An AI red team that finds bugs and submits the patch

What it does

RedAmon is a Dockerized autonomous security framework that runs a complete offensive pipeline: reconnaissance, exploitation, and post-exploitation. It then switches to remediation mode, where an AI triage agent ranks findings and a CodeFix agent clones the target repository, implements patches, and opens GitHub pull requests. The entire cycle is orchestrated through a web UI with a Neo4j knowledge graph at its center.

The interesting bit

Instead of a single linear scanner, RedAmon deploys parallel Fireteam agents—one might run Hydra against credentials while another chains a CVE exploit and a third maps XSS—feeding a shared Neo4j graph in real time. That graph becomes the single source of truth for downstream exploitation and for the CypherFix remediation agent, which actually navigates codebases with 11 code-aware tools to generate patches.

Key highlights

• Parallel multi-agent Fireteam coordinates recon, exploitation, and post-exploitation tasks simultaneously.
• Recon outputs feed a live Neo4j knowledge graph that deduplicates findings and maps attack-surface relationships.
• CypherFix triages and ranks vulnerabilities, then a CodeFix agent generates patches and opens GitHub pull requests.
• Supports 400+ AI models, including local inference via Ollama, vLLM, and LM Studio.
• Bundles 70+ security tools—Metasploit, Nmap, Nuclei, SQLMap, Hydra, OpenVAS—inside a Docker Compose stack with configurable Rules of Engagement guardrails.

Caveats

• The full stack is resource-heavy: OpenVAS mode requires 8 GB RAM (16 GB recommended) and ~50 GB disk, with a ~30-minute first-launch feed sync.
• Despite the repository’s ‘zero human intervention’ tagline, the README explicitly states there is ‘human oversight at every critical step,’ so full autonomy is tempered by design.

Verdict

Security teams and red-team operators who want to compress the recon-to-remediation cycle into a single pipeline should look here—provided they have the hardware and explicit authorization. If you need a lightweight, occasional vulnerability scanner, this is overkill.