zakirkun/guardian-cli

What it solves

Guardian is an AI-powered automation framework for penetration testing. It replaces manual, repetitive security assessments with an intelligent system that can plan, execute, and analyze security tests across networks, web applications, and cloud environments while capturing comprehensive evidence for professional reporting.

How it works

Guardian uses a multi-agent architecture consisting of a Planner, Tool Selector, Analyst, and Reporter. It integrates with various AI providers (such as OpenAI, Claude, and Gemini) to drive the testing process. The system executes a suite of over 50 integrated security tools (like nmap, nuclei, and sqlmap) via a DAG-based workflow engine. To improve accuracy, it employs a "debate triage" system where three AI roles (Red Advocate, Blue Advocate, and Judge) debate ambiguous findings to reduce false positives, and uses RAG (Retrieval-Augmented Generation) grounded in CVE/CWE/MITRE ATT&CK feeds to prevent hallucinations.

Who it’s for

It is designed for security researchers, authorized penetration testers, and educational environments needing to automate complex security assessments and generate professional, evidence-backed reports.

Highlights

• Multi-Provider AI Support: Compatible with OpenAI, Claude, Gemini, OpenRouter, Requesty, and local models via Ollama.
• Vision-LLM Triage: Uses headless screenshots and vision-capable LLMs to enrich analysis of web findings.
• Extensive Toolset: Integrates 50+ security tools across categories like Network, Web Recon, Cloud/Container, and LLM Red-Teaming.
• Smart Workflow DSL: Supports parallel execution, conditional steps, and session resumption via a DAG scheduler.
• Professional Reporting: Exports findings to SARIF, DefectDojo, and Slack, including CVSS v3.1 recomputation and AI decision traces.
• Security Guardrails: Includes DNS-resolve scope validation, prompt-injection defense, and a confirmation gate for intrusive tools.