Agent Plugins Marketplace
← All plugins

outrider-recon

v4.0.0

Claude-native authorized external recon and ASM methodology bundle with 90 documented capabilities across 11 skills, deterministic Python controls, an optional loopback-only limited-control web plane, explicit human-reviewed finding promotion, and optional fixed policy-gated MCP enrichment. It does not provide unrestricted exploitation or autonomous recon orchestration.

Claude Code11 Skills1 MCP serverstdio

By Adam Rhys Heaton (Ap6pack)License: MIT12 GitHub starsUpdated last week

Directory evidence

Runtimes
Claude Code
Parsed components
12 skill or MCP entries
Source updated
Sep 12, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install outrider-recon for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install outrider-recon@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/Ap6pack/outrider-recon

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The repository root is the plugin root.

Plugin files

outrider-recon/
├── .claude-plugin/plugin.json
├── skills/analysis-and-reporting/SKILL.md
├── skills/cloud-and-infra/SKILL.md
├── skills/identity-fabric/SKILL.md
├── skills/offensive-osint/SKILL.md
├── skills/osint-methodology/SKILL.md
├── skills/people-breach-intel/SKILL.md
├── skills/post-discovery/SKILL.md
├── skills/recon-asset-discovery/SKILL.md
├── skills/report-template/SKILL.md
├── skills/secrets-and-dorks/SKILL.md
├── skills/web-surface/SKILL.md
└── .mcp.json

Included Skills11

analysis-and-reportingskills/analysis-and-reporting/SKILL.md

Endpoint interest scoring (0–100), mobile app ownership confidence, attack-path hint patterns (35 templates), severity decision matrix (92 examples), sector severity overrides, and sidecar coordination.

cloud-and-infraskills/cloud-and-infra/SKILL.md

Cloud-native service fingerprints, Kubernetes/container exposure, CI/CD platform exposure, TLS deep audit, and favicon hash pivot for authorized infrastructure recon.

identity-fabricskills/identity-fabric/SKILL.md

Concrete endpoints, probes, and enumeration techniques for identity provider fingerprinting and auth surface mapping. Covers Microsoft Entra (Azure AD), Okta, ADFS, Google Workspace, generic OIDC (Keycloak/Auth0/Ping/OneLogin/Duo), SAML metadata, AWS account-ID extraction, Microsoft 365 deep enumeration (Teams/SharePoint/OneDrive/OAuth/Power Platform), GraphQL field-suggestion enumeration when introspection is disabled, and LinkedIn employee enumeration with role prioritization. Use when mapping an org's auth architecture, enumerating SSO/IdP surfaces, or building a target employee list.

offensive-osintskills/offensive-osint/SKILL.md

Router for the Offensive OSINT arsenal. Dispatches to focused sub-skills by task type. Covers the full external red-team surface: asset discovery, web enumeration, identity/SSO, secrets/dorks, post-credential workflows, cloud/infra, people/breach intel, and analysis/reporting. Companion to osint-methodology. Use for any authorized external recon, bug bounty, or ASM engagement.

osint-methodologyskills/osint-methodology/SKILL.md

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.

people-breach-intelskills/people-breach-intel/SKILL.md

Breach data lookup, HudsonRock infostealer intel, email-pattern inference, email harvest, Slack/Discord discovery, package registry leaks, and vulnerability prioritization endpoints.

post-discoveryskills/post-discovery/SKILL.md

Post-credential enumeration workflows for validated live keys — AWS IAM enum, GitHub PAT scope/repo enum, Slack workspace enum, JWT triage, Postman PMAK workspace enum, Anthropic/OpenAI usage enum. Requires validator confirmation first.

recon-asset-discoveryskills/recon-asset-discovery/SKILL.md

Subdomain enumeration, CT logs, DNS record catalog, WHOIS/RDAP, and passive reconnaissance for authorized external recon.

report-templateskills/report-template/SKILL.md

Autonomous report generation from collected findings. Produces bug bounty submissions, client deliverables, and vulnerability reports using the standard finding schema.

secrets-and-dorksskills/secrets-and-dorks/SKILL.md

48-pattern secret regex catalog, 70 dork corpus across 9 categories, GitHub code-search dorks, and 9 read-only credential validators for authorized secret discovery and verification.

web-surfaceskills/web-surface/SKILL.md

Probe paths, endpoint scoring, email security analysis, vendor fingerprints, documentation leak hunting, and API endpoint references for authorized web-surface enumeration.

MCP servers1

outrider-reconstdio
command
python3
args
mcp-server/server.py

Plugin manifests1

.claude-plugin/plugin.json
{
  "name": "outrider-recon",
  "version": "4.0.0",
  "description": "Claude-native authorized external recon and ASM methodology bundle with 90 documented capabilities across 11 skills, deterministic Python controls, an optional loopback-only limited-control web plane, explicit human-reviewed finding promotion, and optional fixed policy-gated MCP enrichment. It does not provide unrestricted exploitation or autonomous recon orchestration.",
  "author": {
    "name": "Adam Rhys Heaton (Ap6pack)",
    "url": "https://github.com/Ap6pack"
  },
  "homepage": "https://github.com/Ap6pack/outrider-recon",
  "repository": "https://github.com/Ap6pack/outrider-recon",
  "license": "MIT",
  "keywords": [
    "osint",
    "recon",
    "red-team",
    "bug-bounty",
    "attack-surface",
    "reconnaissance",
    "security",
    "pentesting",
    "subdomain-enumeration",
    "secret-scanning"
  ],
  "skills": "./skills/"
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[outrider-recon on Agent Plugins Marketplace](https://pluginsmp.com/plugins/outrider-recon)