cdxiaodong/cain-agent

What it solves

Cain is an AI-powered penetration testing engineer designed for real-world authorized security assessments rather than static lab environments. It addresses the challenge of automating security audits for enterprise assets and cloud environments while ensuring the process remains safe, scoped, and auditable, specifically targeting business-logic flaws, authentication chains, and cloud misconfigurations.

How it works

Built on the Claude Agent SDK, Cain uses a deterministic state machine to orchestrate a pipeline of reconnaissance, testing, and reporting. To ensure safety, it employs structural constraints rather than relying on the AI's behavior: a PreToolUse hook enforces targets defined in a scope.yaml file, and a read-only toolchain of 46 security tools blocks dangerous operations. It also separates the discovery and validation of vulnerabilities into distinct agent sessions to prevent self-confirmation. For cloud security, it includes a specialized module that analyzes IAM/RAM privilege-escalation paths across multiple providers (including AWS, Azure, GCP, and Chinese clouds like Aliyun, Tencent, and Huawei).

Who it’s for

Security professionals and penetration testers performing authorized engagements on enterprise assets and cloud infrastructure who need an automated, scoped, and auditable way to identify vulnerabilities.

Highlights

• Multi-Cloud Support: Extensive coverage of global and Chinese cloud providers (AWS, Azure, GCP, Aliyun, Tencent, Huawei).
• Structural Safety: Hard-coded scope enforcement and a read-only toolchain to prevent unauthorized or destructive actions.
• Deterministic Pipeline: A crash-resumable state machine that moves from recon to testing to reporting.
• Privilege Escalation Analysis: Models IAM/RAM permissions as a directed graph to find escalation paths via BFS.
• Built-in Benchmarking: Includes a vulnerable-terraform range and an executor to measure detection rates, false positives, and costs.