# FAQ

> Quick answers to common questions about installing, running, and writing solutions.

Short answers to the questions that come up most. Each one links to the page that goes deeper.

## Do I need to know how to program?

No. A solution is a plain text file, one instruction per line. Lines that start with `#` are comments, and everything else is a `name: value` line. The [authoring guide](/docs/guides/authoring/) walks you from a one-step file to a full attack, and every stage ends with a checkpoint.

## Who is Exploitmatic for?

Security analysts, penetration testers, red teams, CTF players, and engineers who regression-test patches in CI. If your job is replaying a known attack and proving it worked, that is the gap it fills.

## Is Exploitmatic free?

Yes. The runtime and the solution corpus are open source under the Apache
License 2.0. The binary is downloaded from the
[releases page](https://github.com/exploitmatic/exploitmatic/releases).

## Is Exploitmatic production-ready?

Yes, for its scope. Exploitmatic is released: each version is a tagged binary on the [releases page](https://github.com/exploitmatic/exploitmatic/releases) with checksums. It is pre-1.0, so full backward compatibility is not guaranteed until v1.0.0, and the changelog calls out breaking changes. It is an offensive tool, so run it only against targets you own or are authorized to test.

## Is Exploitmatic a scanner?

No. It replays one documented attack against one target. It does not crawl, discover, or sweep a network. Think of it as a verified replay of a known technique, not a discovery tool.

## Is Exploitmatic an exploit framework?

No. There is no console and no module library. A solution is a data file that the runtime reads; nothing gets loaded or executed from the file. The trade is intentional: a text file is reviewable and diffable where a console session is not.

## How is Exploitmatic different from a hand-written replay script?

A replay script is ad hoc and different on every team. Exploitmatic formalizes it with one grammar, and the file is data, not code: reviewable, diffable, and writable by an LLM. The same file that verifies a vulnerable build regression-tests the fixed one.

## Does Exploitmatic have a GUI?

Yes. Running `exploitmatic` with no arguments opens the desktop workbench, where you write solutions, replay them, and read the result. The workbench runs the runtime and an MCP server in-app, so editors such as VS Code can drive it with no separate service. Pass `--cli` or a subcommand to use the command line, which is what scripts and CI run. See the [command line reference](/docs/usage/cli/).

## What are Exploitmatic's limitations?

It is not a scanner and one run is one target. It replays known attacks; it does not fuzz or find new ones. To check many hosts, loop the command line in a shell.

## Can I use Exploitmatic in CI to regression-test a patch?

Yes. That is the dual-use property: a solution that verifies a vulnerability on a vulnerable build is the same file that regression-tests the patch on a fixed build. The result line is a clean gate for a pipeline.

## What can I run it against?

Only systems you own or are authorized to test. See [Scope and ethics](/docs/scope/) for the rules, including the replica workflow: refine against a local replica first, then verify against an authorized target.

## What does the runtime print?

One line per step, then a result line. Each step line shows the step name, whether the test passed, and which test ran. There is no artifact file; the console output is the result.

## Why a plain text format and not JSON?

So the file reads like a checklist, not markup. There is no syntax to remember, comments are allowed, and diffs stay clean. The format stays strict where it matters: the runtime validates required fields and hex at load time and refuses to run a bad file.

## What are host steps?

Steps that run commands or read files on your own machine, such as reading the flag file a lab writes. They run like any other step; the tool runs on your host. See [Usage](/docs/usage/cli/).

## Can I describe an attack in natural language?

Yes, through an LLM. The runtime itself takes a `.txt` file only, and that is the point: the file is exact, reviewable, and deterministic. Describe the attack in your own words, have an LLM draft the `.txt` file from the [format reference](/docs/solution/format/), review the file, then run it.

## Can I write my own solutions?

Yes. Start with the [authoring guide](/docs/guides/authoring/), read the worked example in [Solutions overview](/docs/solution/), and use the [solutions](/docs/solutions/) as reference implementations.