pikpikcu/airecon

AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.

What it solves

AIRecon is an autonomous penetration testing agent designed to automate the complex process of security reconnaissance and exploitation. It removes the need for manual tool chaining by using an LLM to drive a security-focused sandbox, allowing users to conduct full-stack security audits from discovery to reporting.

How it works

The agent operates through a structured pipeline (RECON $\rightarrow$ ANALYSIS $\rightarrow$ EXPLOIT $\rightarrow$ REPORT) and integrates with an OpenAI-compatible LLM gateway. It executes commands within a Kali Linux Docker sandbox and integrates natively with the Caido proxy.

To enhance its decision-making, it uses a local SQLite memory database to track findings and patterns, and can optionally connect to a massive local knowledge base (airecon-dataset) containing over 1 million security records (CVEs, CTF writeups, etc.) via a dataset_search tool. It also supports the Model Context Protocol (MCP) to extend its toolset with external servers.

Who it’s for

Security researchers, penetration testers, and bug bounty hunters who want to automate repetitive reconnaissance tasks and complex attack chains while maintaining the option for fully offline, private operation using local models.

Highlights

  • Backend Agnostic: Works with any OpenAI-compatible gateway, supporting both hosted models and local ones (e.g., via vLLM or Ollama).
  • Kali Sandbox: Executes tools in a secure, isolated Docker environment.
  • Native Caido Integration: Built-in support for proxy tools like replay, fuzzing, and sitemap management.
  • ** uma Local Knowledge Base**: Optional indexing of ~1.09M security records for grounded, autonomous decision-making.
  • Verified-only Learning: Persists only high-confidence findings to its cross-session brain to avoid noise.
  • Automatic Reasoning Detection: Detects at runtime whether a model supports reasoning capabilities without needing hardcoded lists.

Related

  • Project
    samugit83/redamon

    RedAmon is an autonomous, Docker‑based security platform that chains parallel reconnaissance tools, feeds their results into a Neo4j knowledge graph, and uses LLM agents to triage findings, validate exploits, and automatically generate GitHub pull‑requests with code fixes. It supports many OSINT APIs, multiple LLM providers, optional OpenVAS integration, and provides a web UI for admin‑controlled, human‑in‑the‑loop operation.

  • Project
    KunAgent/Kun

    Kun is a local‑first AI desktop workspace that merges code editing, document management, and chat‑style agents into one Electron app. All data stays on your computer; you connect any OpenAI‑compatible, Anthropic‑compatible, or local model (e.g., Ollama, DeepSeek). Features include project‑wide code assistance, a research‑paper workspace, extensible plugins, and a terminal UI. It’s aimed at developers and researchers who want AI‑augmented productivity without cloud‑side data storage, and it’s released under a non‑commercial PolyForm license.

  • Project
    HKUDS/DeepCode

    An open agentic coding system that uses multi-agent systems to transform natural language and research papers into production-ready code.

  • Project
    PentesterFlow/agent

    PentesterFlow is an open‑source terminal assistant that lets a human analyst guide an LLM‑driven agent through penetration‑testing tasks. It integrates real security tools (curl, shell, Burp, file utilities), supports many LLM backends, stores evidence and findings as markdown, and retains project‑level memory across sessions while requiring explicit approval for risky actions.

  • Project
    Trampoline-AI/predict-rlm

    predict-rlm is a Python library that gives large language models a sandboxed, stateful runtime. Models write and execute Python code, keep mutable state, call focused sub‑models, and use tools/skills (e.g., PDF handling, spreadsheets). The framework records a full trace for observability and can feed those traces to optimisation tools like GEPA. It’s aimed at complex, multi‑step workflows such as document analysis, audit, or spreadsheet automation, and supports optional Docker sandboxing and rich callbacks.