Netw0rkNoob/VulnClaw

基于 AI Agent + MCP 工具链 + 渗透 Skill 编排， 配合大语言模型， 自然语言输入 → 自动完成「信息收集 → 漏洞发现 → 漏洞利用 → 报告生成」全流程。

What it solves

VulnClaw is an AI-driven penetration testing CLI tool designed to automate the entire security assessment workflow. It eliminates the need for manual tool chaining by allowing users to describe their testing goals in natural language, which the AI then translates into a sequence of technical actions to find and exploit vulnerabilities.

How it works

The project uses a model-led "solve engine" where an LLM acts as the primary decision-maker. Instead of following a rigid script, the AI autonomously decides which tools to call and when to stop based on the real-time evidence it gathers.

Key technical components include:

  • AgentState Evidence Memory: All tool outputs are stored as raw evidence. The AI uses high-signal previews to maintain context and can query the full raw data as needed to prevent hallucinations.
  • MCP Toolchain: It integrates the Model Context Protocol (MCP) to connect with external services like Chrome DevTools for browser automation and Burp Suite for HTTP traffic manipulation.
  • Anti-Hallucination Gate: Conclusions or "flags" are only accepted if they appear character-for-character in the actual tool output.
  • Skill Reference System: A library of 50+ specialized security skills (CTF, Web, Internal Network) that the AI can load on-demand rather than having them forced into the system prompt.

Who it’s for

It is intended for authorized penetration testers, CTF competitors, security educators, and red team operators who want to accelerate the reconnaissance and exploitation phases of a security audit.

Highlights

  • Autonomous Workflow: Automatically handles information gathering, vulnerability discovery, exploitation, and report generation.
  • ທີ່ Broad LLM Support: Compatible with 14 providers including OpenAI, Anthropic, DeepSeek, and local Ollama instances.
  • Integrated Toolset: Includes built-in capabilities for Python execution, shell commands, batch HTTP probing, and 29 types of encoding/decryption.
  • Evidence-Based Reporting: Generates structured Markdown reports and runnable Python PoC scripts based on actual session evidence.
  • Flexible Interfaces: Offers a CLI, a TUI (Terminal User Interface), and a full Web UI.

Related

  • Project
    SecNN/AiScan-N

    An AI-powered CLI agent for automated cybersecurity assessments, vulnerability scanning, and penetration testing that integrates with various LLMs.

  • Project
    OpenLAIR/dr-claw

    Dr. Claw is an open‑source, model‑agnostic AI research assistant that provides a unified UI/CLI for the whole research workflow—literature survey, idea generation, experiment code, analysis, paper drafting, and slide creation—driven by Claude Code, Gemini, Codex or any OpenRouter model.

  • Project
    NVlabs/SpatialClaw

    SpatialClaw is a training‑free, code‑as‑action framework for spatial‑reasoning agents. A VLM writes Python cells that run in a persistent Jupyter kernel pre‑loaded with perception tools (SAM‑3, Depth‑Anything‑3) and scientific libraries. The system loops through planning, code generation, safety‑checked execution, and observation until the agent returns an answer. Evaluated on 20 benchmarks, it reaches 59.9 % average accuracy, beating prior agents by 11.2 points, using the same prompt and tools across six VLM back‑ends. The repo provides full runtime, benchmark loaders, installation scripts, and SLURM support.

  • Project
    Vasco0x4/AIDA

    AIDA is an open‑source autonomous pentesting agent that lets any LLM (Claude, Gemini, OpenAI Codex, etc.) drive a Docker‑based security testing environment. The model plans the assessment, calls built‑in tools (nmap, sqlmap, custom Python, raw HTTP), logs every step in a persistent notebook, auto‑scores findings with CVSS 4.0, and can export PDF reports. It ships with a lightweight `aida-pentest` container (or can attach Exegol for more tools) and includes a web dashboard, authentication, and notification integrations. The README cites real CVEs discovered by the system. Licensed under AGPL‑v3.