redamon - Open-source, self-hosted AI penetration testing fr

项目说明

<img src="docs/assets/logo.png" alt="RedAmon Logo" width="120"/>
 
<img src="docs/assets/title.svg" alt="RedAmon" width="340"/>
 
<big><big>Unmask the hidden before the world does</big></big>


An autonomous AI 框架 that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing 代码 fixes, and opening pull requests on your repository. From first packet to merged patch, with human o at every critical step.

> LEGAL DISCLAIMER: This tool is intended for authorized security testing, educational purposes, and research only. Never use this system to scan, probe, or attack any system you do not own or ha written permission to test. Unauthorized access is illegal and punishable by law. By using this 工具, you accept full responsibility for your actions. Read Full Disclaimer

> 🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box. Every sol a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag fell, 工具 call by 工具 call. Auditable, line by line. See the XBOW Benchmark scorecard.

> 📊 Co, measured and self-scored: the Bug Bounty Co — The Full Taxonomy Audit (PDF, 124 pages) audits RedAmon against all 397 classes of web bug-bounty finding, one line at a time, naming the exact module, skill or scanner behind every , and scoring the recon pipeline and the agentic system separately against their own remit. It is deliberately self-critical, it records what is missing as plainly as what is covered: 134 classes complete, 210 in the build backlog, 44 deliberately excluded, with one explicit decision for every class.

<h2 align="center">Dynamic Multi-工具 Parallel Recon Pipeline</h2>

<img src="docs/assets/recon-pipeline.gif" alt="Parallel recon pipeline in action" width="100%"/>


RedAmon launches multiple reconnaissance tools in parallel, each feeding results into a shared knowledge graph in real time. Tools spin up, adapt their scope based on li, and coordinate without manual inter. The entire attack surface -- subdomains, ports, endpoints, parameters -- materializes in minutes, not hours.

<h2 align="center">Recon as a Living Knowledge Graph</h2>

<img src="docs/assets/redamon-graph.gif" alt="RedAmon Neo4j attack-surface graph rendered in 2D" width="100%"/>


Industry-standard scanners chained so each 工具's output feeds the next, then merged into a single Neo4j knowledge graph. Findings are deduplicated, relationships are explicit, and the agent inherits a structured, fully connected attack surface ready to query in natural language.

<h1 align="center">Offense meets defense. One pipeline, full .</h1>

<samp><big>Reconnaissance ➜ Exploitation ➜ Post-Exploitation ➜ AI Triage ➜ CodeFix Agent ➜ GitHub PR</big></samp>
 
RedAmon doesn't stop at finding , it fixes them. The pipeline starts with a 6-phase reconnaissance 引擎 that maps your target's entire attack surface, then hands control to an autonomous AI agent that C, tests credential policies, and maps lateral mo paths. Every finding is recorded in a Neo4j knowledge graph. When the offensi completes, CypherFix takes over: an AI triage agent correlates hundreds of findings, deduplicates them, and ranks them by exploitability. Then a CodeFix agent clones your repository, na the codebase with 11 代码-aware tools, implements targeted fixes, and opens a GitHub pull request, ready for review and merge.

---

Roadmap & Community Contributions

We maintain a public Project Board with upcoming features open for community contributions. Pick a task and submit a PR!

> Want to contribute? See CONTRIBUTING.md for how to get started.

Maintainers

<table>
<tr>
<td align="center" ="top" width="50%">
<img src="docs/assets/samuele.png" alt="Samuele Giampieri" width="120"/> 
Samuele Giampieri: Creator, Maintainer & AI Platform Architect 
AI Platform Architect & Full-Stack Lead with 15+ years of freelancing experience and more than 30 projects shipped to production, including enterprise-scale AI agentic systems. AWS-certified (DevOps Engineer, ML Specialty) and IBM-certified AI Engineer. Designs end-to-end ML solutions spanning deep learning, NLP, Computer , and AI Agent systems with LangChain/LangGraph. 
<a href=" · <a href=" · <a href=" Labs</a> 
<a href=" src="docs/assets/pathbreak.png" alt="Pathbreak - Agentic Cloud Security" width="90"/></a> 
From the same creator: <a href=" - Agentic Cloud Security</a> 
See the attack path. Then break it. 
Pathbreak is an agentic cloud security platform that discovers and the real attack paths a threat actor would exploit across your cloud. It catches the control-plane chains most tools miss. 
<a href=" - agentic cloud security</a> 
pathbreak.io
</td>
<td align="center" ="top" width="50%">
<img src="docs/assets/ritesh.png" alt="Ritesh Gohil" width="120"/> 
Ritesh Gohil: Maintainer & Lead Security Researcher 
Cyber Security Engineer at Workday with over 7 years of experience in Web, API, Mobile, 网络, and Cloud penetration testing. Published 11 CVEs in MITRE, with security acknowledgements from Google (4×) and Apple (6×). Secured 200+ web and mobile applications and contributed to Exploit 数据库, Google Hacking 数据库, and the AWS Community. Holds AWS Security Specialty, eWPTXv2, eCPPTv2, CRTP, and CEH certifications with expertise in red teaming, cloud security, C, and security architecture review. 
<a href=" · <a href="
</td>
</tr>
</table>

> Anthropic Cyber Program: the team behind RedAmon is appro Anthropic's Cyber Program.

---

Quick Start

Prerequisites

Docker & Docker Compose v2+

- macOS: Docker Desktop, with Memory raised to at least 4 GB (8 GB with --gvm) in Settings → Resources. Clone under ~/ so the path is inside the default File Sharing list.
- Windows: Docker Desktop with the WSL2 backend, run from inside the WSL2 filesystem (~/), not /mnt/c/.

That's it. No Node.js, Python, or security tools needed on your host.

#### Minimum System Requirements

| Resource | Without OpenVAS | With OpenVAS (full stack) |
|----------|----------------|--------------------------|
| CPU | 2 cores | 4 cores |
| RAM | 4 GB | 8 GB (16 GB recommended) |
| Disk | 80 GB free | 110 GB free |

> Without OpenVAS runs 7 containers: webapp, postgres, neo4j, agent, kali-sandbox, recon-orchestrator, and docker-broker (a filtering Docker-socket proxy that the recon orchestrator's spawned scan containers go through, so they can only launch the known 工具 images).
> With OpenVAS adds 4 more runtime containers (gvmd, ospd-openvas, g, g) plus ~8 one-shot data-init containers for feeds (~170K+ NVTs). First launch takes ~30 minutes for GVM feed synchronization.
> Dynamic recon and scan containers are spawned on-demand during operations and require additional resources.

> Disk sizing for a real deployment. The figures above are bare minimums to build and run the stack (fixed platform footprint: ~70 GB without OpenVAS, ~95 GB with - measured by true on-disk image size after deduplicating the shared Kali base layers). For an always-on ser real engagements, add ~100 GB of free space for operational data - the Neo4j attack graph, scan artifacts/outputs, Postgres, and container logs all grow with use. That means 200 GB without OpenVAS, 250 GB with OpenVAS, each leaving well over 100 GB free for operations. See the deployment guide for the full breakdown.

1. Clone & Install

The script builds all images and starts the services.

2. Create Admin Account

At the end of the install (and on every ./redamon.sh up or ./redamon.sh update if no admin exists), you will be prompted in the terminal:

Admin name -- display name shown in the UI (e.g. Admin, your name, anything you want).

Admin email -- used to log in at .

Admin password -- minimum 12 characters.

After creation, open and sign in with the email and password you just set.

> No prompt appeared? On a hea boot (especially --gvm, or a small VM) the webapp can take a while to come up, so the automatic prompt may be skipped. Create the admin at any time with:
>
>
>
> It waits for the webapp, then prompts for the same details. It is safe to re-run: reusing an existing admin's email resets that password, a new email adds another admin.

What the admin can do:

Switch between all users via the user dropdown in the header (including users without a password).

Create new users (with or without a password) and assign them admin or standard roles.

Set or change any user's password.

Delete users (except themselves).

Access the Users management page from the header na.

Standard users can only log in (if they have a password set by an admin), change their own password, and use the app within their own scope. They cannot switch users, create users, or access user management.

If you forget the admin password, reset it from the terminal:

Use create-admin when no admin exists yet (it upserts on email); reset-password only updates a user that already exists.

3. Configure

Open (gear icon in the header) to configure e. No .env file is needed.

LLM Pro -- add API keys for OpenAI, Anthropic, OpenRouter, AWS Bedrock, or any OpenAI-compatible endpoint (Ollama, vLLM, Groq, etc.). Each provider can be tested before saving. The model selector in project settings dynamically fetches a models from configured pro.

API Keys -- Tavily, Shodan, SerpAPI, N, URLScan, and threat intelligence keys (Censys, FOFA, OTX, Netlas, , ZoomEye, CriminalIP) to enable extended agent capabilities (web search, OSINT, C, passi intel). Unco search keys (Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet) expand target discovery across 13 search engines -- shared keys (Shodan, Censys, FOFA, etc.) are automatically reused. Supports key rotation -- configure multiple keys per 工具 with automatic round-robin rotation to avoid rate limits.

Tunneling -- configure ngrok or chisel for reverse shell tunneling. Changes apply immediately without container restarts.

All settings are stored per-user in the 数据库. See the AI Model Pro wiki page for detailed setup instructions.

4. Open the Webapp

Go to -- create a project, configure your target, and start scanning.

> For a detailed walkthrough of every feature, check the Wiki.
>
> Prefer video? Watch the Product Demos playlist on YouTube for step-by-step tutorials.
>
> Having issues? See the Troubleshooting guide or the Wiki Troubleshooting page.

Management Commands

All lifecycle management is handled by a single script:

| Command | Description |
|---------|-------------|
| ./redamon.sh install | Build + start lightweight (no GVM, no Knowledge Base, Ta web search) |
| ./redamon.sh install --kbase | Build + start with the local Knowledge Base (~4.4 GB heavier) |
| ./redamon.sh install --gvm | Build + start with G |

> Flags can be combined: ./redamon.sh install --g

| Command | Description |
|---------|-------------|
| ./redamon.sh update | Pull latest , smart-rebuild only changed services (preserves your install-time GVM/KB choice) |
| ./redamon.sh up | Start services (auto-detects GVM and KB mode from install) |
| ./redamon.sh up dev | Start in dev mode with hot-reload (auto-detects GVM and KB mode) |
| ./redamon.sh down | Stop services (preserves data) |
| ./redamon.sh status | Show running services, , GVM mode, KB state |
| ./redamon.sh clean | Remo + images, keep data |
| ./redamon.sh create-admin | Create the admin login (or reset it) -- use if no prompt appeared at install |
| ./redamon.sh reset-password | Reset an existing user's password from the terminal |
| ./redamon.sh supply-chain-sync [ecosystems] | Populate the offline OS for the supply-chain feature (default: npm; e.g. npm PyPI Go) |
| ./redamon.sh purge | Remo including all data |

Updating to a New

Just run:

The script pulls the latest 代码 from GitHub, detects which Dockerfiles and 源码 files changed, rebuilds only the affected images, and restarts the updated services. Your databases, scan results, and reports are preserved -- are ne.

> One-time note when a release adds a new background service. update re-execs the freshly-pulled script so new build/start rules apply automatically -- but only for the script you are updating *from*. When updating *from a that predates this self-heal* (i.e. your first update onto it), run ./redamon.sh up once right after update so any newly added core service is started:
>
>
>
> up is idempotent -- it starts only what is missing and lea containers untouched. After this one-time step, plain ./redamon.sh update handles e on its own.

> Upgrading across 6.9 (repository reorganization). 6.9 grouped the top-le under scanners/, services/, testing/, tooling/ and docs/. git pull moves only tracked files, so data that git does not track -- the knowledge-base index, past scan outputs, and the single-host deploy .env and TLS material -- would otherwise be left behind at the old paths. update (and up/status) migrate it for you automatically and print what moved. If any file was written by a container as root and could not be moved, finish it with:
>
>

The webapp also checks for updates automatically and shows a notification in the UI when a new is a.

Deploy to a Server (Production)

The Quick Start above runs RedAmon locally on localhost. To run a shared, internet-reachable instance on a Linux 服务端 (EC2, DigitalOcean, Hetzner, or bare metal), use the single-host deploy in tooling/deploy/single-host/. It drives redamon.sh over SSH from your laptop and wraps the stack in the internet-facing security layer RedAmon omits by default: nginx + TLS (Let's Encrypt), a host firewall, SSH hardening, and fail2ban, with a single public HTTPS origin so only the login page is reachable and e else stays bound to loopback.

Full walkthrough: Wiki: Deploying to a 服务端. Complete reference: tooling/deploy/single-host/README.md.

De Mode

For contributors and acti with Next.js fast refresh:

工具 images are built automatically on first run if they don't exist yet. The de swaps the production webapp image for a de with your 源码代码 . Every file sa instant hot-reload in the browser.

#### When to Rebuild

| What changed | Action needed |
|-------------|---------------|
| webapp/src/ (frontend code) | Nothing -- Next.js hot-reload handles it in dev mode |
| agentic/*.py (agent Python code) | docker compose build agent && docker compose up -d agent (source is baked into the image, so restart alone won't pick up .py changes) |
| recon_orchestrator/*.py | docker compose restart recon-orchestrator |
| mcp/servers/*.py (MCP servers) | docker compose restart kali-sandbox |
| agentic/Dockerfile or agentic/requirements.txt | docker compose build agent && docker compose up -d agent |
| recon_orchestrator/Dockerfile or its requirements.txt | docker compose build recon-orchestrator && docker compose up -d recon-orchestrator |
| mcp/kali-sandbox/Dockerfile | docker compose build kali-sandbox && docker compose up -d kali-sandbox |
| webapp/Dockerfile or webapp/package.json | docker compose build webapp && docker compose up -d webapp |
| recon/Dockerfile | docker compose --profile tools build recon |
| scanners/g/Dockerfile | docker compose --profile tools build |
| scanners/github_secret_hunt/Dockerfile | docker compose --profile tools build github-secret-hunter |
| scanners/trufflehog_scan/Dockerfile (Secret Multiscanner) | docker compose --profile tools build trufflehog-scanner |
| scanners/baddns_scan/Dockerfile or scanners/baddns_scan/entrypoint.sh | docker compose --profile tools build baddns-scanner |
| scanners/wc (web cache poisoning engine) | docker compose --profile tools build wcvs |
| scanners/supply_chain_scan/Dockerfile (L1 scanner) | docker compose --profile tools build supply-chain |
| scanners/supply_chain_analyzer/ (DIRTY analyzer; entrypoint is baked) | docker compose --profile tools build supply-chain-analyzer |
| docker-compose.yml | docker compose up -d (re-creates affected containers) |
| prisma/schema.prisma | docker compose exec webapp npx prisma db push |

Rebuild a single service:

Common de:

Reclaim disk space:

> For a complete de reference -- hot-reload rules, common commands, important rules, and AI-assisted coding guidelines -- see the De Guide.

---

Knowledge Base (RAG-Enhanced Web Search)

The agent's web_search tool includes a local Knowledge Base -- a RAG pipeline that searches curated security datasets (GTFOBins, LOLBAS, OWASP WSTG, NVD CVEs, ExploitDB, Nuclei templates, and agent skill docs) before falling back to Tavily web search. When the KB returns a high-confidence match, Tavily is skipped entirely for faster, offline-capable results.

How it works: When the KB is enabled, install / up / update builds a lightweight KB index (~1,200 chunks in 10-15 min on CPU). At query time, the agent runs a hybrid retrie (FAISS search + Neo4j fulltext), reranks with a cross-encoder, and checks a confidence threshold. If the score is high enough, results come from the local KB. Otherwise, it falls back to Tavily or merges both.

Default behavior: The KB is opt-in. ./redamon.sh install produces a lightweight install (~4.4 GB lighter, Ta web search). To enable the local KB, pass --kbase:

On first install with --kbase, RedAmon detects your hardware (GPU / CPU / API) and offers a quick-start profile. The choice is persisted, so subsequent update / up commands respect it without re-passing the flag.

Speed up ingestion with API embeddings: By default, embeddings run locally on CPU/GPU. On CPU-only machines, large datasets (ExploitDB, NVD) can take hours. You can offload embedding to an external API by creating a .env file from the template:

Then configure the embedding API in .env:

| | Default | Description |
|----------|---------|-------------|
| KB_EMBEDDING_USE_API | false | Set to true to use API-based embeddings instead of local model |
| KB_EMBEDDING_API_BASE_URL | *(empty = OpenAI)* | Any OpenAI-compatible endpoint (Ollama, vLLM, LiteLLM, Together AI, Azure) |
| KB_EMBEDDING_API_KEY | *(empty)* | API key for the embedding provider |
| KB_EMBEDDING_API_MODEL | text-embedding-3-small | Model name (pro) |
| N | *(empty)* | Free NVD API key for 10x faster C |

Example with Ollama (free, local, no API key cost):

> Important: Ingestion and query must use the same model. If you switch models, rebuild the index: make -C services/knowledge_base kb-rebuild-lite MODE=docker

Manage the KB:

> For full technical documentation -- query pipeline, data sources, ingestion profiles, scoring, security model -- see the Knowledge Base Technical Reference or the Wiki: Knowledge Base & Web Search.

---

Full Wiki Documentation

Built for Enterprise, Secure by Design

Security & Threat Model

Feature Highlights

System Architecture

Components

Documentation

Troubleshooting

RedAmon HackLab

Community Showcase

Legal

---

O

RedAmon is a modular, containerized penetration testing 框架 that chains automated reconnaissance, AI-dri, and graph-powered intelligence into a single, end-to-end offensi pipeline. Every component runs inside Docker (no tools installed on your host) and communicates through well-defined APIs so each layer can evol.

The platform is built around six pillars:

| Pillar | What it does |
|--------|-------------|
| Reconnaissance Pipeline | A parallelized fan-out / fan-in scanning pipeline that maps your target's entire attack surface (starting from a single domain, IP addresses / CIDR ranges, or a Domain batch of many domains scanned in turn) from subdomain discovery (5 concurrent tools) through port scanning, Nmap service detection and NSE scripts, HTTP probing, resource enumeration, and detection. Independent modules run concurrently via ThreadPoolExecutor, graph DB updates happen in a background thread, and results are stored as a rich, queryable graph. Complemented by standalone G scanning, GitHub secret hunting, and Secret Multiscanner deep secret scanning modules. |
| AI Agent Orchestrator | A LangGraph-based autonomous agent that reasons about the graph, selects security tools via MCP, transitions through informational / exploitation / post-exploitation phases, and can be steered in real-time via chat. |
| Attack Surface Graph | A Neo4j knowledge graph with 17 node types and 20+ relationship types that serves as the single 源码 of truth for every finding, and the primary data 源码 the AI agent queries before every decision. |
| E | A persistent, e attack chain graph in Neo4j that tracks every step, finding, decision, and failure across the attack lifecycle, bridging the recon graph and enabling cross-session intelligence accumulation. |
| CypherFix | Automated remediation pipeline: one triage run scores every finding from the graph with a fixed risk model, groups the ones that share a fix, has an LLM check the e behind each, and writes one fix item per group. A CodeFix agent then clones the target repository, implements a fix using a ReAct loop with 11 代码 tools, and opens a GitHub pull request. |
| Project Settings Engine | 500+ per-project parameters (exposed through the webapp UI) that control every 工具's behavior, from Naabu thread counts to Nuclei se filters to agent appro. |

---

Built for Enterprise, Secure by Design

RedAmon is engineered to drop into a real security organization, not just a researcher's laptop.

Secure by design, STRIDE threat-modeled. The whole platform is assessed end to end under STRIDE and hardened in independently waves: 代码-le separation, a filtering Docker broker in front of the host socket, fail-closed auth, SSRF egress guards, secret redaction, append-only audit trails, and a non-disableable guardrail that blocks go, military, and intergo targets. See the Security Posture and Threat Model.

Fully isolated and containerized. Every 工具, scanner, and agent runs in its own container with no host-le. Scan jobs are spawned as ephemeral sibling containers with their own filesystem and 网络 namespace, then torn down on completion, keeping the host clean and containing the blast radius of any exploit.

Go and multi-tenant. Multi-user / multi-project tenancy with admin and standard roles, DB-level user_id + project_id scoping on every node, Rules-of-Engagement enforcement, human-in-the-loop appro, and 500+ per-project settings gi the control an enterprise engagement requires.

Deploy to a server in one command. Beyond local localhost, RedAmon ships a hardened single-host deploy that stands up a shared, internet-reachable instance and wraps the stack in nginx + TLS (Let's Encrypt), a host firewall, SSH hardening, and fail2ban, exposing a single public HTTPS origin:

Full walkthrough: Wiki: Deploying to a 服务端.

---

Security & Threat Model

RedAmon is offensi, so we hold it to the standard it tests others by. It is engineered secure by design and has been assessed end to end under the STRIDE methodology (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Ele of pri), with findings remediated in sequenced, independently waves.

This is not a marketing claim. It is grounded in a published, e analysis you can read:

Security Posture - the full defense-in-depth control catalog: every layer implemented, mapped to the 代码.

Threat Model - the assets, trust boundaries, data flows, entry points, and 网络 surface the analysis was built on.

Highlights of what is implemented:

Code-le separation. The target-facing worker is the least trusted component and holds no secrets; a filtering docker-broker stands between the orchestrator and the host Docker socket (image allowlist, denies --pri, host-root binds, dangerous capabilities).

Two deployment postures, one trust model. Local (backends bound to loopback) and a hardened public-internet deploy that adds nginx + TLS, an operator gate, login rate-limiting, and a single public origin.

Fail-closed by default. Unset auth tokens reject rather than ser 数据库 credentials are refused and rotated, WebSockets require a signed ticket plus a ser same-origin check, and every request is scoped to its authenticated owner (per-user access control with anti-enumeration 404s).

Defense in depth. SSRF egress guards, secret redaction in logs, append-only audit trails, container-escape hardening, decompression and concurrency caps, and supply-chain pinning (sha256 + commit pins).

A non-disableable hard guardrail blocks go, military, and intergo targets regardless of configuration.

, release-gated remediation. Fixes ship in sequenced waves, each independently with li reproduction before and after the patch. See the Changelog security entries.

Found a ? See our Security Policy for private disclosure.

---

Feature Highlights

Reconnaissance Pipeline

A fully automated, end-to-end external attack-surface mapper running inside a Kali Linux container. Give it one input (a root domain, a subdomain list, IP/CIDR ranges, or a Domain batch: a list of hostnames grouped by domain and scanned one group after another into a single graph) and the pipeline returns a complete, structured picture of the target: every subdomain, every live host, every open port, every HTTP service with its technology stack, every crawled endpoint and discovered parameter, every CVE the target is likely to, plus dedicated scanners for GraphQL APIs, subdomain takeovers, hidden hosts behind reverse proxies, web cache poisoning & deception, and an Ad AI Surface layer that tags AI runtimes / DBs / LLM frontends / proxies / MCP servers / chat / completion / embedding / RAG endpoints and prompt-injectable parameters using header / favicon / title / path / parameter-name signatures, then actively confirms them with a dedicated AI Surface Recon module (benign chat-shape probes, MCP handshake + 工具-poisoning scan, reads — no LLM calls).

E runs on a fan-out / fan-in architecture: each phase fires as many tools in parallel as the work allows, then con before the next phase begins. 40+ industry tools integrate into one coordinated workflow, wildcard DNS poisoning is filtered out automatically with puredns, and stealth mode keeps the entire pipeline running on passi only when acti is off-limits. Findings stream into the Neo4j knowledge graph on a background thread so the scan ne on 数据库 writes, and the raw JSON is preserved for download. The detailed 工具-by-工具 breakdown is in the matrix below.

> Wiki: Running Reconnaissance | Technical: README.RECON.md

#### Recon Pipeline Tool Matrix

| Settings Tab | Phase | Tools | Type | Execution |
|:-----:|-------|-------|:----:|-----------|
| Discovery & OSINT | Subdomain Discovery | crt.sh, HackerTarget, Subfinder, Amass, Knockpy | Passive* | 5 tools parallel |
| | Wildcard Filtering | Puredns | Active | Sequential |
| | WHOIS + URLScan | python-whois, URLScan.io API | Passive | Parallel |
| | DNS Resolution | dnspython | Passive | 20 parallel workers |
| | OSINT Enrichment | Shodan / InternetDB | Passive | Parallel with port scan |
| | Unco | ProjectDiscovery Uncover (13 engines: Shodan, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet) | Passive | Before port scan (GROUP 2b) |
| | Threat Intel Enrichment | Censys, FOFA, OTX (AlienVault), Netlas, , ZoomEye, CriminalIP | Passive | 7 tools parallel (GROUP 3b) |
| Port Scanning | Port Scanning | Masscan, Naabu | Active / Passive | Both parallel (Naabu supports passi mode) |
| Nmap Service Detection | Service Detection | Nmap (-s vuln) | Active | Sequential per target |
| Port Scanning | TLS Certificate Grab | tlsx: one handshake per open non-HTTP port (SMTPS 465, IMAPS 993, POP3S 995, LDAPS 636, FTPS 990, and any odd TLS port the port scan found), capturing issuer / SAN / / posture where httpx only reaches the fi ports it dials. In-scope SAN hostnames feed back as scan targets (apex-scoped, resol); optional JARM / JA3 fingerprints and TLS / cipher enumeration | Active | After Nmap, before HTTP probing so discovered hostnames become probe targets (GROUP 3.6) |
| HTTP Probing | HTTP Probing | httpx | Active | Internal parallel |
| | Tech Detection | Wappalyzer | Passive | Sequential (post-probe) |
| | Banner Grabbing | Custom (Python sockets: SSH, FTP, SMTP, MySQL, etc.) | Active | Parallel workers |
| Resource Enum | Web Crawling | Katana, Hakrawler | Active | Parallel |
| | Archi | GAU (Wayback, CommonCrawl, OTX) | Passive | Parallel with crawlers |
| | Parameter Mining | ParamSpider (Wayback CDX) | Passive | Parallel with crawlers |
| | JS Analysis | jsluice | Active | Sequential (post-crawl) |
| | Directory Fuzzing | FFuf | Active | Sequential (post-jsluice) |
| | Browser Crawling | ZAP Ajax Spider | Active | Sequential (post-FFuf), per-seed Docker containers in parallel |
| | Parameter Discovery | Arjun | Active / Passive | Methods parallel (GET/POST/JSON/XML) |
| | API Discovery | Kiterunner | Active | Sequential per wordlist |
| | Endpoint AI Classifier | Path + parameter classifier — tags Endpoint.ai_interface_type (llm-chat, llm-completion, llm-embedding, llm-tool-call, sse-stream, mcp, llm-graphql), is_ai_rag_ingest, Parameter.is_ai_prompt_injectable against catalogued AI signatures | Passive | Sequential (post-crawl) |
| JS Recon | JS Secret Detection | 100 regex patterns + custom uploads | Passive | Parallel per file |
| | Key | 21 service (AWS, GitHub, Stripe, etc.) | Active | Rate-limited (1/sec/svc) |
| | Source Map Discovery | Comment, header, path probing | Active | Per JS file |
| | Dependency Confusion | npm registry check | Passive | Per scoped package |
| | Endpoint Extraction | REST, GraphQL, WebSocket, router patterns | Passive | Per JS file |
| | Framework Fingerprinting | 12 built-in + custom signatures | Passive | Per JS file |
| | DOM Sink Detection | 17 XSS/prototype pollution patterns | Passive | Per JS file |
| Supply Chain Recon | Malicious Package Detection | Black-box harvest of the npm package set the target serves (源码-map node_modules mining + import/require + Wappalyzer technologies), synthesized into a CycloneDX SBOM and against the offline OS. Writes Package + MalPackageFinding nodes, anchored to BaseURL via DEPENDS_ON. No new fetches (parses JS-recon output) | Passi) | Post-JS-recon (GROUP 5.5) |
| AI Surface Recon | AI/LLM/MCP/ Fingerprinting | Acti of the surfaces the classifier flagged — chat-shape probes (dialect/streaming/latency), MCP handshake + tools/list + Cisco YARA 工具-poisoning scan, OpenAPI/model-listing discovery, Julius YAML probe-pack 引擎, confirmation reads (qdrant/chroma/weaviate/milvus). Writes Endpoint.ai_* / ai_mcp_*, Parameter.is_ai_prompt_injectable, confirmed Technology(ai-*), and MCP tool-poisoning nodes | Acti, no LLM calls) | Hosts parallel, workloads sequential (GROUP 5c / Phase 4.5) |
| AI Gauntlet | Broad LLM Scan | garak — 40 probe families (prompt injection, DAN jailbreaks, encoding bypass, data-leak replay, system-prompt extraction, toxicity, malware / exploit generation, package hallucination) | Acti) | Offensi to recon; one-shot per probe, ASR per family, local-judge graded |
| | Multi-Turn Jailbreaks | PyRIT — bounded con attacks (crescendo, skeleton-key, TAP, many-shot) | Acti) | Multi-turn escalation, local attacker / judge model |
| | Quality + Safety Scan | Giskard — app-tailored detectors (prompt injection, information disclosure, hallucination, harmfulness, stereotypes, sycophancy, output formatting) | Acti) | Test set generated from the app purpose, local judge |
| | Red-Team Eval | promptfoo — public attack datasets (Pliny, Bea, HarmBench) + encoding strategies (base64, rot13, leetspeak, morse, pig latin) | Acti) | Dataset eval, ASR per plugin, local judge |
| Scanning | Scanning | Nuclei (9,000+ templates + DAST + custom template upload) | Active | Parallel with GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) |
| GraphQL Security | GraphQL Security Testing | Endpoint discovery, introspection test, schema extraction, sensiti detection, graphql-cop (12 misconfig checks: alias/batch/directive DoS, GraphiQL, trace mode, GET/POST CSRF, field suggestions) | Active / Passive | Parallel with Nuclei + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) |
| Subdomain Takeover | Subdomain Takeo | Subjack (Apache-2.0 DNS-first fingerprints) + Nuclei takeo (http/takeovers/ + dns/) + BadDNS (AGPL-3.0 isolated sidecar: CNAME, NS, MX, TXT, SPF, DMARC, wildcard, NSEC, references, zonetransfer). Cross-工具 dedup, 12+ auto-exploitable pro, confidence-scored confirmed / likely / manual_review | Active / Passive | Parallel with Nuclei + GraphQL Scan + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) |
| VHost & SNI Enumeration | Hidden Host Discovery | Curl-only dual-layer probing: L7 Host-header o + L4 TLS SNI swaps via --resolve, baseline-comparison anomaly detection, 4-tier se ladder (high for L7/L4 routing inconsistency, medium for internal-keyword matches, low/info for status/size deltas), 2,471-entry default wordlist + custom + graph-deri, discovery feedback loop into httpx | Active | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A) |
| Web Cache Poisoning | Web Cache Poisoning & Deception | Two-引擎 detection: WC, Docker-in-Docker) breadth sweep across 10+ technique classes (unkeyed-header poisoning, parameter cloaking, path/cache-key normalization, cache-key injection, web cache deception) then a RedAmon-nati confirmation (cache oracle with silent-cache frozen-Date fallback, isolated cache-buster, fingerprint-gated 框架 packs for Next.js/Nuxt/Remix, baseline→poison→clean persistence check, reflected + non-reflecti detection). Confidence-scored Confirmed/Strong/Tentative tiers, min-confidence gate; benign .invalid canaries + isolated cache buckets so the real cache is ne. Disabled by default | Active | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Origin Discovery (GROUP 6 Phase A) |
| Origin Discovery | Origin-IP Discovery (CDN/WAF unmasking) | Finds the real origin ser behind a CDN/WAF by pi on the fingerprints the origin leaks: 44 non-CDN subdomain names, SPF/MX record IPs, crt.sh SANs, the favicon hash (mmh3), internet-wide scanners (Shodan/Censys/FOFA/ZoomEye/OTX/), and passi history (SecurityTrails/). It then confirms each candidate by fetching it directly and with a forged Host: header, scoring HTML 60% + TLS cert 25% + headers 15% (± status) against the fronted site. Fail-closed SSRF / CDN-range / current-resolution / RoE filters before any probe; per-scan keyed-search budget; per-target cache; ne; con with the WAF-bypass finding via a tenant-scoped id. Disabled by default | Active / Passive | Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning (GROUP 6 Phase A) |
| Security Checks | Security Checks | WAF bypass, direct IP access, TLS expiry, missing headers, cache-control | Active | Parallel workers |
| CVE & MITRE | C | NVD API, API | Passive | Sequential |
| | MITRE Enrichment | CWE / CAPEC mapping | Passive | Sequential |

*Amass can run in active mode when configured. Knockpy performs active DNS probing.

#### Partial Recon

Run any single tool from the pipeline independently without re-running the entire scan. Up to 12 partial recons can run in parallel per project, each with independent logs, stop controls, and status badges in both the Graph toolbar and Project Settings header. Each 工具 section has a play button that opens a modal where you can review existing graph data, add custom targets (subdomains, IPs, ports, or URLs), and launch the 工具 in isolation. Results are merged back into the Neo4j graph using MERGE operations -- duplicates are updated, not recreated. The 工具 runs with all project settings (timeouts, wordlists, API keys, proxy) applied automatically. All pipeline tools support partial recon.

> Wiki: Recon Pipeline Workflow -- Partial Recon

#### AI in Pipeline

Optional LLM-augmented decision points wired inside the recon pipeline where static look-ups historically drift -- Nuclei prunes its tag list to the detected tech stack, the WAF classifier catches header-stripped Cloudflare/AWS WAF/Imperva, and many others across FFuf, Nuclei false-positi, and subdomain-takeo. Each hook is a cascade fallback after the static path with a deterministic safe fallback, so an LLM outage cannot break a scan. One master toggle in the Target tab governs them all.

The recon pipeline uses TypeSafe Jev, a typed decision model, for eight decisions: what kind of page each URL is, which host Hakrawler crawls first, which directories and extensions FFuf fuzzes, whether a 工具 failed or just found nothing, which Nuclei tags to run, whether a WAF is in front, and whether a takeover is real. Je a token on the project owner's account; see how it works in the Je the Recon Pipeline walkthrough on redamon.org.

> Wiki: TypeSafe Jev

> Wiki: AI in Pipeline

AI Gauntlet: Offensive AI/LLM Testing

Where the recon pipeline finds the AI surface, the AI Gauntlet attacks it. Pick the discovered LLM endpoints (or type a custom URL), choose a 工具, confirm the Rules of Engagement, and launch: a short-li runs the target through four industry red-team tools -- garak (broad single-shot scanner, 40 probe families), PyRIT (bounded multi-turn jailbreaks), Giskard (LLM-assisted safety scan), and promptfoo (dataset red-team eval) -- measuring an Attack Success Rate per attack and writing the confirmed weaknesses back onto the graph as OWASP-LLM / MITRE-ATLAS-mapped findings with e transcripts.

It is deterministic (seeds, fixed bounds, pinned 工具 ) and runs with zero external egress: every judge / grader / embedding call is forced to a local Ollama model, so no payload or transcript e your machine. Off by default and RoE-gated, with li progress, and findings surfaced in the Red Zone AI Gauntlet table and the pentest report.

> Wiki: AI Gauntlet | Technical: AI_GAUNTLET_TECH_DOC.md

G Scanner

G performs deep 网络-le assessment with 170,000+ NVTs, probing services at the 协议 layer for misconfigurations, outdated software, default credentials, and known CVEs. Complements Nuclei's web-layer findings. Se scan profiles from quick host discovery (~2 min) to exhaustive deep scanning (~8 hours). Findings are stored as nodes in Neo4j alongside the recon graph.

> Wiki: G Scanning | Technical: README.GVM.md

AI Agent Orchestrator

A LangGraph-based autonomous agent implementing the ReAct pattern. It progresses through three phases: Informational (intelligence gathering, graph queries, Shodan, Google dorking), Exploitation (Metasploit, Hydra credential testing, social engineering simulation), and Post-Exploitation (enumeration, lateral mo). The agent executes 14 security tools via MCP servers inside a Kali sandbox, supports parallel 工具 execution via Wa, and provides real-time chat interaction with guidance, stop/resume, and appro. Deep Think mode enables structured strategic analysis before acting.

> Wiki: AI Agent Guide | Technical: README.AGENTIC_SYSTEM.md

#### Agent Tool Arsenal

| Category | Tool | Description | Phases | MCP Server |
|:-----:|-------|-------------|:------:|:----------:|
| Intelligence | query_graph | Neo4j graph queries -- primary 源码 of truth for recon data | All | -- |
| | web_search | Internet search for C, exploit PoCs, ad | All | -- |
| | c | ProjectDiscovery vulnx -- structured C aggregating NVD + CISA KEV + EPSS + HackerOne + GitHub PoCs + Nuclei template a. 69 lucene-filterable fields. Optional PDCP key (per-user, anonymous mode = 10 req/min) | All | network_recon :8000 |
| | tradecraft_lookup | User-curated catalog of trusted security knowledge URLs (HackTricks, PayloadsAllTheThings, CVE PoC repos, blogs) -- 6 auto-detected resource types, sitemap-dri pick, sqlite+disk cache | Exploit, Post | -- |
| | shodan | Shodan OSINT -- host details, reverse DNS, device search | Info, Exploit | -- |
| | google_dork | Google dorking -- exposed files, admin panels, directory listings | Info | -- |
| Recon & OSINT | execute_subfinder | Passi enumeration (CT logs, DNS datasets). No traffic to target | Info, Exploit | network_recon :8000 |
| | execute_gau | Passive URL discovery from Wayback Machine, Common Crawl, AlienVault OTX, URLScan. No traffic to target | Info, Exploit | network_recon :8000 |
| | execute_amass | OWASP Amass subdomain enumeration and 网络 mapping (passive + active, ASN intel) | Info, Exploit | network_recon :8000 |
| Scanning | execute_naabu | Fast port scanning and | Info, Exploit | network_recon :8000 |
| | execute_nmap | Deep service detection (-sV), OS fingerprint, NSE scripts | All | nmap :8004 |
| | execute_nuclei | C and exploitation with 9,000+ templates + custom uploads | Info, Exploit | nuclei :8002 |
| | execute_httpx | HTTP probing and fingerprinting -- status codes, titles, ser, tech detection | Info, Exploit | network_recon :8000 |
| | execute_wpscan | WordPress scanner -- detects plugins, themes, users, misconfigurations | Info, Exploit | network_recon :8000 |
| Web & HTTP | execute_curl | HTTP requests -- reachability, headers, status codes, banners | All | network_recon :8000 |
| | execute_katana | Web crawling and endpoint discovery with JS parsing and known-file enumeration | Info, Exploit | network_recon :8000 |
| | execute_jsluice | Ja static analysis for hidden API endpoints, URL paths, and secrets | Info, Exploit | network_recon :8000 |
| | execute_arjun | HTTP parameter discovery by brute-forcing ~25,000 common parameter names | Info, Exploit | network_recon :8000 |
| | execute_ffuf | Web fuzzing for hidden directories, files, hosts, and parameters | Info, Exploit | network_recon :8000 |
| | execute_playwright | Headless Chromium browser automation -- JS-rendered content extraction and interacti for SPAs, form testing, XSS | All | playwright :8005 |
| Exploitation | metasploit_console | Persistent msfconsole -- exploit execution, session management, post-exploitation | Exploit, Post | metasploit :8003 |
| | msf_restart | Full Metasploit reset -- kills all sessions, clears module state | Exploit, Post | metasploit :8003 |
| | execute_hydra | THC Hydra brute force -- 50+ protocols (SSH, FTP, RDP, SMB, HTTP, MySQL, etc.) | Exploit, Post | network_recon :8000 |
| Code Execution | kali_shell | Full Kali Linux shell -- nikto, whatweb, testssl, commix, sstimap, tplmap, ysoserial, phpggc, dnsrecon, dnsx, subzy, enum4linux-ng, netexec, kerbrute, bloodhound-python, bhgraph, certipy-ad, bloodyAD, jwt_工具, graphql-cop, graphqlmap, betterleaks, semgrep, hashcat, john, cewl, paramspider, Node.js + npm, Python libs (websockets, zeep, python3-saml, boto3, msal, azure-identity, google-auth, google-cloud-storage), pre-staged post-exploit toolkits at /opt/tools/{linux,windows}/ (linpeas, LinEnum, pspy64, deepce, winPEAS, PowerUp, Pri), and 70+ CLI tools | All | network_recon :8000 |
| | execute_code | Write and run 代码 files (Python, bash, Ruby, Perl, C, C++) -- no shell escaping | Exploit, Post | network_recon :8000 |
| Supply Chain | execute_os | Offline OS -- is a package known-malicious (MAL-) or known- (CVE/GHSA)? Passive, zero 网络 (reads the local OSV DB). Accepts a purl, lockfile, or SBOM | All | network_recon :8000 |
| | execute_guarddog | Beha malware analysis of one package (install hooks, obfuscation, exfil, typosquat). Downloads the tarball, so it dispatches to the hardened analyzer sandbox -- ne inline | Info, Exploit | network_recon :8000 |
| Traffic (TrafficMind) | proxy_brain | DANGEROUS -- web hacking in 代码: it writes Python against a pre-imported redamon SDK to work the captured HTTP corpus (search / get / sitemap / params / grep / diff / to_curl / query reads, decode / jwt().forge() crypto, replay / batch(parallel) / fuzz acti, and browser(id) to drive a real Chromium for DOM-based XSS / SPA / post-JS bugs). Reads run in any phase; acti and the browser are host-pinned to the origin, tenant-scoped by a signed tag, exploitation-gated, budgeted, and re-captured. The agent reads its own on-demand cookbook via redamon.manual(). Replaces the former ten proxy_* tools | All (send: Exploit, Post) | network_recon :8000 |
| Workspace FS | fs_read | Read workspace file with line numbers, auto-detects binary, stores snapshot for fs_diff | All | -- (in-process) |
| | fs_read_many | Batched read of multiple files, capped at max_total_bytes (default 200 KB) | All | -- (in-process) |
| | fs_stat | Metadata only -- size, mtime, mode, type, optional SHA-256 | All | -- (in-process) |
| | fs_write | Atomic create/o/append, auto-creates parents | All | -- (in-process) |
| | fs_edit | Exact-string replacement with uniqueness check, records undo entry | All | -- (in-process) |
| | fs_multi_edit | Multiple ordered edits in one call, all-or-nothing transaction | All | -- (in-process) |
| | fs_undo_edit | Roll back last fs_edit / fs_multi_edit, per-file undo stack capped at 20 | All | -- (in-process) |
| | fs_delete | Delete file or directory (recursive flag required for dirs) | All | -- (in-process) |
| | fs_move | Move or rename a path, auto-creates destination parents | All | -- (in-process) |
| | fs_copy | Copy file or directory tree, permissions normalized so host user can edit | All | -- (in-process) |
| | fs_mkdir | Create directory, idempotent | All | -- (in-process) |
| | fs_chmod | Change permission bits (octal 0o755 or symbolic +x) | All | -- (in-process) |
| | fs_symlink_create | Create symlink, refuses endpoints that would escape the workspace | All | -- (in-process) |
| | fs_grep | Ripgrep o with regex, 30s timeout, 1000-match cap, works on in-flight job logs | All | -- (in-process) |
| | fs_glob | Glob pattern search sorted newest-first, capped 500 results | All | -- (in-process) |
| | fs_find | Metadata search (name + mtime + size + type filters), 30s walk timeout, 5000-result ceiling | All | -- (in-process) |
| | fs_list | Single-directory listing with type / size / mtime, capped 200 entries | All | -- (in-process) |
| | fs_tree | Depth-limited ASCII tree, skips .git, node_modules, __pycache__ | All | -- (in-process) |
| | fs_symbols | Tree-sitter AST outline (function / class / method names + line ranges), 15 languages (py, js, ts, tsx, jsx, java, go, rs, rb, php, c, cpp, cs, kt, swift, scala) | All | -- (in-process) |
| | fs_symlink_read | Resol to its raw target without following it | All | -- (in-process) |
| | fs_hash | SHA-256 or MD5 hash of a file, streams in 64 KB chunks | All | -- (in-process) |
| | fs_diff | Unified diff between two files, or between a file and its last fs_read snapshot (detects concurrent writes in fireteam) | All | -- (in-process) |
| | fs_extract | Safe extraction of tar / zip / gz archives, rejects zip-slip and tar-slip paths | All | -- (in-process) |
| | fs_archive | Bundle workspace paths into tar.gz or zip for one-click operator download | All | -- (in-process) |
| Background Jobs | job_spawn | Detach 工具 call as asyncio background task, output tee'd to jobs/<id>.log in real-time, phase / RoE checks at spawn | All | -- (in-process) |
| | job_status | Non-blocking status query -- current status, log size, last 40 lines of output, sur via <id>.meta.json | All | -- (in-process) |
| | job_wait | Block up to N seconds for the job to finish, returns same shape as job_status | All | -- (in-process) |
| | job_cancel | Cancel a running job, status flips to cancelled, no-op on terminal jobs | All | -- (in-process) |
| | job_list | List background jobs for the project, filter by active=true / false / omit for all | All | -- (in-process) |

All MCP tools run inside a Kali Linux sandbox container. Workspace FS and Background Jobs tools run in-process inside the agent container and operate exclusively on the per-project workspace at /workspace/<projectId>/ -- path rejects every tra trick (project-id injection, symlink escape, zip-slip, tar-slip). See Agent Workspace wiki page for the full reference. Tools marked as dangerous require manual confirmation before execution. Stealth mode restricts acti to passi or single-target operations. Note: WPScan is licensed under the WPScan Public 源码 License (not MIT). Free for pentesting assessments and personal use; commercial use may require a separate license from wpscan.com.

#### MCP 工具 Plugins (extending the agent's 工具 arsenal)

Beyond the 5 built-in MCP servers above, you can plug any Model-Context-Protocol server into the agent as a *工具 plugin* (Shodan, GitHub, Censys, Hugging Face, mitmproxy, your own internal MCPs) without editing 代码, rebuilding containers, or running migrations. Open Global Settings → MCP Tool Plugins.

Two paths: pick one of 39 prefilled Quick-Add presets (OSINT, threat-intel, cloud, web-app scanners, reporting, reverse engineering; categories tagged on every card), or click Add MCP for a manual config. Three transports supported: stdio, sse, streamable_http. The orange Discover and add new tools button runs a live list_tools() against the draft, returns within 30 seconds, and auto-imports each discovered 工具 with its name, description, and a JSON-Schema-derived args_format (types, enums, defaults, min/max, per-property descriptions). Save → tools auto-appear in every project's 工具 Matrix and in the agent's system prompt within ~1 second. No agent restart, no prisma db push.

> Full operator manual (every form field, all 39 presets, the auth flow, the li workflow, rules, troubleshooting, and the storage / security model): MCP Tool Plugins wiki page.

MCP 服务端: Your Own Agent Connecting Into RedAmon

The mirror image of the plugins abo of RedAmon's agent reaching *out* to tools, your agent connects *in* and dri: your Claude 代码 session, an internal triage assistant, a nightly CI job, anything that speaks the Model Context 协议. Mint an access token in Global Settings → MCP Server and it gets 48 tools behind 17 permissions: list projects, read scan status and settings, query the attack-surface graph in plain English or raw Cypher, read findings / suppressed findings / remediations, see why a finding ranks where it does and read its e, submit a quoted e review (RedAmon recomputes the score; the agent never sets one), record a triage , start or stop a Priority Board run (spaced and capped per project), mute and unmute findings behind their own opt-in permission, run sa views, compare saved scan , get an attack-surface o, exploit paths and blast radius, start / stop / queue a recon run, open an engagement, manage recon presets, and (off by default, behind three independent switches) run a command in the Kali sandbox.

The token acts as you, inside your own projects. It is re-checked on every call, so a revoke takes effect on the agent's next call rather than its next reconnect; every graph read is rewritten to match only your tenant's nodes and runs in a read-only Neo4j session; and every write is a positi. Deliberately not exposed: the agent chat, deleting projects, your API keys, re-pointing a project's target, the engagement record, Mute Rules, setting a finding's score directly, changing a a person made in the app, and any graph write beyond , reviews, triage runs and (opt-in) mutes. MCP_SER is off after a normal install and refused o HTTP on a ser, and MCP_DISABLED_TOOLS withdraws a single misbehaving 工具 without taking the whole surface down.

#### Agent Onboarding (teaching *your* agent how to use RedAmon)

Connecting an agent tells it *that* the tools exist. It does not tell it what RedAmon is, what the recon pipeline produces, or which of the 48 tools to reach for first. Agent Onboarding writes those instructions for you. Pick one of 14 Agent Profiles (bug bounty, penetration testing, continuous attack-surface monitoring, management, triage assistance, asset in / CMDB, compliance e, De CI gating, reporting, M&A and third-party risk, threat-intel correlation, SOC enrichment, research and training, or custom) and RedAmon ticks the permissions that job needs and generates a pack tailored to it: a SKILL.md plus reference files co the operating model, the graph's shape, the 工具 sequence for that job, the traps specific to it, and 工具 by 工具 exactly what *this* token can and cannot do. The 工具 facts are read from the 服务端's own live 工具 list at export time, so a pack can ne a 工具 differently from how the ser it. Clients that never load a skill file (Cursor, Windsurf, Cline, Goose, Gemini CLI, Codex CLI) receive a shorter of the same guidance inline the moment they connect.

No profile e kali:exec or recon:o for you, not even the ones that recommend them: a shell on a target-facing box and an irre graph wipe should ne as the side effect of choosing an item from a dropdown.

> Agent Skills teach RedAmon's agent. Agent Onboarding teaches yours.

> Wiki: MCP Server | Wiki: MCP API Reference | Technical: README.MCP.SERVER.md

Agent Workspace: Per-Project Filesystem, Background Jobs, Auto-Offload

> Watch the demo: RedAmon Agent Workspace: AI Runs 4 Parallel Pentests and Writes Its Own Report (YouTube)

Every project gets a persistent /workspace/<projectId>/ directory that the agent, the kali-sandbox, and you (through the FileSystem Drawer in the Red Zone) all see at the same time. Four purpose-built folders are auto-created and protected from rename/delete: notes/ for the agent's scratch work and draft reports, tool-outputs/ for auto-offloaded huge outputs, jobs/ for background-job logs, and uploads/ for files you drop in for the agent to read. The agent is taught the layout on every think step via a WORKSPACE_LAYOUT_BLOCK, and when you drop files into uploads/ the block surfaces them under a CHECK THESE NOW directive so the agent reads them before continuing whatever else it was doing.

The agent gets 24 filesystem tools (fs_read, fs_write, fs_edit, fs_multi_edit, fs_undo_edit, fs_grep, fs_glob, fs_find, fs_diff, fs_symbols, fs_archive, fs_extract, and more) plus 5 background-job tools (job_spawn, job_status, job_wait, job_cancel, job_list). Long scans like nuclei or hydra detach as asyncio tasks and stream output to jobs/<id>.log, so the agent can fs_grep for hits mid-flight without blocking the next reasoning step. Outputs over 20 KB automatically offload to tool-outputs/<utc-iso>-<tool>.txt and the LLM receives a head/tail stub plus the file path, so a 5 MB Playwright DOM dump ne the context window. The drawer surfaces all of this with breadcrumb na, drag-and-drop upload, inline preview, SHA-256 properties, per-folder tar.gz download, and a Jobs tab with li badges and cancel.

Path rejects every tra trick (project-id injection, symlink escape, zip-slip, tar-slip, protected-folder bypass ) and is ser. Jobs sur metadata: orphan running jobs flip to interrupted on boot so the UI ne a fore row.

> Full operator manual (every drawer feature, all 29 workspace tools, the auto-offload policy map, the four protected folders, fireteam coordination patterns via fs_diff , and the path- safety model): Agent Workspace wiki page.

Fireteam: Parallel Specialist Sub-Agents

The agent's most powerful execution mode. When an objecti into independent in angles (auth surface, route map, header policy; or 5 candidate CVEs to triage in parallel), the root agent fans out into N specialist sub-agents that work concurrently inside the same backend, each running its own multi-step ReAct loop with a focused mission. This is RedAmon's implementation of the Scatter-Gather ReAct (SG-ReAct) architectural pattern: a root agent that decides when to fan out, a bounded fireteam of specialists that work in parallel, and a fan-in step that merges their findings back into a single consolidated worldview.

Every safety guarantee that applies to the root agent also applies to every member: hard guardrails, soft guardrails, phase gating, Rules of Engagement, and dangerous-工具 confirmations (handled per-member, in parallel; N members can each be awaiting your approval on their own panel simultaneously without serializing). Recursion is forbidden (a member cannot itself deploy a fireteam) and every wave has a hard cap on members, an iteration budget per member, and a wall-clock timeout. The result is wall-clock parallelism without coordination chaos, predictable termination, and an audit trail where every action is attributable to the specialist that produced it.

> Wiki: Fireteam (Parallel Specialists) | Technical: README.AGENTIC_SYSTEM.md

AI Model Pro

Supports 5 pro and 400+ models: OpenAI (GPT-5.2, GPT-5, GPT-4.1), Anthropic (Claude Opus 4.6, Sonnet 4.5), OpenRouter (300+ models), AWS Bedrock, and any OpenAI-compatible endpoint (Ollama, vLLM, LM Studio, Groq, etc.). Models are dynamically fetched, no hardcoded lists.

OpenAI-compatible provider settings include a reasoning effort control. Enable it to send reasoning_effort with low, medium, high, or max; leave it disabled to send nothing and use the model's default. Enable it only for thinking-capable models: a model without the thinking capability rejects a level, and the agent transparently retries without it. The a effort levels are model-dependent. Canonical OpenAI pro and unrelated OpenAI-compatible endpoints keep their existing behavior.

> Wiki: AI Model Pro

Attack Surface Graph

A Neo4j knowledge graph with 19 node types and 20+ relationship types, the single 源码 of truth for the target's attack surface. The agent queries it before every decision language → Cypher translation.

> Wiki: Attack Surface Graph | Technical: GRAPH.SCHEMA.md

E: Attack Chain E

A persistent, e graph tracking e the AI agent does: 工具 executions, disco, failures, and strategic decisions. Structured chain context replaces flat execution traces, improving agent efficiency by 25%+. Cross-session memory means the agent ne from zero.

> Wiki: E | Technical: README.AGENTIC_SYSTEM.md

Multi-Session Parallel Attack Chains

Launch multiple concurrent agent sessions against the same project. Each session creates its own AttackChain in E. New sessions automatically load findings and failure lessons from all prior sessions, a redundant work.

> Wiki: AI Agent Guide

TrafficMind: HTTP Traffic Capture

RedAmon's built-in, engagement-scoped proxy history: a credential-free man-in-the-middle proxy (powered by mitmproxy) sits between every offensive 工具 and its target, records the full request/response of each HTTP transaction, tags it with *who* produced it (project / user / run / 工具 via a signed HMAC context tag), and stores it in Postgres through a trusted, INSERT-only ingest worker. Think of an always-on HTTP history, except it turns on with a toggle, attributes every request to its 源码, and is queryable by the operator and the AI agent.

Capture is off by default and gated at two levels (a global master switch that runs the proxy, plus a per-project routing toggle). Eight recon tools and eight agent HTTP tools (execute_curl, execute_httpx, execute_playwright, execute_nuclei, execute_katana, execute_ffuf, execute_arjun, execute_wpscan) are routed, so both the pipeline's and the agent's own crawl/fuzz/scan traffic is captured, searchable, and replayable. The proxy holds no secrets, an SSRF egress guard with a DNS-rebinding IP pin keeps it from pi into internal infrastructure, sensiti are redacted, and passi (reflected params, missing security headers, cookie-flag issues) are computed for free on every response. A TrafficMind view in the top na exposes the corpus as a paginated, filterable, proxy-style table with a request/response detail drawer, CSV/JSON export, and reference-counted body cleanup.

The agent works the corpus through a single 代码-native 工具, proxy_brain: it writes Python against a pre-imported redamon SDK and composes the attack itself (loops, conditionals, crypto, oracles) rather than picking from a fixed menu. The SDK's read calls (search, get, sitemap, params, grep, diff, to_curl, query) run in any phase; its acti (replay, batch, fuzz) send li and are gated to the exploitation phases, as is browser(id), which drives a real Chromium to confirm bugs that only surface after Ja runs (DOM-based XSS, SPA-only routes, JS-minted CSRF). proxy_brain runs in the Kali sandbox but holds no 数据库 credential: it reaches the corpus only through the agent's /traffic/exec (read), /traffic/replay (active) and /traffic/browser (browser) endpoints, tenant-scoped by a signed tag the sandbox cannot forge, host-pinned to the origin on every send, budget-capped, stealth-restricted, and re-captured. The agent reads its own on-demand cookbook with redamon.manual(). See docs/readmes/README.TRAFFIC.md for the architecture.

> Wiki: TrafficMind | Technical: README.TRAFFIC.md

Reverse Shells

Unified view of acti: meterpreter, reverse/bind shells, and listeners. Built-in terminal with a Command Whisperer that translates plain English into shell commands.

> Wiki: Reverse Shells

RedAmon Terminal

Full interactive PTY shell access to the Kali sandbox container directly from the graph page via xterm.js. Access all pre-installed pentesting tools (Metasploit, Nmap, Nuclei, Hydra, sqlmap) without leaving the browser. Features dark terminal theme, connection status indicator, auto-reconnect with exponential backoff, fullscreen mode, and browser-side keepalive.

> Wiki: The Graph Dashboard

CypherFix: Automated Remediation

Two-agent pipeline. A Triage Agent scores every finding in the graph with a fixed risk model (how likely it is to be real, times how likely it is to be exploited, times how bad that would be, times how reachable it is), groups the findings that share a fix, and has an LLM check the e behind each one it can judge. The model corrects the factors and ne a score, every quote it gives is against the e it was sent, and it binds no tools. The ranking is complete and correct with no model configured at all. A CodeFix Agent clones the target repo, explores the codebase with 11 tools, implements fixes, and opens a GitHub PR, replicating Claude 代码's agentic design. Because the cloned repo is untrusted, its build/test commands run in an isolated, secret-free sandbox container (not in the agent), and the GitHub token ne it.

> Wiki: CypherFix | Technical: README.CYPHERFIX_AGENTS.md

Agent Skills

An LLM-powered Intent Router classifies user requests into agent skills: CVE (MSF), SQL Injection, XSS, SSRF, RCE, Path Tra / LFI / RFI, Credential Testing, Social Engineering, A Testing, or custom user-defined skills uploaded as Markdown files. Ready-to-use community skills ship for API testing, XSS, SQLi, XXE, BFLA, SSTI, IDOR / BOLA, insecure deserialization, mass assignment, subdomain takeover, and insecure file uploads -- download the .md file and upload it via Global Settings > Agent Skills to activate it for your user. You can also contribute your own by opening a PR.

> Wiki: Agent Skills | Community Skills

Chat Skills

On-demand reference injection via /skill command in the agent chat. Chat Skills are tactical reference docs -- 工具 playbooks, guides, 框架-specific notes -- that you inject into the agent's context exactly when you need them. Type /skill ssrf to load SSRF expertise, or click the skill picker button for a browsable list. 46 reference skills ship with RedAmon co (JWT, OAuth/OIDC, CSRF, race conditions, business logic, prototype pollution, ReDoS, 2FA bypass, LDAP/XPath injection, web cache poisoning, CORS, host header injection, clickjacking, CRLF, and more), tooling (sqlmap, nuclei, ffuf, nmap, httpx, naabu, katana, subfinder, semgrep), protocols (GraphQL, WebSocket, SOAP/WS-Security, SAML), technologies (Firebase, Supabase), frameworks (Next.js, FastAPI, NestJS), Acti (kill chain, Kerberoasting/ASREPRoast, AD-CS ESC1-15, BloodHound path-to-DA), cloud (AWS, Azure, GCP), and post-exploitation (Docker escape, Linux / Windows privesc). Unlike Agent Skills (which dri and phase-aware workflows), Chat Skills are supplementary context that persists until you change or remove them.

> Wiki: Chat Skills | Community Chat Skills

GitHub Secret Hunter

Scans GitHub repositories, gists, and commit history for exposed secrets using 40+ regex patterns and Shannon entropy analysis.

> Wiki: GitHub Secret Hunting

Secret Multiscanner

Hunts li across 14 kinds of target with 1060 detectors: git repositories, GitHub (including deleted commits), GitLab, Docker registries, Hugging Face, S3, GCS, a local filesystem, Jenkins, Elasticsearch, Postman, CircleCI and Travis CI. It goes one step past a regex scanner by calling the owning service's API with the credential it found, so a finding says whether the secret is actually still live, dead, or ne. Each 源码 is configured once per project and runs in its own hardened container (isolated 网络, read-only root, non-root, exactly one credential and no graph access), so different sources scan in parallel. Results are stored as MultiscannerScan → MultiscannerRepository / Image / Model / Bucket / Endpoint → MultiscannerFinding nodes and surface in the Red Zone secrets table, li first. Configure it in project settings, start it per source from the "Other Scans" modal.

> Wiki: Secret Multiscanner

Supply Chain / Malicious Package Detection

Detects known-malicious (MAL-) and known- (CVE/GHSA) packages fully offline against a local OS, across three layers that share one 引擎 and one graph model. L1 audits an uploaded SBOM / lockfile from the "Other Scans" modal; L2 (Supply-Chain Recon) harvests the npm package set a li actually ser recon (源码 maps, imports, technologies) with zero manifest; L3 gives the AI agent on-demand execute_os / execute_guarddog tools. Untrusted bytes (tarballs, target JS) are processed in a hardened, secret-free, 网络-isolated DIRTY sandbox (cap_drop=ALL, read-only, no-install); only a schema- JSON artifact crosses into the creds-holding writer. Results are stored as Package / MalPackageFinding nodes (MAL- = malicious, CVE/GHSA = , GuardDog = suspicious). Populate the offline DB once with ./redamon.sh supply-chain-sync npm.

> Technical: README.SUPPLY_CHAIN.md

Project Settings

500+ configurable parameters across 16 tabs controlling every 工具's behavior, from scan modules to agent appro. Managed through the webapp UI.

> Wiki: Project Settings Reference

Rules of Engagement (RoE)

Upload a RoE document (PDF, TXT, MD, DOCX) to auto-configure project settings and enforce engagement constraints. Enforcement at both the recon pipeline (excluded hosts, rate limits, time windows) and AI agent (prompt injection, se phase cap, 工具 restrictions) layers.

> Wiki: Rules of Engagement

Insights Dashboard

30+ interacti across 4 sections: attack chains & exploits, attack surface, & C, and graph o. All data pulled live from Neo4j and PostgreSQL.

> Wiki: Insights Dashboard

Target Guardrail

LLM-based guardrail pre targeting of unauthorized domains: blocks go sites, major tech companies, financial institutions, and social media platforms. Operates at both project creation and agent initialization. Go, military, educational, and international organization domains (.gov, .mil, .edu, .int) are permanently blocked by a deterministic hard guardrail that cannot be disabled.

> Wiki: Creating a Project

Tool Confirmation

Per-工具 human-in-the-loop gate for dangerous operations. When enabled, the agent pauses before executing high-impact tools (Nmap, Nuclei, Metasploit, Hydra, Kali shell, 代码 execution) and presents an inline Allow / Deny prompt in the chat timeline. Supports both single-工具 and parallel-wave (plan) confirmation modes. Users can appro, or modify 工具 arguments before execution proceeds. Disabled via the Require Tool Confirmation toggle in Project Settings.

> Wiki: Pentest Agent (Tool Confirmation)

Pentest Reports

Professional, 客户端-ready HTML reports with 11 sections. When an AI model is configured, 6 sections receive LLM-generated narratives including executi, risk analysis, and prioritized remediation triage. View example report.

> Wiki: Pentest Reports

Data Export & Import

Full project backup and restore through the web interface: settings, con, graph data, recon/G hunt results as a portable ZIP archive.

> Wiki: Data Export & Import

---

System Architecture

> Full architecture diagrams (data flow, Docker containers, recon pipeline, agent workflow, MCP integration): ARCHITECTURE.md
>
> Technology stack (70+ technologies across frontend, backend, AI, databases, security tools): TECH_STACK.md

---

Components

| Component | Description | Documentation |
|-----------|-------------|---------------|
| Reconnaissance Pipeline | Parallelized fan-out/fan-in OSINT and scanning pipeline | README.RECON.md |
| Recon Orchestrator | Container lifecycle management SDK | README.RECON_ORCHESTRATOR.md |
| Docker Socket Broker | Filtering re for the Docker socket: spawned scan containers reach the daemon through it, so they can only create the known 工具 images (allowlisted, no host mounts / pri / arbitrary images) | n/a |
| Graph Database | Neo4j attack surface mapping with multi-tenant support | README.GRAPH_DB.md · GRAPH.SCHEMA.md |
| MCP Tool Servers | Security tools Context 协议 (Kali sandbox) | README.MCP.md |
| AI Agent Orchestrator | LangGraph-based autonomous agent with ReAct pattern | README.AGENTIC_SYSTEM.md |
| CypherFix Agents | Automated triage + 代码 fix + GitHub PR | README.CYPHERFIX_AGENTS.md |
| Web Application | Next.js dashboard for and AI interaction | README.WEBAPP.md |
| G | Greenbone/Open scanner (170K+ NVTs) | README.GVM.md |
| Secret Multiscanner | Deep secret scanning across 14 源码 kinds (git, GitHub, GitLab, Docker, Hugging Face, S3, GCS, filesystem, Jenkins, Elasticsearch, Postman, CI) with 1060 detectors, li , and one hardened container per 源码 running in parallel | Wiki: Secret Multiscanner |
| Supply-Chain Scanner | Offline malicious/ package detection (OS + GuardDog + retire.js) with a hardened DIRTY/CLEAN split; 3 layers (agent tools, standalone SBOM scan, li recon) | README.SUPPLY_CHAIN.md |
| PostgreSQL Database | Project settings, user accounts, configuration data | README.POSTGRES.md |
| Settings Registry | The one description of every recon parameter: its unit, bounds, engagement cap, stealth profile and who may write it. Every derived list the pipeline used to keep aligned by hand is a query over it | README.SETTINGS_REGISTRY.md · Wiki: Project Settings Registry |
| Test En | Intentionally Docker containers for safe testing | README.GPIGS.md |

---

Documentation

| Resource | Link |
|----------|------|
| Full Wiki (user guide) | github.com/samugit83/redamon/wiki |
| Bug Bounty Co Audit (397 classes, PDF) | Wiki: The Full Taxonomy Audit |
| Ser (single-host) | Wiki: Deploying to a Server · tooling/deploy/single-host/README.md |
| Security Posture (defense-in-depth catalog) | docs/readmes/README.SECURITY_POSTURE.md |
| Supply-Chain / Malicious-Package Detection | docs/readmes/README.SUPPLY_CHAIN.md |
| Threat Model (STRIDE) | docs/readmes/README.TM.SYSTEM_O.md |
| Security Policy | SECURITY.md |
| AI-Assisted De | Wiki: Ship Perfect PRs with AI |
| De Guide | docs/readmes/README.DEV.md |
| Architecture Diagrams | docs/readmes/ARCHITECTURE.md |
| Technology Stack | docs/readmes/TECH_STACK.md |
| Troubleshooting | docs/readmes/TROUBLESHOOTING.md |
| Changelog | CHANGELOG.md |
| Full Disclaimer | DISCLAIMER.md |
| Third-Party Licenses | THIRD-PARTY-LICENSES.md |
| License | LICENSE |

---

Troubleshooting

RedAmon is fully Dockerized and runs on any OS with Docker Compose v2+. For OS-specific fixes (Linux, Windows, macOS), see Troubleshooting Guide or the Wiki.

---

RedAmon HackLab

<table>
<tr>
<td width="280" align="center">
<a href="
<img src="docs/assets/hacklab.png" alt="RedAmon HackLab" width="260"/>
</a>
</td>
<td>
<h3>Want to see RedAmon think like a real pentester?</h3>
Explore real-time li sessions -- every step, every pivot, every exploit -- across 15 categories on a li. Full session logs, decoded walkthroughs, and video recordings showing the agent autonomously compromising a multi-service 服务端 from scratch.
<a href=" the HackLab →</a>
  |  
<a href=" your own session →</a>
 Got an amazing agent session on your own target? Share it with the community -- session log + YouTube video.
</td>
</tr>
</table>

---

Community Showcase

, writeups, and real-world experiences from security professionals using RedAmon in the field. Want to be featured? See the Content Creator track in CONTRIBUTING.md.

| Title | Link |
|-------|------|
| RedAmon v2.2.0, Social Engineering Test: Payload Delivery to Shell Access | Watch |
| AI Agent C: Beyond Standard Tooling | Watch |
| RedAmon 2.0, From 0 to 1000 GitHub Stars in 10 Days: Multi-Agent Parallel Attacks | Watch |
| Build an Autonomous AI Red Team Agent from Scratch: LangGraph + Metasploit + Neo4j Full Tutorial | Watch |

Real-World Case Studies

| Who | What | Link |
|-----|------|------|
| Nipun Dinudaya | Deployed RedAmon on a company website, identified a critical SQL injection that could ha significant data exposure | Read on LinkedIn |
| Bhargav CH S | Used RedAmon during an internship at Ascent e-Digit Solutions: hands-on reconnaissance, DNS analysis, and attack surface mapping | Read on LinkedIn |

Community Guides

| Who | What | Link |
|-----|------|------|
| MrGood | Mastering Redamon: A Comprehensi to Installation on Kali Linux, addressing Kali-specific Docker challenges and security posture | Read on Medium |
| Bogdan Caraman | How to Install RedAmon on Debian 13 (Trixie) with OpenRouter, step-by-step guide with Docker setup, static IP, and systemd automation | Read on Blog |

---

Contributing

Contributions are welcome! Please read CONTRIBUTING.md for guidelines on how to get started, 代码 style con, and the pull request process.

---

Maintainers

Samuele Giampieri: creator, maintainer & AI platform architect · LinkedIn · GitHub · Devergo Labs

Ritesh Gohil: maintainer & lead security researcher · LinkedIn · GitHub

---

Contact

For questions, feedback, or collaboration inquiries:

Sponsorship: RedAmon is free and MIT licensed, and stays that way. If you would like to sponsor the project, write to the same address. Sponsorship helps co and testing costs.

---

Legal

> Local by default; ser has a supported hardened path. Out of the box RedAmon is meant to run on a local machine and does not include internet-facing security controls on its own. To run it on a public, internet-reachable 服务端, use the hardened single-host deploy in tooling/deploy/single-host/, which puts the whole stack behind nginx + TLS, a host firewall, SSH hardening, and a single public HTTPS origin, with every internal service bound to loopback. Running the raw stack (without that deploy) on a public IP would expose unauthenticated internal services, so anything outside a trusted local 网络 without the hardened deploy is entirely at your own risk.

This project is released under the MIT License.

RedAmon integrates several third-party tools under their own licenses (MIT, Apache-2.0, BSD, GPL-2.0/3.0, AGPL-3.0, LGPL, and the WPScan Public 源码 License). 源码代码 for all AGPL-licensed components is a at their upstream repositories. The full in and license obligations are documented in THIRD-PARTY-LICENSES.md.

> Commercial use note: The Kali sandbox image bundles WPScan, which is go by the WPScan Public 源码 License. WPScan restricts commercial use (SaaS, paid product offerings, services) without a separate license from the WPScan team. Pentesting engagements and personal use are permitted. If you intend to use RedAmon in a commercial product or service, review THIRD-PARTY-LICENSES.md before distribution.

See DISCLAIMER.md for full terms of use, acceptable use policy, and legal compliance requirements.

---

Use responsibly. Test ethically. Defend better.

项目信息

开发语言：Python

Star 数：2932

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-源码, self-hosted AI penetration testing 框架: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human appro, and opens PRs that fix what it finds. MCP both ways: plug in any MCP 服务端 as a 工具, or dri from Claude 代码 or your own agent.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	redamon - Open-source, self-hosted AI penetration testing fr
所属分类	黑客技术
发布作者	admin
发布时间	2026-10-05 22:10:19
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	479
讨论数量	0
主题状态	正常讨论中

redamon - Open-source, self-hosted AI penetration testing fr

项目说明

Roadmap & Community Contributions

Maintainers

Quick Start

Prerequisites

1. Clone & Install

2. Create Admin Account

3. Configure

4. Open the Webapp

Management Commands

Updating to a New

Deploy to a Server (Production)

De Mode

Knowledge Base (RAG-Enhanced Web Search)

Table of Contents

O

Built for Enterprise, Secure by Design

Security & Threat Model

Feature Highlights

Reconnaissance Pipeline

AI Gauntlet: Offensive AI/LLM Testing

G Scanner

AI Agent Orchestrator

MCP 服务端: Your Own Agent Connecting *Into* RedAmon

Agent Workspace: Per-Project Filesystem, Background Jobs, Auto-Offload

Fireteam: Parallel Specialist Sub-Agents

AI Model Pro

Attack Surface Graph

E: Attack Chain E

Multi-Session Parallel Attack Chains

TrafficMind: HTTP Traffic Capture

Reverse Shells

RedAmon Terminal

CypherFix: Automated Remediation

Agent Skills

Chat Skills

GitHub Secret Hunter

Secret Multiscanner

Supply Chain / Malicious Package Detection

Project Settings

Rules of Engagement (RoE)

Insights Dashboard

Target Guardrail

Tool Confirmation

Pentest Reports

Data Export & Import

System Architecture

Components

Documentation

Troubleshooting

RedAmon HackLab

Community Showcase

Real-World Case Studies

Community Guides

Contributing

Maintainers

Contact

Legal

项目信息

技术要点

使用与学习建议

免责声明

怎么获取这个资源？

下载链接失效了怎么办？

可以转载或二次发布吗？

下载链接

同分类推荐

MCP 服务端: Your Own Agent Connecting Into RedAmon