The Forge Fire — a containment sphere on a lab workbench holding swirling red and cyan attack energy, with a holographic HUD showing attack variant verdicts: Encoding Evasion FAIL, Obfuscation Chain PASS, Comment Injection FAIL, Multi-Step Exploit PASS, WAF Bypass with a bypass-success warning
v0.7.0 · Public Beta

Thuban Crucible attacks its own defences — and publishes the results.

Thuban Crucible is the adversarial testing engine behind every Thuban claim. It throws hundreds of mutations at the detection engine — obfuscated payloads, encoding tricks, comment injection, multi-step chains — and reports exactly what gets caught and what doesn't. Publicly. The machine does not mark its own homework.

$ npx thuban crucible run
▶ See Crucible in action
515
Mutation Seeds
3
Intensity Levels
99.2%
Detection Rate
91/100
Thuban's Own Score
All 515 mutations run locally. Your code NEVER leaves your machine.

Crucible tests Thuban’s own Shield — not your code. It does not modify, delete, or execute anything in your project. Your code is never touched.

Attack Categories

What Crucible throws at the detection engine.

Every category below is a real class of adversarial pattern — not a hypothetical.

SQL injection
Cross-site scripting (XSS)
Path traversal
SSRF
Insecure deserialization
Prototype pollution
Secrets in base64
Secrets in hex
Secrets in Unicode
Command injection
Phantom imports
Mutated conditionals

515 adversarial mutations attempted.

511 caught before they'd count as a miss.

Every result reproduced against the real Thuban Scan source — not mocks. Full methodology in the adversarial report.

Thuban Shield hardened AI agent protection promotional poster
Mutation testing containment sphere on a lab bench, holographic panel showing MUTATION: Obfuscation Chain FAILED, MUTATION: Encoding Evasion PASSED, attack score 91.3%, CVE cross-reference, and a Public Test Results Dashboard for Crucible Instance Alpha-7
New Feature · v0.7.0

The Crucible — Adversarial Testing
Built into the Tool

Our CTO stress-tested Thuban with 7 reports across 5 languages. He found real bugs. We fixed every one, then built The Crucible so it could never happen again. Now every user gets that same adversarial testing — against 515 known attack patterns and climbing.

► Launch Dashboard Demo
Live telemetry — watch the adversarial engine run in real time

The Crucible in 45 seconds — easy → medium → hard → hell

🥐
Gentle
--level gentle
CI-friendly. Runs fast adversarial checks without breaking your pipeline. Perfect for every pull request.
⚡
Medium
--level medium
Thorough chaos and mutation testing. Runs the full adversarial seed library. For pre-release hardening.
🔥
Hell
--level hell
Every pattern in the corpus, every mutation, every edge case we’ve recorded. The most thorough run. Takes longer — worth it before a major release.
Terminal — The Crucible (hell mode)
██ ███████████████████████████ ██
█ THUBAN CRUCIBLE v0.7.0 — HELL MODE ENGAGED █
██ ███████████████████████████ ██
$ thuban crucible run . --level hell
Seeding adversarial test files across 10 languages...
515 patterns loaded — secrets, injections, mutations, chaos
[██████████████████████████████] 100% — Running adversarial suite
Chaos seeding complete. Running detection...
Golden master comparison...
Mutation testing complete.
Originals untouched. Test workspace destroyed.
████████████████████████████
CRUCIBLE SCORE 91 / 100
████████████████████████████
✓ Detection rate: 511/515 known adversarial patterns (99.2%)
⚠ 4 patterns slipped through — see report for details
Report saved: crucible-report-hell-2026-07-01.html
▶ Open: thuban crucible report --last
Crucible live attack variant testing — verdict report showing Encoding Evasion FAIL, Obfuscation Chains PASS, Comment Injection FAIL, Multi-Step Exploit PASS, and WAF Bypass with a successful bypass warning, on The Forge Fire containment vessel
Live attack variant testing — every verdict logged, pass or fail.
Mutation engine testing attack variants AV-145 through AV-149 — encoding evasion, obfuscation chain, comment injection, multi-step exploit — with an amber BYPASS SUCCESS warning glowing above the containment sphere
When a bypass slips through, the amber warning doesn't hide it.
Adversarial Engine

Six testing modes. One honest score.

The Crucible runs your codebase against 515 known attack patterns. Not a guarantee — a measurement. Every bug anyone finds becomes a permanent entry in the corpus.

🚀

Adversarial Seeding

515 known attack patterns — and climbing. Secrets in base64, hex, and Unicode. SQL injection across dialects. XSS, SSRF, deserialization, prototype pollution. Injected into isolated test copies across 10 languages. Your originals are never touched.

515 patterns and climbing
☠

Chaos & Mutation Engine

Flips operators (< to >, == to !=), corrupts strings, swaps imports, mutates control flow, inverts conditionals. Verifies your scanner catches the mutant — or flags the miss. Never touches your original files.

Chaos testing
💾

Golden Master Testing

Captures your scanner’s baseline output as a “golden master”. Every future run is compared against it. Regressions surface automatically. Approve new behaviour with a single command.

Regression guard
🔄

Self-Attack Mode

Thuban runs The Crucible against its own codebase before every release. If we find something we don’t catch, we fix it before shipping. It’s a useful discipline, not a claim of completeness. Run with thuban crucible self-test.

Tested before every release
👑

Adversarial Stress Test

A tribute to our CTO, who stress-tested Thuban with 7 detailed reports across 5 languages. He found real gaps. We fixed them — and turned his methodology into a repeatable test battery so that kind of adversarial scrutiny happens on every run, by design.

Tribute to external adversarial thinking
📊

Interactive HTML Reports

Crucible Score 0–100: how many known patterns your scanner detected, expressed as a ratio. Not a certification — a snapshot. Detection rates by language and category. Mutation miss report. Approve output changes with a command, then share the report with your team.

Honest measurement
The Origin

The Story Behind the Adversarial Stress Test

How one CTO’s adversarial testing became a permanent part of the tool.

Our CTO stress-tested Thuban with 7 detailed reports across 5 languages. He broke it — found real bugs, real gaps, real false positives. We fixed every one, in hours. Then we did something deliberate: we turned his exact methodology into an automated test battery so that external, adversarial scrutiny happens on every run, not just when someone thinks to look. We called it the Adversarial Stress Test. It’s a tribute to the value of being tested by someone who isn’t trying to make you look good — and a commitment that every bug anyone ever finds becomes a permanent test case. The corpus only grows.
7
Detailed CTO reports
5
Languages stress-tested
515+
Patterns in the corpus
growing
Every bug → new test case
A note on what this means

The Crucible is a corpus, not a proof. It tells you how many known attack patterns your scanner detects. It doesn’t tell you about patterns no-one has thought of yet. That’s why the corpus grows every time someone finds something new — including us. We think honesty about the limits of testing is more useful than confidence that testing is complete.

On the source of these findings

Adversarial testing by our own CTO, not just the development team. He stress-tested Thuban the way a skeptical customer would — actively trying to break it rather than confirm it works. Every gap he found becomes a permanent test case, so that kind of scrutiny keeps happening even when no one asks for it. It’s one data point, not a substitute for independent third-party security review.

CLI Reference

Crucible Commands

Six commands. Three intensity levels. Every run tells you exactly how many known patterns were detected — and which weren’t.

► thuban crucible — adversarial testing engine
thuban crucible run . --level hell Run against all 515 known patterns at the highest intensity. Seeds across 10 languages, runs chaos and mutation testing, scores detection rate. The most thorough reading you can get from the current corpus.
thuban crucible kenny Run the adversarial stress-test battery built from our CTO’s original 7 reports across 5 languages. Every gap he found is now a permanent test case. A tribute to adversarial thinking from outside the team.
thuban crucible self-test Thuban runs the Crucible against its own source before every release. If a pattern slips through, we fix it before shipping. A discipline check, not a guarantee.
thuban crucible approve Approve the current golden master output as the new baseline. Any future run that deviates triggers a regression alert. The approve workflow.
thuban crucible run . --level gentle CI-friendly intensity. Fast adversarial checks that complete in seconds. Drop into every pull request to catch regressions before they merge.
thuban crucible report --last Open the interactive HTML report from your last Crucible run. Crucible Score, detection rates by language and category, mutation miss breakdown.
91
Thuban’s own Crucible Score
Detection rate against known patterns: 511/515
5 not detected — tracked, being worked on — last run 2026-07-01
Why Crucible?

Deploy at scale, with proof.

The machine doesn’t mark its own homework. 515 adversarial mutations, no mercy.

Quantify your defense integrity — deploy at scale with proof, Thuban Crucible campaign header
We don't mark our own homework — forensic data-backed adversarial reports, Thuban Crucible campaign header
515 mutations, no mercy — encoding evasion and multi-step exploit chains, Thuban Crucible campaign header
Break your security before they do — 515 adversarial mutations in the Forge Fire, Thuban Crucible campaign header
Unique to Thuban

The Kill Switch: Thuban verifies itself before it verifies you

Unlike other scanners, Thuban checks its own integrity before scanning your code. If the scanner itself is broken, it refuses to give you a false sense of security.

GitHub Action — Safe Mode
$ thuban crucible run . --level gentle --json
 
Safe Mode: verifying scanner integrity before scan...
Crucible self-test: 99.2% pattern detection — PASSED
 
$ thuban scan . --ci --fail-on high
Scanning... 3 critical issues found.
Workflow FAILED — critical findings above threshold.

If the scanner fails its own test

If the Crucible detection rate falls below 95%, the entire workflow is blocked — including skipping the real scan — with: “Thuban Safe Mode: Thuban Scan self-test failed. Blocking deployment until scanner integrity is restored.” This isn’t a bug in your code; it means the tool itself needs attention before you can trust its output.

Opt out when you need to

Set self-verify: false in the workflow inputs to bypass Safe Mode temporarily while investigating a regression. It defaults to true because we’d rather block a deploy than let a broken scanner rubber-stamp your PR.

Thuban Help
Ask a question or pick a topic below.