zakirkun/guardian-cli

Guardian is a production-ready AI-powered penetration testing automation CLI tool that leverages Google Gemini and LangChain to orchestrate intelligent, step-by-step penetration testing workflows while maintaining ethical hacking standards.

What it solves

Guardian 是一个 AI 驱动的渗透测试自动化框架。它用智能系统取代手动、重复的安全评估，能够规划、执行和分析网络、Web 应用和云环境的安全测试，同时捕获完整证据以生成专业报告。

How it works

Guardian 使用由 Planner、Tool Selector、Analyst 和 Reporter 组成的多代理架构。它可集成多种 AI 提供商（如 OpenAI、Claude、Gemini）来驱动测试过程。系统通过基于 DAG 的工作流引擎执行超过 50 种集成安全工具（如 nmap、nuclei、sqlmap）。为提升准确性，采用“辩论分流”系统，由三种 AI 角色（Red Advocate、Blue Advocate、Judge）对模糊发现进行辩论，以降低误报，并使用基于 CVE/CWE/MITRE ATT&CK 信息的 RAG（检索增强生成）防止幻觉。

Who it’s for

它面向安全研究员、授权渗透测试员以及需要自动化复杂安全评估并生成有证据支撑的专业报告的教育环境。

Highlights

  • Multi-Provider AI Support: Compatible with OpenAI, Claude, Gemini, OpenRouter, Requesty, and local models via Ollama.
  • Vision-LLM Triage: Uses headless screenshots and vision-capable LLMs to enrich analysis of web findings.
  • Extensive Toolset: Integrates 50+ security tools across categories like Network, Web Recon, Cloud/Container, and LLM Red-Teaming.
  • Smart Workflow DSL: Supports parallel execution, conditional steps, and session resumption via a DAG scheduler.
  • Professional Reporting: Exports findings to SARIF, DefectDojo, and Slack, including CVSS v3.1 recomputation and AI decision traces.
  • Security Guardrails: Includes DNS-resolve scope validation, prompt-injection defense, and a confirmation gate for intrusive tools.