cdxiaodong/cain-agent

What it solves

Cain is designed for real-world authorized security assessments, moving beyond simple CTF (Capture The Flag) style tools. It addresses the challenge of automating penetration testing for enterprise assets, focusing on business-logic flaws, authentication chains, and complex cloud misconfigurations across multiple providers, including AWS, Azure, GCP, and several Chinese cloud platforms (Aliyun, Tencent, Huawei).

How it works

Cain uses a deterministic attack pipeline (reconnaissance $\rightarrow$ testing $\rightarrow$ reporting) orchestrated by a state machine to ensure consistency and auditability. It is built on the Claude Agent SDK and employs a "Finder $\neq$ Validator" architecture where discovery and validation occur in separate agent sessions to prevent self-confirmation of findings.

Safety is enforced through structural constraints rather than AI behavior: a PreToolUse hook blocks any action outside the defined scope.yaml, and a read-only toolchain prevents dangerous write or exploit operations. The system also uses a redaction hook to strip secrets before persistence.

Who it’s for

It is intended for security professionals conducting authorized penetration tests, bug bounty hunters, and organizations performing security audits on their cloud and on-premise infrastructure.

Highlights

• Broad Cloud Coverage: Supports AWS, Azure, GCP, Aliyun, Tencent, and Huawei cloud environments.
• Structural Safety: Hard scope enforcement and a read-only toolchain ensure the agent cannot perform unauthorized or destructive actions.
• Multi-Backend Routing: Allows different LLM backends (e.g., Claude or a custom "pi" bridge) and models to be used for different stages of the pipeline to optimize for cost and capability.
• IAM Privilege Escalation Analysis: Models cloud permissions as a directed graph to find escalation paths via Breadth-First Search (BFS).
• Detailed Artifacts: Generates human-readable Markdown reports and machine-readable JSON summaries including evidence chains and remediation advice.