feat(orchestration): Remove SQLMap from the agent codeflow

Author: vishnurajkv

README.md

@@ -12,7 +12,7 @@ SecNode API helps security engineers and backend teams run repeatable API risk a
 
 - Ingests local or remote OpenAPI/Swagger schema files
 - **Phase 1c Deep Recon:** Automatically analyzes body schemas and uses AI to plan `arjun` parameter discovery.
-- **Tool Orchestration:** Integrates `nuclei`, `sqlmap`, and `dirsearch` directly into the agent reasoning.
+- **Tool Orchestration:** Integrates `nuclei` and `dirsearch` directly into the agent reasoning.
 - **AI-Driven Logic:** Uses an LLM to understand API behavior and generate adversarial test cases.
 - **Autonomous Agent:** Supports iterative replanning with request budgets and finding deduplication.
 - **Reporting:** Produces both human-readable Markdown and machine-readable JSON findings.
@@ -101,7 +101,7 @@ secnodeapi --target http://api.local/spec --mode agent --request-budget 500 --ma
 
 ## Docker Support
 
-The easiest way to run SecNode with all integrated tools (`nuclei`, `sqlmap`, `arjun`, `dirsearch`) is via Docker.
+The easiest way to run SecNode with all integrated tools (`nuclei`, `arjun`, `dirsearch`) is via Docker.
 
 ### Build
 ```bash

src/secnodeapi/services/tool_orchestrator.py

@@ -25,7 +25,6 @@
 from ..tools.runners.arjun_runner import ArjunRunner
 from ..tools.runners.dirsearch_runner import DirsearchRunner
 from ..tools.runners.nuclei_runner import NucleiRunner
-from ..tools.runners.sqlmap_runner import SqlmapRunner
 from ..vulnerability_models import APIEndpoint, Finding, SchemaStructure
 
 logger = structlog.get_logger(__name__)
@@ -64,7 +63,6 @@ async def _ask_ai_for_tool_plan(api_structure: SchemaStructure, base_url: str) -
         "  - dirsearch: Directory and endpoint brute-forcing. Run on the base URL.\n"
         "  - arjun: HTTP parameter discovery. Run on each endpoint URL.\n"
         "  - nuclei: Vulnerability scanning with templates. Run on the base URL.\n"
-        "  - sqlmap: SQL injection verification. Run only on endpoints with query parameters or forms.\n\n"
         "Return ONLY valid JSON: "
         '{"plan": [{"tool": "tool_name", "target_url": "https://...", "reason": "why", "priority": "high|medium|low"}]}\n'
         "Limit total invocations to 8 maximum. Prioritize dirsearch and nuclei first."
@@ -110,8 +108,6 @@ async def _run_single_tool(plan: ToolPlan) -> tuple[ToolPlan, ToolRun]:
         run = await runner.run_with_output(invocation_id, plan.target_url)
     elif plan.tool == "nuclei" and isinstance(runner, NucleiRunner):
         run = await runner.run_api_scan(invocation_id, plan.target_url)
-    elif plan.tool == "sqlmap" and isinstance(runner, SqlmapRunner):
-        run = await runner.run_verification(invocation_id, plan.target_url)
     else:
         run = await runner.run(invocation_id, plan.target_url, [])
 

src/secnodeapi/tools/parsers/normalized.py

@@ -290,7 +290,6 @@ def _parse_generic(run: ToolRun) -> List[ParsedFinding]:
     "dirsearch": _parse_dirsearch,
     "nuclei": _parse_nuclei,
     "ffuf": _parse_ffuf,
-    "sqlmap": _parse_sqlmap,
     "zap-cli": _parse_zap,
     "zap": _parse_zap,
     "kr": _parse_kiterunner,

src/secnodeapi/tools/runners/__init__.py

@@ -5,15 +5,13 @@
 from .ffuf_runner import FfufRunner
 from .kiterunner_runner import KiterunnerRunner
 from .nuclei_runner import NucleiRunner
-from .sqlmap_runner import SqlmapRunner
 from .zap_runner import ZapRunner
 
 RUNNERS = {
     "arjun": ArjunRunner(),
     "dirsearch": DirsearchRunner(),
     "ffuf": FfufRunner(),
     "nuclei": NucleiRunner(),
-    "sqlmap": SqlmapRunner(),
     "zap": ZapRunner(),
     "kiterunner": KiterunnerRunner(),
 }