T3MP3ST - autonomous red teaming platform; multi-agent offen

项目说明

🌩️ T3MP3ST 🌩️

<!-- ⊰ sharp eye on the raw source. there's a flag for the curious: T3MP3ST{r3c31pt5_n0t_v1b3z} — the one that counts, you earn: run npm run . LO ⊱ -->

<di="center">

A multi-agent offensi framework, built to turn the AI coding agent you already run into a zero-day hunter.

!scores: re-derivable &nbsp; ! 27/27 &nbsp; !PRs welcome &nbsp; !License: AGPL-3.0

</div>

Your AI coding agent is already a hacker — T3MP3ST hands it an arsenal.

Point it at an authorized target and the kill chain runs itself: recon → exploit → report, from a browser War Room or the CLI, driven by the agent you're *already* signed into — Claude Code, Codex, Hermes, OpenCode, Oh My Pi — or a model you run fully offline (Ollama, LM Studio, vLLM). No new API keys, no cloud tenant, no second bill. Your agent is the brain; T3MP3ST is the war machine bolted around it. Self-hosted storm. Keyless warfare. ⚡

And it won't ask you to take its word for it. On XBOW's own 104-challenge suite it scores 90.1% pass@1 — above XBOW's self-reported 85% — alongside hint-free CTF solves and a cold hunt on real, post-cutoff CVEs the model had never seen. Every number in this README recomputes from committed data with one command (npm run ). Loud about the mission, honest about the build — the status table says exactly what's live, what's scaffolding, and what's still roadmap; full receipts in Benchmarks.

Three things set it apart:

1. Reproducible. Every number in this README recomputes from committed data — npm run re-derives all of them, 27/27 green. A claim that can't be reproduced doesn't ship. No trust-me numbers, ever.
2. Keyless. The AI coding agent already on your machine is the backbone. No API keys, no second bill, no gatekeeper.
3. Honest about scope. The status table marks exactly what's stable, experimental, or roadmap — because red-teaming shouldn't be a priesthood, and it damn sure shouldn't run on vibes.

Jump to → Quick start · Usage guide · De guide · Updating · What it hunts · What ships today · Benchmarks · Architecture · Docs

⚠️ Authorized use only

T3MP3ST is an offensive security tool, built for authorized testing, research, and education. Point it only at systems you own or have explicit, written permission to test. Unauthorized access to computers, networks, or data is illegal in most jurisdictions — you alone are responsible for how you use this software and for staying inside the law and your rules of engagement. Bring the storm to *your* targets, not someone else's.

T3MP3ST is provided as-is under the AGPL-3.0 license, with no warranty and no liability for any damage, loss, or misuse. The authors do not endorse, support, or condone unauthorized activity. Get permission. Stay in scope. Don't be a menace. 🫡

Why it exists

Offensi sits behind years of practice and expensi. The bet behind T3MP3ST is that a coordinated agent swarm puts real bug-hunting in reach of people who never got the invite, across web apps, CTFs, smart contracts, source code, and embedded/robotics OSS. That is an ambitious bet, and the sections below are careful to separate what already works from what is still a bet.

What it hunts

| Domain | What it does | Status |
|---|---|---|
| 🕸️ Web apps | Black-box, external-attacker recon → exploit (XBEN suite) | ✅ Stable |
| 🚩 CTF | Hint-free, sandbox-jailed solves (Cybench) | ✅ Stable |
| 🤖 Robotics / OT / embedded | Coordinated-disclosure pipeline for OSS vuln hunting (OS + refuter) | ✅ Pipeline stable |
| 📂 Source code | White-box repo analysis with blind master-builder decomposition | ✅ Multi-language ingest (web-tree-sitter) |
| 💰 Smart contracts | Damn DeFi | ⚠️ reproduction, not no |
| ☁️ Cloud (IaC) | Misconfig-detection benchmark (cloud:bench) + opt-in cloud arsenal (aws/az/gcloud + scoutsuite/cloudfox/pmapper; pacu gated) | 🚧 IaC-misconfig scaffolding — li exploitation not yet benchmarked |
| 📱 Mobile | Built-in static analyzer (manifest misconfig + secret/cleartext detection, mobile:bench) + opt-in arsenal (mobsfscan/objection/drozer; frida gated) | 🚧 static-detection scaffolding — dynamic exploitation not benchmarked |
| 🔩 Binary / RE | Decompiled-output sink detector (unsafe-copy / format-string / cmd-injection / int-o, binary:bench) + opt-in arsenal (ghidra/radare2/objdump/checksec/strings; gdb gated) | 🚧 static sink-detection scaffolding — solving/pwn not benchmarked |

Quick start

Fastest path to a running War Room (keyless, ~2 min to set up; mission time depends on the target):

In the War Room, open Settings and connect a local agent (Claude Code / Codex / Hermes / OpenCode / Oh My Pi). Then describe a target to Op Admiral in plain English and launch. The agent you connected is the brain. No key required.

Prefer to bring a key? Set one and skip the connect step:

Novita AI is an opt-in third-party hosted provider. Requests send the selected
model id, prompts/context, generated output, and request metadata to Novita;
your API key authenticates those requests. Review Novita's current
privacy policy and
terms before using sensiti
data. T3MP3ST does not claim independent assurance for sensiti.

Slow local agents can be given more room with T3MP3ST_LOCAL_AGENT_TIMEOUT_MS
for each CLI call, T3MP3ST_TASK_TIMEOUT_MS for mission tasks, and
T3MP3ST_GENERAL_TIMEOUT_MS for planning requests. are milliseconds.

Claude Code session reuse is disabled by default because a resumed coding-agent
session may retain pro context and ambient tool authority outside the
Arsenal receipt boundary. Operators who explicitly trust their local Claude
Code configuration as a separate execution authority may set
T3MP3ST_TRUST_CLAUDE_SESSION=1; reuse remains isolated to one task and the
choice must not be treated as an Arsenal-enforced sandbox.

Or run it fully offline on your own model — no key, no cloud. Defaults to Ollama; point it at any OpenAI-compatible server (LM Studio, vLLM, llama.cpp):

Tool-calling works on any local model (it's driven over text), so the Arsenal runs even on models without nati.

Check the numbers for yourself:

Step-by-step operator usage lives in Getting Started. Library/SDK usage, the HTTP API, and MCP setup live in docs/.

Docker

Run T3MP3ST API server in a container (localhost only, not exposed externally):

Security Note: Container binds to 127.0.0.1:3333 - accessible only from localhost, not exposed to network.

Test the API:

Execute commands inside the container:

Full deployment guide: docs/DOCKER.md.

Updating from upstream

If you installed from a release tarball or copied the tree instead of tracking git pull, use the built-in updater to sync with github.com/elder-plinius/T3MP3ST without losing local secrets or bench output. It shows a numbered plan, asks y/N before changing anything, then runs npm install.

Works on Windows (PowerShell), macOS, Linux, and WSL. Requires git and npm on your PATH.

Safety modes

The updater is destructive only when explicitly requested:

| Command | What it does | Local changes |
|---|---|---|
| npm run update | Default interactive sync | git merge upstream/main; protected paths backed up and restored |
| npm run update:dry | Read-only preview | No git init, fetch, merge, reset, or npm install; safe on tarball installs |
| npm run update:hard | Opt-in hard reset | git reset --hard upstream/main; protected paths still restored |

All non-dry-run modes ask y/N before changing anything. Pass --force only in trusted automation. On the first-time path (no commits yet), the updater replaces the working tree with the upstream snapshot, but protected paths are backed up first and restored afterward.

Protected paths (inside the repo)

Before replacing files, the updater backs up anything on disk that matches scripts/update-protected.txt, then restores it after sync. Only paths that exist locally are affected — if you ne them, nothing happens.

| Path | Why it's protected |
|---|---|
| .env, .env.* | API keys and local en. !.en is an exception — the template is not protected so upstream can update it. |
| .keys.local | One-off key paste file loaded by bench scripts (e.g. ) without touching .env. |
| .keys.bounty.json | HackerOne / Bugcrowd / similar platform credentials. |
| bench/cybench/corpus-stage/ | Large cloned Cybench corpus (not redistributed; expensive to re-download). |
| bench/cybench/ser/, bench/cybench/challenges/ | Per-run Cybench Docker staging and challenge trees (regenerable, but slow to rebuild). |
| bench/xbow/stage/, bench/xbow/challenges/ | XBOW/XBEN challenge staging (large third-party trees). |
| bench/wild-hunt/ | Cold-hunt findings, PoCs, disclosure drafts, and campaign results — pre-coordination vuln material. |
| bench/decomposition-results/ | White-box decomposition run JSON (may contain unreported analysis). |
| bench/refusal-frontier/ | Refusal-boundary probe artifacts (raw model responses). |
| bench/nyu/ | Staged NYU CTF content from nyu-prep.mjs. |
| docs/disclosures/ | Generated disclosure packages (disclosure-gen output). |
| reports/ | Engagement and hunt reports (persistent output; same tree as Docker mounts in deployment setups). |
| e/ | PoCs, screenshots, and other finding e kept across updates. |

Add your own patterns in scripts/update-protected.local.txt (optional local o; same glob syntax as the main manifest).

Ne (outside the repo)

These li the project tree — an update ne or writes them:

What ships today

The framework is an 8-operator kill chain, and this table won't blow smoke about it. Recon is a li engine — and the teeth are already real: 90.1% pass@1 on XBEN, 8/10 held-out post-cutoff C to exact file/line/CWE, and a coordinated-disclosure pipeline that's li to ha held for coordination right now. What's *not* proven is the swarm. Each downstream operator — Exploiter, Infiltrator, Exfiltrator, Ghost — runs the same real, tool-backed ReAct loop as recon (real exploit tools, not stubs), but the headline numbers came from a single agent, not the coordinated 8-operator cell, and end-to-end swarm exploitation is unbenchmarked and still unreliable. The engine is real; the swarm is the part still earning its stripes. Loud where we' it, blunt about the rest.

| Component | Status | Notes |
|---|---|---|
| Re-derivable measurement () | ✅ Stable | every headline recomputes from committed artifacts |
| Recon engine | ✅ Stable | drives nmap / DNS / HTTP / fingerprinting; every finding traces to real tool output |
| Mission engine + War Room + Op Admiral | ✅ Stable | keyless through a connected local agent |
| Arsenal, MCP server, HTTP API | ✅ Stable | 36 built-in tools by default; 111 with the opt-in T3MP3ST_FULL_ARSENAL (+75 adapters, with dangerous/catalog-only drivers — metasploit, hydra, pacu, frida — behind narrow appro rather than generic execution) — both counts re-derive via . security_recon over MCP |
| Egress-scope containment | ✅ Stable (on by default) | once a mission target is set, built-in networked tools refuse off-scope public hosts — not the target/subdomains, not loopback/private (SCOPE DENIED) — a tightened default, not a bare tool runner |
| Coordinated-disclosure pipeline | ✅ Stable | OS + live PoC + refuter panel + CVSS; drafts only, a human sends |
| White-box source analysis | ⚠️ Experimental | Multi-language ingest (Python/JS/TS/Go/Java/C/C++); Python retains its regex parser, while other languages fail open to no extracted blocks; multi-model decomposition costs more tokens, not fewer |
| DeFi (Damn DeFi) | ⚠️ Experimental | reproduces known exploit classes; not no |
| Exploiter / Infiltrator / Exfiltrator / Ghost | ⚠️ Experimental | run the real tool-backed ReAct loop (same engine as recon); unproven as a coordinated swarm — single-agent is the benchmarked path, li exploitation still unreliable |
| Ad modules (cloud, persistence, swarm, cognition) | 🚧 Planned | interface-only in src/stubs/ |
| Self-impro loop | 🧪 Research | records lessons + proposals today; feeding them back into planning is roadmap |

Full feature-by-feature breakdown: FEATURES.md.

Co by domain

Where the storm reaches today — and where it's headed. Same discipline as e else: a domain is ✅ only when there's a receipt behind it.

| Domain | What it covers | Status |
|---|---|---|
| 🕸️ Web | apps, APIs, auth flows, OWASP Top 10 | ✅ Core — XBEN 90.1% pass@1 |
| 📂 Code | white-box source audits, SAST-style vuln hunting | ✅ Proven (hunt result) — held-out C: single-agent 8/10 exact file/line/CWE, 10/10 found (7 languages); the repo-ingest *engine* itself is still ⚠️ experimental |
| 🚩 CTF | wargames, practice ranges, challenges | ✅ Proven — Cybench 23/40 hint-free |
| 🔌 Network / Infra | recon, service/stack fingerprinting; lateral + privesc | ✅ recon (live nmap/DNS/HTTP engine) · ⚠️ lateral/privesc experimental |
| 🤖 Embedded / IoT / OT | firmware, robotics, ICS/SCADA OSS | ✅ C live — coordinated-disclosure drafts held for |
| 📦 Supply chain | dependency audits, install-without-confirmation | ⚠️ Real — dedicated class; hit a CWE-829 on the held-out set |
| 💰 Blockchain | smart contracts, DeFi, Solidity | ⚠️ Reproduction only — Damn DeFi, not no |
| ☁️ Cloud | AWS/GCP/Azure misconfig, IAM, ser | 🚧 In de |
| 📱 Mobile | Android/iOS app security | 🚧 In de |
| 🏢 Identity / AD | Kerberos, pass-the-hash, AD attacks | 🚧 In de |
| 🔐 Binary / RE | o, ROP, exploit dev | 🚧 In de — needs specialized tooling |

The class/squad architecture means new domains *compose* rather than fork — each is a loadout (specialist classes + arsenal + target adapter + a benchmark). 🚧 domains ship dark until they have a number.

Benchmarks

Headline results. Each recomputes from the committed JSON with npm run ; full methodology and caveats are in the linked docs.

| Suite | Result | Context |
|---|---|---|
| XBEN — XBOW's 104-challenge suite, black-box | pass@1 mean 90.1% (Wilson-95 86.2–92.9), floor 91/104 · gpt-5.5 | XBOW self-reports 85% on the same suite; ours re-derives the graded from committed artifacts (raw transcripts stripped for privacy) |
| XBEN — white-box (reported separately) | pass@1 98.7%, best-ball 104/104 · gpt-5.5 | ne with the black-box number |
| Cybench — 40-task academic bench, Opus 4.8, no hints | 23/40 (58%) hint-free, single-run pass@1 (-enforced) | not the raw-score record (Anthropic: 76.5% pass@10); every flag graded against the committed oracle |
| Cybench model matrix — identical 15-task committed subset, pass@1 | Opus 4.7 vs 4.8, with per-task source receipts and separate failure/abstention/infrastructure outcomes | rebuild and inspect the model/harness matrix; historical system comparison, not an isolated model ranking |
| C — 10 real post-cutoff (2026) CVEs, held-out, 7 languages | single-agent 8/10 exact file/line/CWE ( all-exact, stable) · 10/10 found (full pack) | memorization- & fitting-proof: post-cutoff, and the hardened prompts were ne on these; recomputes it. n=10, directional; the swarm's edge here is recall, not a coordination-beats-solo proof |

How to read these:

The number isn't the flex — the receipt is. A keyless, open-source harness that hands you the re-run instead of asking you to trust it: clone it, run npm run , and every abo from its committed oracle in front of you.

Deeper reading: WALL_FORENSICS (per-challenge misses), CYBENCH, INTEGRITY_LEDGER (contamination audit and every retraction), OBSIDIVM (our own live web range).

Documentation

| Doc | Contents |
|---|---|
| Docs index | operator, de, benchmark, and release documentation map |
| Getting Started | install, first launch, first safe mission, CLI basics, updates, and troubleshooting |
| De Guide | source map, scripts, SDK usage, extension points, and release checks |
| API Reference | local HTTP API route groups and integration notes |
| MCP Guide | MCP ser and security_recon usage |
| FEATURES.md | feature-by-feature status ([x] shipped / [~] partial / [ ] planned) |
| SCOPE_AND_AUTHORIZATION | authority model, scope receipts, e and retest rules |
| AUTHENTICATED_WORKFLOWS | current authenticated-request support, capability diagnostics, and the design boundary for interacti |
| | how findings become tool-pro of model-asserted |
| CONTRIBUTION_RECEIPTS | PR receipt template for scope, run mode, model/harness labels, redaction, and |
| MODEL_MATRIX | Reproducible cross-model benchmark matrix and arbitrary model selection |
| TEAM_PREVIEW | first-run path and review script |
| INSTALL_MATRIX | macOS / Linux readiness table |
| ARSENAL_ACTI | optional external-tool setup |
| PULL_REQUEST_DELIVERY | contributor and maintainer checklist for scoped, re PRs |
| CYBENCH · WALL_FORENSICS · INTEGRITY_LEDGER · COGNITI | benchmark methodology |
| RELEASE_CHECKLIST | the gates a release must pass |

Architecture

Operators map to MITRE ATT&CK and Cyber Kill Chain phases (recon is li phases are scaffolded):

| Operator | Phase | MITRE | Function |
|---|---|---|---|
| Recon | Reconnaissance | TA0043 | OSINT, network discovery, asset enumeration |
| Scanner | Discovery | TA0007 | scanning, service fingerprinting |
| Exploiter | Initial Access | TA0001 | exploitation, payload delivery |
| Infiltrator | Lateral Mo | TA0008 | post-exploitation, pri escalation |
| Exfiltrator | Collection / Exfil | TA0009/10 | data extraction, credential har |
| Ghost | Persistence | TA0003 | persistence, stealth, cleanup |
| Coordinator | Command & Control | TA0011 | mission control, orchestration |
| Analyst | Analysis | — | pattern analysis, reporting |

Pro: OpenRouter, , Anthropic, OpenAI, or a keyless local agent (Claude Code / Codex / Hermes / OpenCode / Oh My Pi). Set OPENROUTER_API_KEY / / ANTHROPIC_API_KEY, or connect an agent in Settings.

Integrations: node dist/mcp-server.js exposes security_recon to MCP-aware agents. npm run server starts the HTTP API (POST /api/mission/start, GET /api/mission/status, and more). Full reference in docs/.

Contributing — join the swarm

Red-teaming shouldn't be a priesthood. Bring an adapter, a prompt pack, a runbook, a new arsenal tool, or a bug report.

One rule, non-negotiable: e here is for authorized testing only. Owned, scoped, or consenting targets. Build for defenders, or don't build it here.

1. Fork it, branch it.
2. Open a PR with tests. If you touch a headline number, npm run has to stay green.

Release process and gates: RELEASE_CHECKLIST.

License

AGPL-3.0. See LICENSE.

---

<di="center">

*Fortes fortuna iuvat* — fortune favors the bold.

⊰•-•✧ LO ✧•-•⊱ 🌩️

</div>

项目信息

开发语言：TypeScript

Star 数：6387

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕autonomous red teaming platform; multi-agent offensive-security meta-harness展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。