An AI pentest framework where red and blue agents debate bugs

What it does

Guardian is a Python CLI framework that wires up roughly 50 existing security tools—nmap, nuclei, sqlmap, and others—into automated penetration-testing workflows. It uses large language models from OpenAI, Anthropic, Google, or local Ollama instances to plan scans, select tools, analyze output, and generate reports with full execution traceability. The system runs steps as an async DAG, supports resuming interrupted sessions, and can export results to SARIF, DefectDojo, or Slack.

The interesting bit

The standout is its multi-agent debate triage: a Red Advocate, Blue Advocate, and Judge argue over ambiguous findings, which the README claims improves F1 by at least five percentage points over a single-agent baseline. It also swaps in a smaller “judge” model after a big model does the heavy thinking, aiming for roughly tenfold cost reduction, and grounds CVE references with a local SQLite RAG over MITRE ATT&CK feeds to curb hallucinations.

Key highlights

• Supports six AI provider backends, including local Ollama and OpenRouter, with a plugin entry-point contract so third parties can add providers without forking.
• Integrates 50 security tools across network, web, cloud, mobile, AD, and LLM red-team categories, lazily loading them so --help stays under 500 ms.
• Ships 13-plus workflow templates with parallel DAG execution, conditional steps, sandboxed Jinja2 parameter templating, and --resume for interrupted runs.
• Defensive guardrails include DNS-resolved scope validation, prompt-injection wrappers around untrusted tool output, API-key redaction, and a confirmation gate for destructive actions.
• Recomputes CVSS v3.1 scores to catch drift, captures visual evidence via headless screenshots, and includes token usage and cost ledgers in AI decision traces.

Caveats

• The framework requires an external AI provider API key (or a local Ollama setup) and a separate installation of the underlying security tools; without them, scanning capabilities are limited.
• The README is truncated and some reporting details are cut off, so it is unclear whether all export formats are fully documented.
• Several feature labels (e.g., B8, B10, B11, B13, B14, A3) look like internal milestone tags that may confuse casual readers.

Verdict

Security engineers who want to automate repetitive reconnaissance and vulnerability triage across heterogeneous toolchains will find this a credible starting point. Teams looking for a fully self-contained scanner with no external AI dependencies or tool installation should look elsewhere.