Binding contract for all official and custom NXS. Source: nxs/CONTRACT.md (v0.1). Breaking changes increment major version; additive fields stay compatible within the same major.

Mandatory

Every NXS must be executable, support global options below, honour the exit-code table, ignore unknown meta fields, and expose a stable id.

Invocation

nxs-<name> [GLOBAL OPTIONS] [SCRIPT-SPECIFIC OPTIONS]
OptionRequiredDescription
--crash <path>Yes*Input that caused the event
--target <host:port>Yes*e.g. 10.0.0.5:21
--event <type>Nocrash | hang | interesting | new_coverage | new_state
--model <name>NoProtocol model
--minimized <path>NoMinimised crash input
--meta <path>NoJSON metadata from Nexsiz
--out <dir>NoArtefact directory
--timeout <secs>NoInternal timeout
-v / --verboseNoHuman log on stderr
--help / -hYesUsage
--versionYesVersion + stable id

* At least one of --crash or --meta must be present. Meta may supply crash.path and target.

Exit codes

CodeMeaning
0Completed; no further vulnerability indication
1Operational error
2Escalate — further vulnerability / exploit-assist
3Internal timeout
4Interrupted / cancelled
≥10Script-specific success variants (document in nxs.toml)

See also Exit Codes.

Metadata JSON

Nexsiz writes meta on spawn. Minimal fields include nexsiz_version, event, timestamp, target, model, crash, result, worker_id, output_dir. Unknown fields must be ignored.

Artefacts (recommended)

<out>/
├── report.json
├── repro/
├── logs/
└── artifacts/

report.json should carry nxs_id, exit_hint, summary, findings, artifacts.

Stdio

  • stdout — concise; optional final JSON line
  • stderr — human progress/errors (-v)
  • stdin — not required; --meta - may read meta from stdin

Identity (nxs.toml)

FieldExample
idcrash/auto-repro
nameauto-repro
version1.0.0
categoriescrash,safe,default
eventscrash,hang
descriptionone paragraph