

Package mcpserver adapts the shared tool registry onto an MCP stdio server using the official modelcontextprotocol/go-sdk.

Package registry is the single source of truth for the tool suite.

Package runner is the single choke point every tool invocation funnels through.

Package shellword provides shell word-splitting and quoting, the Go equivalents of Python's shlex.split / shlex.quote / shlex.join used by the original tool wrappers.

Package skills is an on-demand knowledge library: expert playbooks as embedded markdown spanning offensive, malware, threat-intel, and governance (GRC, standards, CISO) domains, tied to this server's actual tool names where relevant.