cskwork/scopeweaver

ScopeWeaver – AI‑driven multi‑agent penetration‑testing platform

What it is

• An open‑source system that lets large language models (LLMs) act as autonomous security‑testing agents. It combines a Go backend, a Next.js frontend, and a PostgreSQL store.
• Built as a fork of the ARTEX project (upstream commit 160fe13), re‑branded and translated into English, Korean and Simplified Chinese.

Key capabilities

• LLM‑powered agents: a planner generates attack steps, workers execute them (e.g., run nmap, curl, custom scripts) while a “main‑agent” lets a human intervene.
• Two‑graph data model: an asset graph (targets, domains, IPs) and an exploration graph (discovered nodes, activity) that agents can query via LLM‑exposed tools.
• Approval workflow: potentially dangerous actions (e.g., running a exploit) are gated by an “interception approval” UI component, re‑using the AegisHook design.
• Asset sync: can import scopes directly from the companion ScopeSentry service.
• LLM provider flexibility: supports Anthropic, OpenAI, and Z‑AI’s GLM‑5.3 via configurable API keys.
• Built‑in coding‑agent integration: Claude Code, Codex or Pi can create tasks, read progress, and control agents through the provided adapter.
• Live event streaming: tasks emit progress via Server‑Sent Events (SSE) or Streamable HTTP, enabling real‑time dashboards.

Installation options

Method	What it does
One‑click script (./install.sh)	Detects Docker, lets you run everything in Docker or build a local binary, creates .env and starts the service on http://localhost:8787.
Docker Compose (manual)	Builds the image locally, starts a PostgreSQL container, mounts ./skills and ./data.
Pre‑built binary (Releases)	Download a zip for your OS, run ./start.sh (a supervisor that handles updates).
Build from source	Compile the Go backend and embed the Next.js static files yourself.
Cross‑platform release builder (./build.sh --release)	Produces self‑contained zip archives for Linux, macOS and Windows.

Running the system

1. Ensure a PostgreSQL instance is reachable (default DB name artex).
2. Provide an LLM API key (ANTHROPIC_API_KEY or OPENAI_API_KEY) – either as an environment variable or via the UI.
3. Open the web UI at http://localhost:8787; the first visit walks you through admin‑password setup.
4. Use the LLM → New form to create a penetration‑testing task, select a model, and let the agents explore the imported asset scope.
5. Approve any flagged actions through the Approval records view; results appear in the Findings page.

Updating

• In‑app one‑click update checks GitHub releases, verifies the SHA‑256 checksum, smoke‑tests the binary and swaps it atomically. Roll‑back is automatic on repeated failures.
• CLI scripts (./update.sh or Docker‑compose rebuild) provide manual alternatives.

Configuration highlights

• Database connection via config.json or ARTEX_PG_DSN env var.
• LLM provider settings (ARTEX_LLM_PROVIDER, ARTEX_LLM_MODEL, etc.) can be overridden per‑task.
• Concurrency (number of worker agents per task) is adjustable in System settings (default 3).
• Traffic‑capture proxy runs on port 8788; can be accessed by agents for MITM inspection.

Development

• ./dev.sh launches backend, proxy and Next.js dev server with hot‑reload.
• Tests run with go test ./....
• The codebase follows the norma SDK conventions for agents, tools, and memory.

License & disclaimer

• Distributed under AGPL‑3.0 (same as upstream ARTEX). The README stresses that the tool is for authorized security testing only; misuse is prohibited.

Who might use it

• Security teams that want to augment manual pentests with LLM‑driven automation.
• Researchers exploring autonomous attack‑chain generation.
• Developers looking for a reference implementation of LLM multi‑agent orchestration in Go.

---

All information above is taken directly from the repository’s README; no external assumptions have been added.