zakirkun/deep-eye

Deep Eye orchestrates multiple AI providers (OpenAI, Claude, Grok, Gemini, OLLAMA, Groq, Mistral, OpenRouter, LiteLLM, LM Studio) for intelligent payload generation, scans targets for 45+ vulnerability types, and produces professional reports with compliance mapping.

What it solves

Deep Eye is an AI-driven penetration testing tool designed to automate the discovery and reporting of security vulnerabilities. It reduces the manual effort required to generate complex attack payloads and triage findings by leveraging multiple AI providers to intelligently scan targets for over 50 types of vulnerabilities.

How it works

The tool orchestrates a variety of AI models (such as GPT-4o, Claude, and Llama) to generate context-aware payloads based on the target's tech stack, WAF fingerprints, and known CVEs. It uses a RAG-indexed CVE database to inform its attack patterns. The system includes a browser automation layer via Playwright and an intercepting proxy for deep analysis, and can ingest OpenAPI/Swagger specifications to seed its crawl. After scanning, it uses AI to triage findings, filter false positives, and generate professional, compliance-mapped reports (e.g., PCI-DSS, SOC2).

Who it’s for

It is intended for security researchers, bug bounty hunters, and penetration testers who have authorization to test the same systems.

Highlights

  • Multi-AI Provider Support: Failover support for 11 different AI providers, including local options like OLLAMA.
  • Context-Aware Payloads: Generates payloads tailored to the specific target environment and CVE intelligence.
  • AI Triage: Automatically filters false positives and provides evidence summaries for each finding.
  • Comprehensive Reporting: Auto-generates HackerOne-style reports and supports multiple export formats including PDF, SARIF, and JSON.
  • Natural-Language Scope: Allows users to define target boundaries using natural language commands.
  • Advanced Automation: Includes CAPTCHA detection and solving, browser automation, and scan diffing for retesting.

Related

  • Project
    0xSteph/pentest-ai

    An open-source AI penetration testing and bug-bounty tool that uses machine oracles to independently verify and prove every vulnerability finding.

  • Project
    Unclecheng-li/DeepSec

    An AI security platform combining a three-layer code auditing system (Shield) and an automated, authorized penetration testing engine (Spear).

  • Project
    psyray/oasis

    OASIS is a Python CLI tool that uses locally hosted LLMs (via Ollama or any OpenAI‑compatible server) to scan source code for security vulnerabilities. It runs a fast scan model, then deep‑analysis models, validates findings deterministically, caches results, and outputs canonical JSON plus HTML/PDF/Markdown reports. A password‑protected web dashboard lets users explore findings and ask the assistant for re‑investigations. It supports multi‑model runs, suppression registries, diffing against baselines, and CI exit‑code gating.

  • Project
    openhackai/OpenHack

    OpenHack is an open‑source, LLM‑driven security scanner that analyses a codebase through a recon‑→‑hunter‑→‑validator‑→‑verifier pipeline, presenting findings in an interactive terminal UI and optionally verifying exploits in Docker.

  • Project
    lintsinghua/DeepAudit

    DeepAudit is an open‑source, multi‑agent AI security auditor that analyses code, generates and sandbox‑executes PoC exploits, and outputs professional reports. It runs via Docker, supports local LLMs, and aims to reduce false positives and verify vulnerabilities automatically.