LumosLab-Innovation/OpenHunterAI

What it solves

OpenHunterAI provides a local workspace for AI-driven security red teaming. It allows users to assess the security of web applications, APIs, and LLM applications from an attacker's perspective without requiring access to the source code, ensuring that assessments are constrained to verified, authorized targets.

How it works

The system uses a structured assessment model that moves from locking the scope and mapping the attack surface to establishing a baseline and testing bounded hypotheses. It integrates multiple signal sources—including browser inspection, recon tools, ZAP, and a Nuclei adapter—and utilizes AI-assisted investigation via adapters. The architecture consists of a React-based UI, a Public API for planning, a NATS orchestrator with Go workers for execution, and a Postgres database for findings and reporting.

Who it’s for

It is designed for security researchers and developers who own or are authorized to test public applications and want to automate the discovery of security vulnerabilities using AI-assisted reasoning.

Highlights

• Local Workspace: Runs entirely on the user's machine with no signup required, keeping project and scan records private.
• Explicit Scope Control: Includes domain verification and human approval gates to prevent unauthorized scanning.
• Multi-Tool Integration: Combines signals from various security tools like ZAP and Nuclei into a single workflow.
• Coding Agent Skill: Can be integrated as a skill for AI coding agents such as Claude Code, Gemini CLI, and Codex to prepare scoped security assessments.