Documentation / SwarmHack

Configuration & Environment

Configuration

All YAML configs live under config/. The npm package ships a copy of swarmhack.yaml at release/npm/config/swarmhack.yaml.

Config files

| Path | Controls | Edit when | Shipped via npm |

| --- | --- | --- | --- |

| config/swarmhack.yaml | Top-level runtime + queen + agents + reporting + rate-limit. | Customising defaults for a tenant. | yes |

| config/swarmhack.example.yaml | Annotated example. | Reference only — copy then edit. | no |

| config/swarmhack-test.yaml | Test harness overrides. | Test runs only. | no |

| config/swarmhack_phase1.yaml | Phase-1 minimal config. | Legacy use only. | no |

| config/swarmhack.schema.json | JSON Schema for swarmhack.yaml. | swarmhack config validate uses this. | no |

| config/pentest_rate_limited.yaml | Conservative rate-limit profile (5 req/s, burst 10). | High-friction targets or strict WAFs. | no |

| config/sse_capability_map.yaml | SSE capability map for upsell + delta reports. | POV-01 confirmation by SSE SE. | no |

sse_capability_map.yaml

44 entries total (29 SSE scenarios + 14 legacy CWE → SSE capability mappings + 1 SSE.* fallback). Lookup precedence: exact category → prefix wildcard → broadest fallback (SSE.*).

Schema fields per entry

| Field | Notes |

| --- | --- |

| category | OCSF finding category string (e.g. SSE.sse_ztna_001, CWE-89). |

| sse_capability | Marketing name of the SSE capability. |

| capability_kind | deployed-misconfigured, licensed-not-enabled, not-licensed. |

| license_tier | included, add-on, tier-2, tier-3. |

| remediation_short | One-line operator-facing remediation. |

| remediation_long | Full SE-actionable remediation paragraph. |

| upsell_pitch_one_liner | Sales-facing pitch line rendered into the upsell MD. |

| confidence | 0.0–1.0; renderer surfaces when ≥ 0.7. |

Add an entry during a POV by inserting a new - category: ... block; the renderer hot-reads the map at every run (no rebuild). Override the file with swarmhack scorecard --capability-map <PATH>.

Environment variables

| Env var | Effect |

| --- | --- |

| SWARMHACK_AUTHZ_DOC | Path to authz doc (same as --authz-doc). |

| SWARMHACK_ALLOW_NO_AUTHZ=1 | Confirms operator-acknowledged bypass (combine with --authz-skip). |

| SWARMHACK_INSECURE_PREFLIGHT_TLS=1 | Disable TLS verification for pre-flight reachability probe. |

| SWARMHACK_INSECURE_BANNER_TLS=1 | Disable TLS verification for recon banner-fetch client. |

| SWARMHACK_IN_TOOLS_CONTAINER | Marker that the binary is running inside the toolchain container. |

| SWARMHACK_LOG_LEVEL | Log level fallback (overridden by --log-level). |

| SWARMHACK_GOAD_ROOT | Override GOAD repo path (default ~/.swarmhack/goad/). |

| SWARMHACK_DATA_DIR | Override hash-crack data dir. |

| SWARMHACK_NO_INFO_FINDINGS | Web-crawler suppresses Info-severity findings. |

| SWARMHACK_ENABLE_BROWSER | Web-crawler opts into the headless-browser backend. |

| SWARMHACK_SQLI_MODULAR | SQLi agent uses the modular architecture. |

| SWARMHACK_SQLI_SHAPE_GATE | SQLi confirmation shape-gate tuning. |

| SWARMHACK_SQLI_JAC_MIN_BASE, _MAX_PAIR, _MIN_TOKENS | SQLi Jaccard similarity tuning. |

| SWARMHACK_REPO | Lab harness: override git remote for lab clone-goad. |

| RUST_LOG | Standard tracing-subscriber env filter; takes precedence over --log-level. |