pikpikcu/airecon

What it solves

AIRecon is an autonomous penetration testing agent designed to automate the complex process of security auditing. It replaces manual tool chaining by using an LLM to drive a security-focused environment, managing the workflow from initial reconnaissance to final reporting while ensuring that testing remains within defined scopes.

How it works

The agent operates through a structured pipeline (RECON $\rightarrow$ ANALYSIS $\rightarrow$ EXPLOIT $\rightarrow$ REPORT) and interacts with any OpenAI-compatible LLM gateway. It executes security tools within a Kali Linux Docker sandbox and integrates natively with the Caido proxy.

Key technical components include:

• Memory & Learning: Uses a local SQLite database to store session findings and tool performance, allowing the agent to avoid repeating failed paths and compound proven knowledge.
• Knowledge Base: An optional local dataset of ~1.09M security records (CVEs, CTF writeups, payloads) that the LLM can query autonomously via a dataset_search tool.
• Reasoning Detection: Automatically detects if a model supports reasoning capabilities at runtime to optimize the agent's thinking process.
• MCP Integration: Supports the Model Context Protocol (MCP) to dynamically extend its toolset via external servers.

Who it’s for

It is built for security researchers, penetration testers, and bug bounty hunters who want to automate reconnaissance and exploitation workflows while maintaining the privacy of their target intelligence through local LLM deployments.

Highlights

• Backend Agnostic: Works with hosted models (GPT, Claude, Gemini) or fully offline local models via vLLM or Ollama.
• Kali Sandbox: Executes all commands in a secure, isolated Docker environment.
• Native Caido Integration: Built-in support for proxy tools like replay, fuzzing, and sitemap management.
• Verified-only Learning: Only high-confidence findings are persisted to the long-term brain to prevent noise.
• Extensive Tooling: Includes browser automation, custom fuzzers, Schemathesis API fuzzing, and Semgrep SAST.