openhackai/OpenHack

Open Source Agentic Security Scanner

What it solves

OpenHack addresses the challenge of identifying security vulnerabilities in codebases by automating the discovery, validation, and verification process. It provides an open-source alternative to proprietary security tools, using open-source models to find high-quality, verified vulnerabilities.

How it works

The tool operates through a multi-agent pipeline consisting of four distinct stages:

  1. Recon: Performs a deep dive into the application to build a full project model and understand context.
  2. Hunting: Uses specialized agents to find vulnerabilities based on specific categories or risky code features.
  3. Validation: A dedicated agent reviews findings to confirm their validity and potential impact.
  4. Verification: Uses a sandbox (via Docker) or a headless browser to attempt real-world exploits, such as HTTP requests or client-side attacks, to confirm the vulnerability.

Who it’s for

It is designed for developers and security professionals who want an automated, agentic way to scan their codebases for vulnerabilities and verify them in a live environment.

Highlights

  • Multi-agent pipeline for automated reconnaissance, hunting, and validation
  • Sandbox verification that uses Docker to attempt real exploits against a running instance of the app
  • Browser verification to detect client-side issues like XSS and CSRF using a headless browser
  • Interactive TUI for real-time monitoring of agent activity and findings
  • Headless mode for integration into CI/CD pipelines and automated scripts