Skip to main content
Every Neo-managed cloud sandbox includes a full security toolchain, and the agent invokes these tools from the terminal. Self-hosted sandboxes use the same managed tool image when Docker confinement is active. With native or off confinement, available tools come from the host.

​
What it includes

  • ProjectDiscovery suite: Nuclei, Subfinder, DNSx, Httpx, Naabu, Katana, tlsx, asnmap, and the rest of the toolkit
  • Red team stack: Impacket, NetExec, BloodHound, Responder, Hydra, John, Kerbrute, and Chisel
  • Web application tools: SQLMap, Semgrep, ffuf, Gitleaks, and TruffleHog
  • Runtimes and CLIs: Python, Go, Node.js, Docker, and cloud CLIs for AWS, Azure, GCP, and GitHub
  • Connectivity: VPN clients for reaching internal and isolated network targets

​
How it fits in

These tools are not registered with the model one by one. Instead the agent reaches them through its command and script execution tools, running each binary and chaining its output into the next step. In a Neo-managed sandbox, the agent can install additional packages when a task requires them. On a self-hosted sandbox, package installation and permissions depend on its confine mode and service account. You can add custom binaries, scripts, and wordlists. Anything installed in the selected environment remains available according to that sandbox’s storage and lifecycle. See Sandboxes for how cloud and self-hosted execution differ.