Remove proprietary jxscout-pro-v2 material from MIT web-security capability (ADM-81)

capabilities/web-security/agents/web-security.md

@@ -122,7 +122,6 @@ You may also have tools from MCP servers. Check your tool schema for what's avai
 
 - **Proxy tools (Caido, Burp):** When a finding passes `assess_confidence`, replay the PoC through the available proxy to capture clean request/response evidence for the report. Use whichever proxy tools or programmatic approach fits the flow naturally.
 - **thermoptic**: Routes traffic through a TLS-fingerprint-resistant proxy. Useful when `execute_http` is blocked by bot detection or WAF fingerprinting.
-- **jxscout**: Finds **gadgets**, not vulnerabilities. Always trace data flow and confirm exploitability before reporting. Load the `jxscout-security-research` skill for the full workflow guide.
 - **agent-browser**: Prefer running the local `agent-browser` CLI directly when it is available on `PATH`; it is the primary browser automation path. **Always use a unique session name** (`--session <name>`) to avoid collisions with other agents or concurrent tasks sharing the same browser daemon — e.g. `agent-browser --session $(uuidgen || echo $$) open <url>`. Without an explicit session name, all callers share the default session and will clobber each other's page state. If the CLI is unavailable, use `agent_browser_status` to verify the MCP fallback, then use `agent_browser_open`, `agent_browser_snapshot`, `agent_browser_click`, `agent_browser_fill`, `agent_browser_wait`, `agent_browser_get`, and `agent_browser_screenshot` for normal browser workflows. Use `agent_browser_run` only for fallback CLI subcommands not covered by a specific MCP tool. If neither the local CLI nor the MCP fallback is available, fall back to non-browser HTTP testing or ask for the dependency only when a real browser is required.
 - **protoscope**: Prefer running the local `protoscope` CLI directly when it is available on `PATH`; it is the primary protobuf inspection and assembly path. If the CLI is unavailable, use `protoscope_status` to verify the MCP fallback. Use `protoscope_inspect_file` or `protoscope_inspect_hex` to decode binary protobuf payloads, and `protoscope_assemble_text` or `protoscope_assemble_file` to build binary protobuf bytes from Protoscope text. Use descriptor-set and message-type options when available to improve field names and enum output.
 - **hackerone**: Query HackerOne programs, scopes, reports, and hacktivity. Run `hackerone_health` first to verify credentials. Use `hackerone_get_program_scope` to enumerate in-scope assets before testing. Use `hackerone_search_hacktivity` to study previously disclosed vulnerabilities in a program. Use `hackerone_submit_report` only after the reporting pipeline completes (assess_confidence → report-preflight → exploit-verifier → report_item). Requires `H1_USERNAME` and `H1_API_TOKEN` env vars.
@@ -168,7 +167,7 @@ Before reporting any finding, complete this sequence:
 3. Load `exploit-verifier` skill — Run the Triple-Check (static viability, dynamic trigger, sink confirmation).
 4. Call `report_item` with type `web_vulnerability` — populate fields from your validated evidence. The schema enforces structure; fill what you have, leave optional fields empty when black-box testing doesn't yield them.
 
-If triaging batch findings from scanners or jxscout, load `vuln-critic` first to filter before entering this pipeline.
+If triaging batch findings from scanners, load `vuln-critic` first to filter before entering this pipeline.
 
 Do not skip steps 1-3. Do not report unverified findings.
 

capabilities/web-security/capability.yaml

@@ -1,6 +1,6 @@
 schema: 1
 name: web-security
-version: "1.15.1"
+version: "2.0.0"
 description: >
   Web application penetration testing with 83 attack technique playbooks
   covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
@@ -18,7 +18,7 @@ description: >
   @caido/sdk-client / caido-ts) for curl-through-Caido
   testing, match & replace rules, and replay handoffs; Burp proxy
   integration via MCP, browser automation via
-  agent-browser, JS static analysis via jxscout, AST-based code pattern
+  agent-browser, AST-based code pattern
   search via ast-grep, protobuf inspection via
   protoscope, credential management, DNS rebinding, HTTP desync
   fingerprinting with byte-exact smuggling payload construction, blind
@@ -63,12 +63,6 @@ mcp:
         CAIDO_ACCESS_TOKEN: "${CAIDO_ACCESS_TOKEN:-}"
         CAIDO_ALLOW_SENSITIVE_HEADERS: "${CAIDO_ALLOW_SENSITIVE_HEADERS:-}"
       init_timeout: 60
-    jxscout:
-      command: "uv"
-      args:
-        - "run"
-        - "${CAPABILITY_ROOT}/mcp/jxscout.py"
-      init_timeout: 60
     thermoptic:
       command: "uv"
       args:
@@ -204,8 +198,6 @@ checks:
     command: command -v ast-grep
   - name: wrangler
     command: command -v wrangler
-  - name: jxscout
-    command: command -v jxscout-pro-v2
 
 author:
   name: Dreadnode
@@ -252,7 +244,6 @@ keywords:
   - agent-browser
   - browser-automation
   - burp-suite
-  - jxscout
   - ast-grep
   - interactsh
   - oob-callbacks

capabilities/web-security/docker/Dockerfile.runtime

@@ -40,8 +40,7 @@
 #               as a cold-start aid.
 #
 # Tools NOT included (require external setup):
-#   - Burp    — set burp MCP url to a running instance
-#   - jxscout — commercial binary, requires license activation
+#   - Burp — set burp MCP url to a running instance
 
 FROM python:3.12-slim