Everything about the range, the deck, the board, the forge, the scope rules, every command, and an honest list of what is not built yet. If you would rather just play, start a range — you do not need any of this to begin.
Four things stacked on one another. Read them in order and the rest of this page is obvious.
A coach in the command line, not a chatbot in a tab. athelgard talk puts you
in a session with her: type a command or plain English at the same prompt. Before she
answers she looks — your position, your deck, what you named wrongly last week — and
each lookup is printed, so the advice is auditable. She grades what you name and teaches on
a wrong answer, and she never takes the graded move for you.
Districts you walk, hosts you scan. Every host is a fictional .sim twin of a
real weakness class. The evidence is real enough to reason from; the machine is not real, so
nobody can be harmed and nothing needs authorisation.
Bug bounty is not typing exploits — it is looking at behaviour and correctly saying what kind of failure it is, then defending that in writing. That is the whole loop here: observe → name → evidence → report.
A correct call earns one cell of a 74-card competency grid, recorded against your
callsign — not the range — so it survives the room closing. hunt path maps what
you hold to published exam objectives and job roles.
Every card is earnable in ASCII. The 3D arena renders the same world in geometry — better to look at, not more to play. No mechanic lives behind the glass.
A card is evidence you demonstrated a class in a simulation. It is not a certification, not employment eligibility, and not paid work. The exam is still the exam.
You do not have to. Play it in this browser — same range, same server, same grading, on a phone if you like. Install only when you want the game in the shell you actually work in, where it sits beside your own tools.
athelgard is a Node program you run inside whatever shell you already use —
PowerShell or Git Bash on Windows, Terminal on macOS, anything on Linux. It is not its own
shell and it does not replace yours. One line installs it; re-running the same line updates it
in place.
Windows — paste into PowerShell (press Win, type PowerShell, Enter):
BountyWarzirm https://www.bountywarz.com/install.ps1 | iexThat one installs Git and Node for you if they are missing, and leaves an Athelgard icon on your desktop — double-click it and you are in the game, no terminal knowledge required.
macOS / Linux / Git Bash:
curl -fsSL https://www.bountywarz.com/install.sh | bash
It needs git and Node 20+, clones to ~/bountywarz, and puts
athelgard on your PATH. Then, from any directory:
athelgard # first run: Athelgard introduces herself and sets you up
That first bare command is a conversation, not a manual: she asks what to call you, explains
the loop in four lines, opens your first range and takes a contract in your name. Every bare
athelgard after that picks you up where you stopped — where you are standing, what
you have proved, and the one command to type next. You are never handed a menu. If you
want the list instead of the mentor, ask for it: athelgard help.
Piping a script into your shell deserves a look first — read install.sh or install.ps1 before you run it. Prefer to do it by hand, or already have the repo?
git clone https://github.com/NyxSpecter4/bountywarz.git
cd bountywarz
npm install
npm link # puts `athelgard` on your PATH
Don't want it on your PATH? node bin/athelgard-cli does the same thing from
the repo directory.
No browser tab required. start is the only thing you have to remember: she
introduces herself, asks what to call you, and opens Westminster under that name.
athelgard startlook — the map viewWhere you are in the city, and what the room is.
[*] SQUARE MILE [ ] DOCKLANDS
[ ] WESTMINSTER [ ] TOWER
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
[ ] SOUTH BANK
fps / walk — the first-person viewThe same district, raycast into characters.
HHHHHHHHHHHHHH
HHHHHHHHHHHHHH
***********************#########HHHHHHHHHHHHHH#########***********
***********************#########HHHHHHHHHHHHHH#########***********
***********************#########HHHHHHHHHHHHHH#########***********
. . . . . . . . . . .HHHHHHHHHHHHHH. . . . . . .
. . . . . . . . . . . HHHHHHHHHHHHHH . . . . . .
. . . . . . . . . . . . . . . . . . . . . .
THE SQUARE MILE facing north IRON-EAGLE-K7
exits: east, south, west hosts here: 2
also here: BRAVO-K2
walk is the live loop: w forward, a/d
turn, q quit. Every step is a server move, so the other hunters in your range
and the mentor on your phone all see you arrive. The walls, the doorways and the
H blocks are not decoration — the doorways are the district's real exits and each
block is a real host you can scan.
This is the architectural decision the whole thing rests on. The world is not inside the browser and not inside the terminal — it is a session on the server. Everything else is a client reading it.
┌──────────────────────────────┐
│ THE SESSION (the truth) │
│ districts · hosts · hunters │
│ events · quests · your deck │
└──────────────┬───────────────┘
┌───────────────────┬───────┴────────┬────────────────────┐
ASCII terminal 3D London arena phone call second terminal
(this page) (/london) (Athelgard) (your teammate)Athelgard coaches from the session record, not from a guess. If she says you are in the Square Mile with two hosts unscanned, that is because the server says so.
The shell version is not a stripped-down side build that drifts. It renders the same world the 3D arena renders — so work done in one is real in the other.
A range is a room. A second person types hunt enter — she lists what is open
and takes a number — and they are standing next to you, with a shared log and
hunt say.
No. One terminal plays the game. People often keep a second one open for their own coding work, and the phone as a third surface, but nothing requires it — it is the same binary and the same session either way.
The Forever Deck is 74 cards: 22 majors and 52 minors. A minor is a method × pillar coordinate — four suits (BREACH, SHIELD, SIGNAL, FORGE) across the thirteen Zero Trust pillars. You do not earn one for finishing a level. You earn one by correctly naming the weakness class a host actually fields.
athelgard hunt scan whitehall-uplink.london.sim
Whitehall Uplink [westminster]
service : document intake on 443
observed : a document that arrives with an
appended instruction is processed whole
Now name the class you think that is:
athelgard hunt name whitehall-uplink.london.sim
Which weakness class? (a number is enough, e.g. 345)Recon shows you the evidence and withholds the answer. That is the exercise: the judgement a hunter actually makes. Get it wrong and the range teaches you the history — Walsingham's forged postscript is the same failure as an unverified document today.
+--------------------------------------------+ | /X\ BREACH 4 APPLICATION | | | | THE INJECTION | | | | Every database has a door. This key fits | | all. | +--------------------------------------------+ | earned by naming it | | You reached the data through the | | application itself. | +--------------------------------------------+
1 2 3 4 5 6 7 8 9 10 11 12 13 BREACH . . . # . . . . . . . . . SHIELD . . . . . . . . . . . . . SIGNAL . . . . . . . . # . . . . FORGE . . . . . . . . . . . . . # = proven . = not yet
athelgard hunt deck draws the matrix and every card you hold.
athelgard hunt card draws one you have not earned yet, so you can read the
target before you go.
A card is also a line on a CV. athelgard hunt path shows what you hold joined to
the vocabulary employers already buy — published exam objectives and NICE work roles — with
the sentence you would defend out loud in an interview:
Insufficient verification of data authenticity — what naming this proves
On a CV, defensibly:
identified insufficient verification of data authenticity
Published exam objectives it sits under:
SEC+ 1.4 CompTIA Security+ SY0-701 — Importance of using appropriate cryptographic solutions
SEC+ 2.4 CompTIA Security+ SY0-701 — Analyze indicators of malicious activity
Hired for it as:
Secure Software Developer / AppSec (NICE OG-WRL-013)
Defensive Cybersecurity Analyst (NICE PD-WRL-004)
It will never tell you that you are a percentage of the way to a certification. It says you demonstrated the class; the exam is still the exam. This is what you revise from.
Athelgard takes a contract in your name on your first run. It states who is paying, what they noticed, what it is worth, and the one command to type. You choose your own work later.
athelgard hunt board # every open contract, priced by severity
athelgard hunt take BW-007 # she briefs you and gives you the next move CONTRACT BW-007 — Whitehall Document Service
----------------------------------------------------------------------
asset : whitehall-uplink.london.sim (document intake on 443)
severity : MEDIUM — real impact, but bounded or requiring conditions
pays : $250–$900 on a valid, in-scope report
What the client noticed:
a document that arrives with an appended instruction is processed whole
Your move — observe it before you name anything:
athelgard hunt scan whitehall-uplink.london.sim
Payouts follow real severity bands — critical outpays medium by an order of magnitude, the way public programs actually price them. Deciding what a finding is worth is the judgement a bounty hunter is paid for, so the range charges you to learn it.
Every contract is a fictional twin of a real product class with a real CWE behind it. Safe to attack, and the skill transfers unchanged — that is what a cyber range is for.
athelgard hunt graduate leaves the range: live programs that are open
and paying right now, with their own published in-scope assets, read from the public
bounty index. Real companies. Read their policy, stay inside their scope.
London is authored. A forged range is not: name a role and Athelgard asks the public labour data what that job pays and employs, asks the public vulnerability feed what is actually being filed against its weakness classes this quarter, and writes a playable range from the answers.
athelgard hunt forge security-analyst # live BLS + NVD in, a range out
athelgard hunt open role-security-analyst
athelgard hunt gap role-security-analyst # the cells it can award that you cannot yet prove
athelgard hunt ranges # the shelf: authored and forged alikeThe real layer decides what is worth teaching — the occupation, the wage, the
classes being filed. The fiction layer is what you play: a .sim twin. No real
vendor or product name ever reaches a player, and no real system is ever a target.
If the labour feed has nothing for that occupation, or the vulnerability feed has nothing for any of its classes, the forge fails rather than inventing a wage or a CVE. A made-up number would make the whole thing worthless.
Because the deck is a grid, the cells a role's range can award and you do not hold are your capability gap against that role — measured from what you have demonstrated, not self-assessed.
The point of the game is to make you an ethical hunter, so authorisation is enforced by the software rather than described in a README.
*.london.sim, localhost, 127.x, ::1
and RFC1918 private networks. Nothing else.
The CLI refuses out-of-scope targets before sending, and the server refuses them again on arrival. A patched client still gets nowhere.
An out-of-scope target does not just error. It tells you why the boundary exists and what an authorisation actually is.
Be clear about this: not yet. The CLI runs a fixed recon tool set —
nmap, curl, dig, host, whois,
nc — each invoked with an argument array, never a shell string, so there is no
command injection surface and no arbitrary execution. Real bash belongs in a
per-session sandbox container, and that container is not built yet. Until it is, the honest
description is "a hunting client with real recon tools", not "a shell in the game".
| Command | What it does |
|---|---|
athelgard | Athelgard herself. First run introduces her; every run after picks you up where you stopped and gives one next command. |
athelgard help | The command list — for when you want the list instead of the mentor. |
athelgard start | Meet Athelgard — callsign, the loop, your first range. Runs itself on first launch. |
athelgard help "…" | Ask in plain English. She answers; she does not print a menu. |
athelgard ask "…" | Ask Athelgard herself. No API key needed — she answers from the deployed brain. |
talk | The room. One prompt, commands or plain English; she looks things up before answering and always ends on the next command. |
hunt coach "…" | The same mentor for a single question, without staying in the room. |
athelgard hunt | No arguments — explains the loop and where you are. |
hunt open | Create a range on the server and enter it. She asks your callsign if she has not met you. |
hunt open london | Open a range by name — authored or forged. |
hunt ranges | The shelf: every range available to open. |
hunt forge analyst | Build a range from live labour and vulnerability data for that job role. |
hunt gap london | Cells that range can award which you cannot yet prove. |
hunt board | Contracts on the range: what is worth working, and what it proves. |
hunt graduate | Live public programs, read-only, matched to what you have proven. |
hunt enter | Join someone else's range — she lists what is open and takes a number. This is multiplayer. |
hunt sessions | List live ranges — terminal-made and browser-made alike. |
hunt look | Map view: the city, the room, who is with you. |
hunt fps · hunt eyes | One first-person frame from where you stand. |
hunt walk | Live loop — w forward, a/d turn, q quit. |
hunt turn left | Turn without entering the loop. |
hunt go east | Move through a real exit — a direction or a district name. |
hunt say "…" | Speak to everyone in the range. |
hunt scan whitehall-uplink.london.sim | Recon. Shows evidence, withholds the class. |
hunt name whitehall-uplink.london.sim | Name the weakness class — she asks which one. Correct calls earn the card. |
hunt finding | Log the evidence behind the call. She already knows the host and the class you named. |
hunt report | Produce the write-up — the part real bounty work is judged on. |
hunt deck | Your competency matrix and every card you hold. |
hunt card | Draw a card you have not earned, to read the target before you go. |
hunt path | Exam objectives and job roles your cards map to. |
hunt status | Session, callsign, quest progress. |
A page that only lists wins is a sales page. This is the real state of it.
| Piece | State | Detail |
|---|---|---|
| Server-owned London range | Built | Five districts, real exits, simulated hosts, real CWE metadata. |
| Terminal-only play | Built | No browser tab needed to create or play a range. |
| ASCII first-person renderer | Built | Geometry derived from the district's own exits and hosts. |
| Multiplayer rooms | Built | Shared range, shared log, presence in both views. |
| Cards in the terminal | Built | Drawn from the one 74-card deck; correct claims write to the ledger. |
| Hunt quest track | Built | Recon → name the class → evidence → write-up → scope discipline. |
| Phone coaching on live state | Built | Reads the same session; falls back to templates only if every model provider is down. |
| 3D London arena | Built, unoptimised | Renders today; 16 landmark meshes exceed the triangle budget and need decimation. |
| Cards → certification pathways | Partial | Every London class maps to published exam objectives and NICE roles
(hunt path); the London CWE set does not cover every cell of the deck yet. |
| Forged ranges from live data | Built | Public labour + vulnerability feeds in, a playable range out; refuses rather than inventing a figure. |
| Subject-blind range engine | Built | Ranges are data packs. A non-cyber range runs on the same engine with no code changes. |
| Forging a non-cyber career | Not built | Needs a public feed of real failures for that trade. The engine is ready; the data is not. |
Real sandboxed bash | Not built | Needs a per-session container. Fixed recon tools only for now. |
| Live bounty matching | Not built | Bounty feeds exist; nothing yet filters them by the cards you hold. |
| Our own terminal emulator / IDE / PWA | Not built | You use your own shell. A packaged surface is possible, not shipped. |
Your own. On Windows that is usually Git Bash; on macOS or Linux it is whatever you already
run. athelgard is a program you launch inside it, not a shell of its own.
Structurally, yes — a server-owned world with rooms, exits, presence and text. The difference is what you do in the rooms: the hosts field real weakness classes, and progress is a competency claim rather than a level.
They share the session record, so events raised from the terminal are visible to the arena and to phone coaching. Both surfaces read one state rather than syncing two.
No, and that is deliberate. Recon is limited to the simulated range and private addresses, enforced on both the client and the server. Learning where the boundary is is the training.
Coaching routes through the shared provider chain — DeepSeek first on quality, then Groq, then further fallbacks — grounded in the live session, with canned responses kept only as a floor if every provider is unavailable.
Against your callsign on the server, not against the range — close the terminal, open a different range next week on another machine, and the record is still yours, with the class that proved it and when. The live session carries it too, which is why the phone and the browser can both see it.