Haryy985/yunkun-console-preview

Treat this as a product preview and design document, not a tool you can install and rely on today. The repository's own description states it currently contains only articles and screenshots with no product source, while the README points to a source/ directory and Windows offline releases, so the two accounts of what is shipped conflict and should be checked before planning around it.

The problem

In an authorized pentest, the hard part after the scan is often reconstructing what happened: which tool the agent called, what request produced a finding, and whether a colleague can reproduce the result. Teams end up stitching together chat logs, proxy history, notes and a separate report. The stated workflow here puts the conversation, execution trace, HTTP request/response records and finding report in one console, so the report is assembled from linked evidence rather than retyped afterward. The promised result is a task view showing what is running, where a conclusion came from, and what someone else would need to repeat it.

What's different

The distinctive mechanism is a human-gated loop around an agent. The agent may submit proposals to add or correct knowledge, but those enter retrieval only after a person approves them. Findings are meant to carry real step and traffic evidence plus manual quality review, and reports are organized around the vulnerability description, URL, HTTP request packet and key response instead of old curl repro commands. Automation speeds collection and drafting while authorization boundaries and conclusions stay with the operator.

The console also bundles RAG knowledge bases, proxy discovery and validation via FOFA/Quake, tool/MCP/Skills configuration, token accounting and flow auditing beside the agent chat. That breadth is the main trade-off: fewer vantages point, but many moving parts to configure and keep running, and the author admits the full chain of real models, proxies and complete tasks has not been accepted end to end. The supplied material is release notes and screenshots, so the quality of that gated loop cannot be judged.

Who should try it

A reasonable fit is a security team running authorized engagements in an isolated lab that wants to evaluate whether an evidence-centric agent workspace matches its reporting process. It is a poor fit for anyone needing a working tool now: there is no public demo or signed installer, Linux and macOS have no tested conclusion in this version, and the repository description says source is absent while the README links to one. A solo learner curious about approval-gated knowledge and traffic evidence is the other plausible audience.

Requirements and limitations

The documented default is Windows x64. The offline package and update manual describe a bundle with the console and PostgreSQL runtime, so that path needs no Go, Node.js, npm, Docker or network downloads; the project instructions also list an online build path in the source directory. Upgrades use backup-and-migration rather than replacing the running program, so stop the old install and back up the private database, config and Skills first. The acceptance record recommends a dedicated low-privilege environment because the native agent uses the account's local permissions with no container isolation.

Scanned PDFs, encrypted documents and older Office formats are outside general parsing guarantees; Linux and macOS have no tested conclusion here; and the author says real-model and proxy chains, external database migration and clean-system installs still need environment-specific checks. The preview also limits permitted use to reading, studying and local isolated verification.

HotRepo's take

One dated observation places this repository at #24 on the 2026-10-25 NEW-REPOSITORY board (新项目榜, not an overall Trending rank) with 135 total stars. There is insufficient comparable daily-board history to judge persistence. Given the ten-day age and the conflict over whether source and releases exist, verify repository contents and release integrity first; the acceptance record covers tests and a simulated upgrade, not the real-model task chain.