An autonomous red team that outsources the actual hacking

What it does The platform is an autonomous penetration-testing orchestrator that dispatches specialized AI agents against web apps, Active Directory, Kubernetes, and cloud targets. It discovers services, fingerprints technology stacks, and executes real offensive security tools inside an isolated Docker layer, producing structured, evidence-based audit reports.

The interesting bit The architecture keeps the AI brain away from the shell. An LLM plans the attack path, but every tool invocation passes through an MCP gatekeeper that lives between the reasoning engine and the Docker toolbox. It is essentially a red-team exercise with a built-in safety chaperone.

Key highlights

• Ships with a Docker image containing over 50 compiled security tools, including Nuclei, BloodHound, sqlmap, and NetExec.
• Dynamically dispatches technology-specific agents—CMS, Active Directory, Kubernetes, GraphQL—based on live fingerprinting.
• Interprets natural-language scope flags for bug bounty or focused assessments.
• Runs against cloud or local LLM providers; the README explicitly warns that GPU setup can require troubleshooting.
• Licensed under GPLv3.

Caveats

• Runs inside Docker and requires an LLM API key to function; the README flags GPU configuration as a common stumbling block.
• Much of the deep technical detail—full agent lifecycles, complete tool list, network diagrams—is offloaded to a separate docs/full.md file rather than shown in the README.

Verdict Security teams and DevSecOps engineers who want to automate repetitive offensive testing without giving an LLM direct shell access should try it. If you prefer manual testing and spreadsheets, it will not change your mind.