Cookbook

Task-oriented, runnable recipes for the Rank autonomous pentesting platform.

The recipes below are problem-first and runnable. Each one starts from a concrete goal, walks through the steps across the web platform, CLI, and Python SDK where relevant, and ends with a complete, self-contained script you can save locally and run.

Every recipe assumes you have an account and an API token. If you do not yet, start with the Quickstart and Authentication guides.

Recipes

Run your first automated pentest

Create an automatic web pentest, activate RoE, stream it end to end, and email a sealed report.

Guided pentest, phase by phase

Assign agents per phase and drive a guided pentest one phase at a time after an active RoE.

Rules of Engagement & kill switch

Activate a fail-closed RoE, list in-run approvals, and halt with the kill switch.

Triage vulnerabilities and gate CI

Resolve, flag, and bulk-update findings, then fail your CI build with a quality gate.

Retest a fixed finding

Enqueue a retest, poll the run, and set remediation policy. Cookies never come back on GET.

Push findings to Jira, GitHub or Slack

Create a Jira (or GitHub / Slack) integration before the pentest, then test and sync.

Tenant webhooks

Subscribe at the tenant, verify HMAC signatures, and list deliveries.

Sealed reports & SARIF

Set a report profile, generate multi-format sealed reports, and export findings as SARIF.

Stream agent events in real time

Split one SSE stream into the assistant answer and a live timeline of agent activity.

Build a custom local tool

Define a local tool, register it with the CLI, wire up an API key, and run it on your machine.

Set up a team with RBAC

Create a team, define Admin/Pentester/Viewer roles, assign permissions, and invite members.

How to run the examples

Each recipe is self-contained and ends with a complete script you can save and run. They all share the same setup:

pip install rank-sdk
export RANK_API_KEY=rk_...
python <script>.py

The client reads RANK_API_KEY from the environment, so you never have to hard-code a key. See the Python SDK overview for client options and the Streaming guide for a deeper look at the event protocol used throughout these recipes.