Black box from a URL, grey box with logins, white box across your repositories. interopt refuses to report anything it cannot prove against what it actually saw.
You name a target and pick a depth. Black box takes a URL and nothing else. Grey box takes test accounts, or registers its own where signup is open, so everything behind the login is in scope. White box pairs the running target with the repository behind it — and where there is no environment to point at, the agent stands one up and tears it down when the run ends.
Without source, a finding is an endpoint and a response. With it, the agent follows the route to the handler that served it and cites the file and the line, so triage stops being an investigation before it starts. The same pass reads what has been committed that should not have been, and what your dependencies actually ship rather than what the manifest claims.
The agent writes the change against your codebase, on its own branch, reusing the helpers already in the project instead of inventing its own. Nothing merges on your behalf: the diff arrives file by file, you drop whatever you do not want, and the pull request opens when you say so.
A pentest is a date in the calendar; this is a schedule you own. Run it daily, weekly, monthly, once a quarter, or on every push to a branch. The configuration you chose is frozen into that schedule — same depth, same scope, same accounts — so the tenth run is as thorough as the first. What changes between runs is your code, which is the only variable you wanted measured.
A finding that cannot show you all of this does not reach your queue. It is dropped, not downgraded.
Where it exploited something, the exact request and the response that came back, so you can run it again and get the same result.
What the issue actually gets an attacker, worked out against your app rather than read off a severity table.
The file and line behind the behaviour, once your repositories are connected.
Every pentest ends with a full report, the same document we used to write by hand, generated the moment the run finishes rather than days later. That is what you hand an auditor for SOC 2 or ISO 27001, without anyone assembling it afterwards.
Every step the agent took is recorded and can be replayed end to end. When a finding is challenged, the answer is the transcript rather than a debate about whether the tool is trustworthy.
Where there is nothing running to test, the agent builds the target from source and tears it down after. Production stays out of scope unless you put it in.
Run the whole thing inside your own infrastructure, with an audit log for every run, when the code cannot leave your network.
Read them in interopt, or push them to Jira, Linear or GitHub Issues so they queue with everything else. Alerts go to Slack, Teams or Discord at the severity you choose.
Testing runs against the app as deployed, so the language is never a prerequisite. Connect source and the agent works the frameworks out from the repo.
A URL, a set of logins, or the repository itself. interopt tests what it is given, proves what it finds, and with your code connected, opens the pull request that fixes it.
