> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Run your first workflow
Describe what you need in plain language and Neo plans and executes it. Here's what Neo can handle:
* Pentesting applications and APIs
* Reviewing code for vulnerabilities
* Triaging scanner findings
* Mapping attack surfaces
* Validating patches
* Modeling threats
* Monitoring for new exposures
If you're getting started, the workflows below give you a structured entry point. Neo fills in the details so you don't have to get the prompt exactly right.
Long-running, contextual pentest: full recon through exploitation with real-world impact proof
Cut through noise: rank findings by true exploitability and blast radius
Exhaustive code review: full architecture mapping, data-flow tracing, and validation
***
## Your first prompts
Not sure where to start? Run these in order. The first teaches Neo how you work, and each one after it produces a result you can review in a single session. Replace anything in angle brackets with your own values, and only point Neo at systems you own or are authorized to test.
```text theme={"system"}
Before we test anything, interview me so you can work the way I do. Ask about my role, the applications, domains, and repositories I own, what is in and out of scope, any rules of engagement, and how I want findings reported. Save my preferences to memory, then give me a short summary I can paste into a project's settings.
```
Run this in **Thorough** mode. Neo asks its questions before doing anything else and stores your preferences in **global memory**, so later tasks start out knowing your role and reporting style. Paste the summary into a [project's Settings](/platform/projects) to make your scope and rules of engagement apply to every task in that project.
```text theme={"system"}
Map the external attack surface of : subdomains, live hosts, open ports, and the technologies running on each. Flag anything that looks like it should not be public, such as admin panels, staging environments, or exposed services. Do not run intrusive tests.
```
Run this in **Thorough** mode. You get an inventory of what is reachable from the internet and a shortlist of exposures worth looking at first.
```text theme={"system"}
Pentest for authentication, access control, and injection flaws. Log in with the test account stored as . Keep all testing non-destructive.
```
Run this in **Thorough** mode. Store the test account as a [secret](/concepts/secrets) first so Neo can test behind the login. You get verified findings with evidence, reproduction steps, and remediation guidance.
```text theme={"system"}
Review for security issues. Prioritize authentication, authorization, and anywhere user input reaches a database query, shell command, or file path. Report each finding with the file and line number.
```
Run this in **Thorough** mode. For a private repository, connect it in **Settings → Integrations → GitHub** first. You get findings tied to specific lines of code, each traced back to where an attacker could reach it.
```text theme={"system"}
Triage the attached scanner report. Remove duplicates and false positives, confirm which findings are actually exploitable, and rank what is left by real risk.
```
Attach the export in the task input and run this in **Fast** mode, or **Thorough** for a large report. You get a short list of findings that need action, separated from the noise.
Once a prompt works the way you want, save it to the [Prompt Library](/platform/prompt-library) so you and your team can rerun it with `/`.
***
## How Neo works
Regardless of which workflow you run, Neo follows the same four-phase process every time.
Neo reads your scope, credentials, and any context you provided, then builds a multi-step testing plan. It maps the attack surface, identifies the highest-risk areas based on the application's architecture, and decides which tools and techniques to apply in what order.
You can see the plan before execution begins and steer it if needed.
Neo works through the assessment systematically: crawling the application, probing endpoints, testing authentication and authorization flows, attempting injection, chaining findings into multi-step attack paths, and running browser-based tests for client-side vulnerabilities.
Every command, request, and decision streams in real time so you can follow along or intervene at any point.
Before reporting any finding, Neo independently confirms it is exploitable. It re-runs the attack, captures the full evidence trail (payloads, request/response pairs, screenshots, execution logs), and validates that the issue is real, not a theoretical concern.
Findings that cannot be confirmed are discarded, not reported.
Neo delivers a complete report in your chosen format: every confirmed vulnerability with its severity, evidence, reproduction steps, and remediation guidance. If you have Linear, Jira, or GitHub connected, Neo automatically creates issues for each finding. No copy-pasting required.
Stay in session for your first run. Watching Neo plan and execute gives you a clear sense of how it thinks, which makes every subsequent run easier to direct.
***
## Using Neo Effectively
Once you've seen Neo complete a workflow end to end, the next step is learning how to collaborate with it effectively.
Neo works best when you treat it like a security engineer on your team: share intent, give context, and let it think and work through the details.
You can brief it like a teammate, describing what to test, what to avoid, and what success looks like, or give it freedom to explore creatively, like you would with a red teamer.
* When your goal is **specific**, Neo executes with precision:
> "Test the staging API for authentication flaws and create tickets for confirmed issues."
>
> "Re-scan assets discovered last week and flag new endpoints only."
* When your goal is **broad**, Neo thinks like an attacker, exploring systems creatively to uncover real paths to risk:
> "Find ways to move laterally from our exposed APIs into internal systems."
>
> "Explore potential privilege escalation paths across the staging environment."
In both cases, Neo plans a multi-step workflow: mapping assets, selecting tools, chaining tests, and adapting its approach as it learns more about your environment.
It can pivot between structured workflows and creative exploration seamlessly.
**Quick Tips**
* Use clear intent, but don't be afraid to give Neo open-ended goals; it performs well in both.
* Provide context once: Neo remembers and builds on it.
* Interact mid-run: steer or refine in real time.
* Chain workflows for compounded efficiency and coverage.
* Review outputs early: transparency builds trust quickly.
* Iterate toward autonomy: start guided, scale over time.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.