redamon
ActiveDescription
An AI-powered agentic red team framework that automates offensive security operations, from reconnaissance to exploitation to post-exploitation, with zero human intervention.
Key Features
- Autonomous offensive pipeline chaining recon, exploitation, and post-exploitation into a single workflow with human oversight at each critical step
- Fireteam parallel multi-agent architecture — multiple AI agents test different attack vectors concurrently using Hydra, CVE exploits, and XSS scanning
- Neo4j knowledge graph that merges all tool outputs into a deduplicated, queryable attack surface with explicit relationships
- CypherFix AI triage agent correlates findings, ranks by exploitability, then CodeFix agent clones repos, implements fixes, and opens GitHub PRs
- 100+ integrated security tools including Metasploit, Nmap, Nuclei, SQLMap, Hydra, and OpenVAS with 185,000+ detection rules
- Configurable autonomy with RoE guardrails — supports local models via Ollama, vLLM, and LM Studio with 400+ AI model options
Use Cases
💡 Automated penetration testing for authorized security teams running full-scope assessments against target infrastructure
💡 CI/CD security gate that continuously scans repositories and auto-remediates vulnerabilities via pull requests
💡 Security research and CVE validation — autonomously verify exploitability of newly disclosed vulnerabilities
💡 Educational red team lab for learning offensive security techniques with full attack chain visibility
💡 Compliance auditing — map entire attack surfaces and generate AI-driven pentest reports with remediation code
Strengths & Limitations
✅ Strengths
- • Actively maintained, recent updates
- • High community interest (2.3k stars)
- • Permissive open-source license (MIT)
- • Responsive to issues, low backlog
Tags
Categories
Quick Start
Clone the repo, install via Docker Compose, configure your target scope and AI provider API key in the project settings (500+ configurable options), then run the pipeline. RedAmon performs 6-phase recon, hands off to exploitation agents, triages findings via CypherFix, and opens a GitHub PR with code fixes — all with configurable autonomy levels.