Reckoning is a local web-based orchestrator for chaining CLI tools into repeatable workflows — built for recon, red team ops, and threat intelligence, but usable for any command-line tooling.
git clone https://github.com/rf-peixoto/reckoning
cd reckoning
./install.sh
./start.sh
Then open http://127.0.0.1:5000 in your browser. On Windows, use install.bat / start.bat.
By default the server binds to 127.0.0.1 only. This tool executes shell
commands on the host, so do not expose it to the network. To bind elsewhere
(only on an isolated machine you control), pass a host: ./start.sh 5000 0.0.0.0.
On first launch an admin account is bootstrapped with a random temporary
password, printed to the console and written to ADMIN_CREDENTIALS.txt.
- Sign in as
adminwith the temporary password. - You are forced to set a new password (min 10 chars, upper + lower + digit).
- You are forced to set up MFA — scan the QR code with an authenticator app (Aegis, Google Authenticator, 1Password, …) and confirm a code.
- Delete
ADMIN_CREDENTIALS.txt.
Every subsequent login requires the password plus a TOTP code.
Workflows are ordered chains of CLI tools. Each tool receives input from a previous step and passes output to the next. Placeholder system:
| Placeholder | Value |
|---|---|
{domain} or {0} |
The target you entered at run time |
{1}, {2}, {3}… |
Output of step 1, 2, 3… |
{out_TOOL_ID} |
Stable reference to a specific tool's output |
{entry_name} |
Any value from your String Library |
Targets must be bare domains or IP addresses (e.g. example.com, 10.0.0.5).
Anything else — URLs, ports, credentials, or input containing shell
metacharacters — is rejected at run time.
Executions run through a bounded scheduler. Concurrent Executions in Settings caps how many run at once; extra runs queue until a slot frees. The limit is applied live — changing it doesn't require a restart.
Tools you configure in Settings → Tool Library are the source of truth. A workflow step linked to a library tool tracks it live by default — edit the library entry's command, args, or update command, and every workflow using it picks up the change on its next run automatically.
If a specific step needs different arguments just for one workflow, check Customize for this step only in the workflow editor. That freezes the step's command/args/update independent of later library edits, until you uncheck it again.
- Once — a single run (default)
- Repeat N times — with a configurable sleep between each
- Recurring — every N minutes until cancelled
- Scheduled — fires once at a specific date/time
Named reusable strings (wordlists, tokens, API keys, hostnames). Reference them
as {name} in any arguments template. Mark an entry secret to mask it in the
UI and API; use the reveal and copy buttons to access the value on
demand. Secret values are never embedded in page source.
Settings → Network lets you route tool traffic through a proxy (disabled by
default). When enabled, every tool subprocess — including update commands —
receives standard HTTP_PROXY / HTTPS_PROXY / ALL_PROXY environment
variables set to your proxy URL (http://, https://, socks5://,
socks5h://, or socks4://). Tools that honor these (curl, most Go- and
Python-based recon tools) route through it automatically; tools that need an
explicit proxy flag still require one in their own arguments.
The Health page shows live CPU, memory, network throughput, and GPU usage
(if nvidia-smi is available) for the host running Reckoning.
Every workflow execution is monitored independently while it runs. Once it
finishes, its detail page shows a Resource Usage card with average/peak
CPU and memory, total bandwidth consumed, and time-series charts for that
specific run — useful for spotting which tools or targets are expensive before
scaling a workflow up. Metrics require psutil (included in
requirements.txt); the page degrades gracefully if it isn't installed.
On the Executions page, select two completed runs of the same workflow and target and click Compare Selected. The diff view shows a summary (changed tools, total added/removed), per-tool similarity, and a "show changed only" filter.
Everything is stored in reckoning.db (SQLite). In Settings → Data
Management you can download or restore a backup (restores are validated to be
genuine SQLite backups). Auto-Backup Every N days writes periodic snapshots
to backups/, keeping the most recent N files.
If the process is killed mid-run, those executions are marked interrupted on the next start rather than being left stuck as "running".
- No unauthenticated access; the admin account requires MFA.
- Binds to localhost by default; runs with debug disabled.
- Still: only point it at targets you are authorized to test, and keep it on an isolated host.
Bitcoin [BTC] bc1qflkwmca89fzw9gfpg6dkf0es9ctnm2ktcq03dp