Vessels
Vessels are the execution environments where Cracken's tool actions run. Each Vessel type is specialized for a kind of work — running security tools, executing scripts, or automating a browser — and lives inside a Tentacle.
At a glance
- What it is — A managed execution environment inside a Tentacle that runs one kind of tool action (Bash, Python, Browser, MCP, Integration, or backend tool) and returns the result.
- When to use it — Whenever the agent needs to run a security tool or script (Bash/Python Vessel), interact with a web app (Browser Vessel), or reach an MCP server, integration, or backend tool.
- Inputs — A tool action from the agent (a command, script, or browser action) and, for MCP/Integration Vessels, the server or connection to attach to.
- Outputs — Captured stdout/stderr, screenshots, or traffic returned to the operation; a Vessel ID for interacting with long-lived or background work.
- Related objects — Browser Vessel, MCP Servers, Integrations, Operations, Semi-Autonomous Policy
- Common actions — Execute commands/scripts (Bash/Python Vessel), navigate and interact with pages (Browser Vessel), run a background listener.
- API / tool links — UI only — no public API.
What is a Vessel?
A Vessel is a managed execution environment inside a Tentacle. It receives a tool action from the agent, runs it in a scoped environment, and returns the result. A single Tentacle can run many Vessels at once, so an operation can keep a background listener alive in one Vessel while it works in another.
Vessels share the Tentacle's Kali Linux container: the Bash and Python Vessels run directly in that container, and the Browser Vessel runs a Chromium process the Tentacle launches. Vessels provide:
- Isolation — work runs inside the Tentacle, scoped to the engagement's authorized targets.
- Specialization — different Vessel types for different kinds of task.
- Observability — output and traffic are captured and returned for analysis.
Vessel types
The agent-facing tool Vessels documented here:
- Bash Vessel — execute security tools in Kali Linux.
- Python Vessel — run custom scripts and automation.
- Browser Vessel — automated web application interaction.
Cracken also runs three Vessel types that back tool plumbing rather than direct shell work:
- MCP — an MCP server connection exposed to the operation as tools.
- Integration — a connected third-party tool surfaced through an integration.
- Backend tool — a tool implemented in the Cracken backend rather than in the Tentacle.
See the Browser Vessel section for the full browser action set, and Coming soon for planned dedicated Vessels.
Bash Vessel
| Environment | Kali Linux container |
| Primary use | Security tool execution |
| Status | Available |
The Bash Vessel executes shell commands inside the Tentacle's Kali Linux container. It is the primary interface for running security assessment tools, system commands, and automation scripts during an operation.
Capabilities
- Security tool execution — run the security tools installed in the Tentacle image, such as nmap, ffuf, nuclei, gobuster, whatweb, wpscan, hydra, and the Metasploit Framework.
- Command chaining — execute command pipelines with full shell interpretation.
- Output capture — all stdout and stderr streams are captured and returned to the backend.
- Background processes — run a long-lived process (a listener or server) in the background and keep interacting with it through its Vessel ID.
- Network operations — network access to targets within the engagement Realm for active testing.
Background commands
When a Bash or Python command is started in the background, Cracken records the command and its output durably. This requires a current Tentacle that acknowledges durable protocol version 2; Cracken rejects a background command on an older connection instead of leaving it queued. The operation continues immediately; later output and terminal success, failure, cancellation, or disconnected-Tentacle timeout are delivered back to it as a system notification. A backend replica handoff does not interrupt this delivery while the Tentacle remains connected. Stopping, archiving, or completing the operation requests cancellation of its active background commands.
Example operations
# Network reconnaissance
nmap -sV -sC -p- target.example.com -oN scan_results.txt
# Technology fingerprinting
whatweb https://target.example.com
# Directory enumeration
ffuf -u https://target.example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt
# Vulnerability scanning
nuclei -u https://target.example.com -severity critical,high
Use cases
The Bash Vessel is used throughout the assessment. During reconnaissance and discovery, it runs port scanning, subdomain enumeration, and directory brute-forcing with tools such as nmap, amass, sublist3r, gobuster, and ffuf. During vulnerability assessment, it runs automated scanning with nuclei, whatweb, and wpscan. During exploitation and post-exploitation, it runs the Metasploit Framework and can hold a background listener (for example nc -lvp 4444) alive while the operation continues, interacting with the callback through the Vessel ID.
Python Vessel
| Environment | Python REPL in the Kali container |
| Primary use | Custom scripts and automation |
| Status | Available |
An interactive Python interpreter in the same Kali container, for work that benefits from real code — multi-step API flows, data parsing, and proof-of-concept exploits. It ships the Kali image's security libraries (shodan, fierce, pandas, semgrep, and more), and you can pip install anything else at runtime.
Browser Vessel
| Environment | Headless Chromium |
| Primary use | Web application interaction |
| Status | Available |
A headless Playwright-controlled Chromium instance for automated web application testing. The agent does not script raw Playwright — it issues high-level actions (click, type, navigate) and receives a screenshot plus an accessibility-tree snapshot back after each one, with the same authenticated context you have in your own browser.
Available actions
After every action the agent receives the current URL, a fresh screenshot, the accessibility tree, and — when relevant — captured network traffic.
| Action | Description |
|---|---|
navigate | Load a URL and wait for the page to settle |
click | Click an element identified by its accessibility reference |
type | Enter text into a form field |
hover | Hover over an element to reveal tooltips or menus |
select_option | Choose an item from a <select> dropdown |
press_key | Press a keyboard key (Enter, Escape, Tab, etc.) |
scroll | Scroll the page or a specific scrollable container |
wait_for | Wait for specific text to appear or for a time interval |
drag | Drag an element to a target location |
evaluate | Execute arbitrary JavaScript in the page context and return the result |
snapshot | Capture the accessibility tree as structured text |
take_screenshot | Capture a PNG of the rendered page |
network_requests | Return all HTTP/HTTPS requests a page made, with headers and bodies |
get_state | Return the current URL and page content |
Element references for click, type, hover, select_option, and drag come from the accessibility tree — the agent reads the snapshot, picks an element by its role and label, and references it by ID, avoiding brittle CSS-selector matching.
Authenticated session import
Many targets sit behind SSO, MFA, or one-time login flows. Rather than automate the login, capture an already-authenticated session from your own browser and replay it inside the Vessel.
Install the Cracken Session Exporter extension (from the Vessel's ⋮ menu → Export from Browser → Download Extension, then load it unpacked in chrome://extensions), log in to the target as you normally would — optionally adding identity-provider domains such as okta.com or login.microsoftonline.com so their cookies are included — and Export JSON. Back in Cracken, open the Vessel's ⋮ menu → Import Session and load that file. On import the Tentacle restores the cookies, localStorage, and sessionStorage into a fresh Playwright context, so the agent inherits your authenticated session with no automated login. Session state persists across commands but is discarded when the Vessel stops — re-import to restore it.
Export Session in the ⋮ menu exports the Vessel's current session out of Cracken. Export from Browser is the extension flow for bringing a session from your own browser into Cracken.
Approval and autonomy
Browser actions go through the realm's Autonomy policy via the browser_mode setting. Under EVIDENCE_ONLY, read-only actions (navigate, snapshot, take_screenshot, network_requests, get_state, wait_for) run automatically and anything that interacts with the page requires approval; under INTERACTIVE, all actions run automatically within the realm's intrusiveness ceiling and confidence threshold. AUTO-mode operations skip the prompts entirely, still bound by the ceiling and target scope. Out-of-scope navigations (for example to link-local or metadata IPs) are rejected regardless of mode.
What you see in the ledger
Every browser action produces a record in the operation ledger: the rendered screenshot (saved as an artifact and exported with reports), the accessibility snapshot the agent used to pick its target, the final URL after redirects, and — when the action requested it — the captured network traffic (method, URL, status, headers, and bodies).
Lifecycle
| Phase | What happens |
|---|---|
| Start | The Tentacle spawns a Playwright-managed Chromium process and returns a Vessel UUID; the Vessel appears in the Tentacle view and broadcasts a vessel_create event. |
| Use | Each action is an MCP tool call routed to the Chromium process; the response carries the screenshot, snapshot, URL, and any requested traffic. |
| Stop | The browser is closed gracefully with a short timeout before a forced kill, and its session state is discarded. |
Limits
Chromium runs headless, so all feedback is screenshots and snapshots and some sites detect headless browsers. Each action has a configurable timeout; very large pages or full-page screenshots can approach internal message-size limits; and file downloads triggered by page actions aren't surfaced as artifacts automatically — fetch a file with the Bash Vessel or evaluate instead.
Coming soon
Two dedicated Vessels are planned. The work they cover is possible today through the Bash and Python Vessels; these will give it a managed surface.
Echo Vessel
The Echo Vessel will enable precise HTTP request manipulation and replay — crafting custom requests with full control over method, headers, body, and encoding, then analyzing responses in detail. Useful for testing specific endpoints, manipulating parameters, and validating fixes.
Planned capabilities:
- Manual request construction with full header control.
- Request history and modification tracking.
- Response comparison and diff analysis.
- Automatic parameter encoding and decoding.
- Request sequencing for multi-step attacks.
Reverse Shell Vessel
Reverse-shell handling already works today: start a listener (for example nc -lvp 4444) as a background command in the Bash Vessel and interact with the callback through its Vessel ID. The planned Reverse Shell Vessel will provide a dedicated, managed surface for callback handling instead of running it through a background Bash command.
Planned capabilities:
- Multi-protocol listener support (TCP, HTTP, DNS).
- Session management for multiple connections.
- Payload generation for various platforms.
- Encrypted communication channels.
- Command history and logging.
Next steps
- Tentacles — the host process that launches and runs Vessels.
- Operations — how Vessel actions appear in the operation ledger.
- Autonomy — how Vessel actions are gated for approval.