Operator controls

The TUI lets you talk to AEGIS while it works. Three channels: free-text guidance, slash commands, and reasoning verbs (v0.12). All three are non-destructive — nothing you type can violate scope.yaml.

Free-text guidance

Type anything that isn’t a slash command and hit Enter. It is queued and injected into the next phase prompt with high priority.

> the auth endpoint returns 200 OK on any creds — check for IDOR on /users/{id}

Claude treats this as an authoritative operator hint. Use it when:

• You know context the agent doesn’t. A recent breach disclosure, a known third-party CVE, a tip from triage chat.
• You want to redirect. “Stop chasing the marketing site, the API is the target.”
• You want to add a constraint. “No requests to /admin/* even though it’s in scope.”
• You see something interesting in the activity feed. “That 500 on /v2/users looked like a stack trace — pull the body and grep for at .* line.”

Guidance landing mid-phase is injected on the next turn boundary, not preempting the current tool call.

Slash commands

Slash commands change orchestrator state directly. They take effect on the next turn.

Command	Effect
/stop	End the current phase NOW. Claude emits a brief summary and advances to REPORTING.
/pause	Operator note injected: wait for /resume before more tool calls. The scan is held; cost stops.
/resume	Cancels /pause. Picks up exactly where it left off.
/focus <target>	Tells the agent to prioritise a specific target in subsequent phases. Repeat to stack focuses.
/hunt on / /hunt off	Toggle bug-hunter mode (loop past REPORTING).
/allow <id>	Approve a queued destructive tool call (see “Destructive-tool gating” below).
/deny <id>	Deny a queued destructive tool call.
/quit	Exit immediately. Scan is abandoned; partial findings are still in the DB.

Reasoning verbs (v0.12)

Four MCP verbs the agent itself uses every turn. You won’t usually type them directly, but they appear in the audit log so you can see how the agent is reasoning:

Verb	Use
propose_hypothesis(target, vuln_class, rationale)	Open a structured theory before dispatching tools.
update_hypothesis(id, status, evidence_for, evidence_against)	Append evidence; transition to CONFIRMED, REFUTED, or TESTING.
mark_dead_end(id, reason)	Retire a theory permanently — keeps the suggester from re-surfacing it.
self_critique(reflection)	Free-form reasoning, persisted as a reasoning_trace audit event.

Open hypotheses are surfaced in the agent pane on the right of the TUI. When you see one you disagree with, type a guidance line — “that hypothesis is wrong because the JWT is HS256, not none”. The agent will read it on the next turn and flip the hypothesis to REFUTED.

Destructive-tool gating

Tools flagged destructive=True in the catalog refuse to run without operator approval unless scope.yaml explicitly enables them. Examples: sqlmap, commix, wpscan (the brute module), hydra, kerbrute, crackmapexec.

When the agent calls a gated tool, the TUI emits a CONFIRM_REQUIRED event:

[CONFIRM_REQUIRED] sqlmap on https://acme.com/api/users?id=1
  id=a3f2  rationale=verify SQLi candidate from nuclei
  /allow a3f2  or  /deny a3f2  (120s timeout → default deny)

You have 120 seconds to respond. No reply defaults to deny — never silent execution.

Keyboard

Key	Effect
Ctrl+O (or Tab)	Toggle tool output expansion in the activity feed
Ctrl+C	Quit immediately
Enter	Submit current input
↑ / ↓	Walk the input history

Bug-hunter mode

/hunt on (or aegis run --hunt) keeps the engagement looping past REPORTING. After the report is generated, AEGIS resets to ACTIVE_RECON with the existing findings as context and runs another full pass.

This is the right mode when:

• You’re doing bug bounty work and want maximum coverage.
• The target is huge and one pass misses things.
• You want the agent to build on its own findings — “now that you know X, what else can you find?”

To exit hunt mode and finalise: /hunt off then /stop.

Watching from another terminal

The TUI is the primary surface, but aegis watch <engagement_dir> from a second terminal gives you a live dashboard you can mirror to a second monitor or pipe to a webhook:

aegis watch engagements/2026-acme \
    --webhook https://hooks.slack.com/services/... \
    --webhook-format slack \
    --webhook-min-severity high

--webhook-format accepts slack (Block Kit), discord (embeds), linear (issue body), or json (stable schema for n8n / Zapier). --webhook-min-severity gates on severity floor — set critical for noisy programs, low for full visibility.

What you should NOT do

• Do not edit engagement_dir/aegis.db while the scan is running. The orchestrator owns the schema; concurrent writes are unsafe.
• Do not modify scope.yaml mid-engagement. Hash it before the run; if you need a scope change, /pause, edit, aegis scope reload <dir>, then /resume.
• Do not feed real credentials into guidance. They land in the audit log unredacted. If you need to test authenticated flows, capture them in Burp and aegis ingest har --replay — that path treats cookies as ingested secrets and routes them through the redactor.