samugit83/redamon

RedAmon – Autonomous AI‑Powered Security Platform

What it does

• RedAmon is a self‑contained Docker‑based system that runs a full security testing pipeline from reconnaissance to code‑fix generation. It launches dozens of open‑source scanners (e.g., Nmap, Metasploit, OpenVAS) in parallel, merges their outputs into a Neo4j knowledge graph, and lets an autonomous LLM‑driven agent triage findings, validate exploitability, and automatically create pull‑requests with remediation patches.
• The workflow is:
  1. Recon – multi‑tool discovery (sub‑domains, ports, endpoints) feeds a live graph.
  2. Exploitation – the agent checks CVEs, attempts exploits, maps lateral movement.
  3. Post‑exploitation – gathers further data, builds a full attack surface.
  4. AI Triage – an LLM ranks findings, deduplicates them, and decides which need fixing.
  5. CodeFix – another agent clones the target repo, runs 11 code‑aware tools, writes patches, and opens a GitHub PR for review.
• Human oversight is required at each critical step; the UI lets admins approve or reject actions.

Key components

• Docker stack – web UI, PostgreSQL, Neo4j, an “agent” container, a Kali‑based sandbox for scans, and optional OpenVAS (GVM) containers.
• Knowledge graph – all scanner results are stored in Neo4j, enabling queries in natural language and providing a structured view of the attack surface.
• AI providers – supports OpenAI, Anthropic, AWS Bedrock, Ollama, vLLM, Groq, etc.; you add API keys in the UI.
• OSINT integrations – API keys for Shodan, VirusTotal, Censys, FOFA, URLScan, NVD, Vulners, and many search engines (Google, Bing, Quake, etc.) give the agent broad discovery capabilities.
• CypherFix – the remediation module that analyses code, generates fixes, and creates PRs.

Getting started

1. Install Docker & Docker‑Compose.
2. Clone the repo and run ./redamon.sh install (add --gvm for full OpenVAS support or --kbase for the local knowledge base).
3. The script builds the images, starts the containers, and prompts you to create an admin user.
4. Log into http://localhost:3000, add your LLM and API keys, create a project, set a target, and hit Start Scan.

System requirements

• Minimum: 2 CPU, 4 GB RAM, 80 GB disk (without OpenVAS). With OpenVAS: 4 CPU, 8 GB RAM, ~110 GB disk.
• For production use, allocate ~200 GB free space for Neo4j, scan artefacts, and logs.

Community & licensing

• Open‑source under the MIT license.
• Active Discord, Telegram, and YouTube channels for demos and support.
• Roadmap and contribution board are public; the maintainers encourage PRs.

Legal disclaimer RedAmon is explicitly labeled a security testing tool for authorized use only. Misuse against systems you do not own is illegal.

---

Bottom line: RedAmon bundles a massive set of security scanners with an LLM‑driven orchestration layer, turning raw vulnerability data into actionable code fixes—all wrapped in a Docker‑first deployment that can be run locally or on a server.