About RiFT Research
RiFT Research is a subordinate research group within SENTIA Lab. It is a specialized research division, not a separate parent laboratory. SENTIA Lab provides the overarching research affiliation; RiFT Research concentrates on cybersecurity engineering and maintains the RiFT project.
The group studies how specialized security engines, analytical workflows, and agents can work together across targets ranging from web applications to source trees, binaries and network infrastructure. RiFT is the shared platform for that direction: it aims to support both a native security agent and external MCP clients. Its cognitive and execution architecture is independent of AELIA, and authorization remains enforced outside model-generated instructions.
Research scope
A broad research program spanning application security, software analysis, vulnerability discovery, networks, and the systems that connect specialized security tools.
- 01
Black-box web, API & backend security
Reconnaissance, application behavior analysis, security testing and controlled exploitation in authorized environments without requiring access to source code.
- 02
White-box web & source-code analysis
Source-aware auditing, codebase comprehension, static and dynamic analysis, dependency review, data-flow reasoning, and vulnerability verification.
- 03
Reverse engineering & binary analysis
Executable and firmware inspection, disassembly and decompilation workflows, behavioral analysis, binary instrumentation, and research on undocumented internals.
- 04
Vulnerability discovery, fuzzing & exploit research
Systematic flaw discovery, fuzzing, crash triage, root-cause analysis and reproducible proof-of-concept validation, including original vulnerability and zero-day research. Discovery outcomes are never guaranteed.
- 05
Network security & L2/L3 assessment
Authorized testing of network devices, services and protocols, including Layer 2 and Layer 3 environments, packet and protocol analysis, configuration review and network penetration testing.
- 06
Additional security domains
Cloud and container environments, operating systems, mobile targets, protocol implementations and other relevant security surfaces as research needs evolve.
- 07
Security agents, MCP & specialist engines
A native RiFT security agent alongside reusable MCP servers, plugins, tool adapters and specialist analysis engines, enabling compatible clients to use the same research capabilities.
- 08
Sandboxing, access control & research evidence
Isolated jobs, scoped target access, protected execution, traceability, verified findings and reproducible experiments across security domains.
RiFT — security agent & MCP platform
A modular security research environment with two complementary ways to operate: a dedicated security agent and reusable capabilities exposed through MCP.
RiFT brings together domain-specific analysis engines, flexible research workflows, tool discovery, policy-bound execution, secure access to target environments, and evidence management. Its scope includes black-box and white-box web assessment, software and binary analysis, reverse engineering, fuzzing, vulnerability research, and network penetration testing.
- RiFT agent mode
- A dedicated security agent intended to plan investigations, coordinate specialist tools, examine evidence and adapt research workflows across supported domains. The agent operates within explicit permissions and research scope.
- RiFT MCP / plugin mode
- Use RiFT engines and capabilities from other compatible clients and agents through structured MCP interfaces, with independent authorization and execution boundaries.
- Domain-specific engines
- Composable tools for web, code, binary, reverse-engineering, fuzzing and network research, through consistent and inspectable interfaces.
- Controlled execution
- Sandboxes, target authorization, connection bridges, policy gateways, result artifacts and audit records applicable across multiple types of assessment.
System architecture
A modular approach separates research planning and tool orchestration from privileged execution, target authorization, and evidence handling.
Controlled execution boundary
Research and execution principles
Authorization is a prerequisite. RiFT is intended for approved testing, education, and controlled research. Scope, target ownership or consent, tool privileges, and collected evidence must remain explicit.
- 01
Explicit scope
Keep testing boundaries and accessible targets visible to both operators and automated components.
- 02
Separation of control and execution
Place security tools behind managed interfaces rather than granting an agent unrestricted host access.
- 03
Verifiable results
Favor traceable tool output, reproducible experiments, and evidence-supported observations over unsupported claims.