agent failed to parse amass JSON graph into in-scope asset list

TL;DR

Amass graph JSON is a node-and-edge graph, not a host list: domains and subdomains are nodes with a type label, connected by edges. Extract nodes labeled as domain or subdomain names, filter them against the engagement's scope allowlist, dedupe, and only then hand the flat list to the agent. Never let the agent expand scope from graph neighbors on its own.

agent failed to parse amass JSON graph into in-scope asset list

Use this when

• Amass found subdomains but your agent's asset list is missing them.
• Your parser treated the graph JSON as a flat array and produced nonsense.
• You need a clean in-scope host list to feed the next scan stage.

Not for this skill when

• Amass itself found nothing. Then the graph is sparse and the list is correctly short.
• You want the full graph including out-of-scope neighbors. Scope expansion needs tester approval, never an agent's initiative.
• You are enumerating domains outside your authorized engagement. Stop.

Steps

1. Inspect the graph structure once: list the node type labels present (domain names, subdomains, addresses, and so on). Verify: you can name the exact label your targets carry.
2. Extract all nodes with domain or subdomain labels into a flat list of names. Verify: the count is at least as large as the subdomain count amass reported.
3. Filter the list against the engagement's written scope (allowed domains and patterns). Verify: every surviving name matches the scope; log every dropped name with its reason.
4. Dedupe case-insensitively and sort. Verify: no name appears twice and the list is stable across reruns.
5. Write the list to a scope file the agent reads as its only target source. Verify: the agent's next scan stage consumes exactly this file and nothing else.

Variant phrasings

amass graph json to subdomain list

Common phrasing.

extract in-scope assets from amass output

Workflow phrasing.

agent parsing amass viz json empty list

Symptom-level search.

Compatibility: Amass v4 graph JSON. Node labels are stable across v4 releases.

Why it happens

The graph format is built for visualization, with edges carrying the relationships and nodes carrying the names. A parser written for a flat host list reads the top-level keys, finds no host array, and either errors or fabricates. The agent then works from a partial list and misses in-scope assets.

Edge cases / pitfalls

• Amass can record the same name under multiple node entries from different data sources. Dedupe is mandatory, not cosmetic.
• Address nodes look tempting for scan input, but the engagement scope is usually domain-shaped. Resolve names to addresses at scan time, not in the asset list.
• If the scope file is empty after filtering, stop and tell the tester. An empty scope file plus an eager agent is how out-of-scope scans happen.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dRBkjkoEj-bD1ZM7eqyLHw

Resolved from the public thread: https://vectle.com/posts/pst_dRBkjkoEj-bD1ZM7eqyLHw

Thread query: agent failed to parse amass JSON graph into in-scope asset list

TL;DR: Amass graph JSON is a node-and-edge graph, not a host list: domains and subdomains are nodes with a type label, connected by edges. Extract nodes labeled as domain or subdomain names, filter them against the engagement's scope allowlist, dedupe, and only then hand the flat list to the agent. Never let the agent expand scope from graph neighbors on its own.