Strix is an open-source, AI-powered penetration testing tool that orchestrates multiple LLM-driven agents to autonomously discover and validate security vulnerabilities in web applications, APIs, source code, and infrastructure. The system operates as a CLI application with three interface surfaces: a headless/non-interactive mode for CI/CD pipelines, a feature-rich Go Bubble Tea TUI for interactive scanning, and a local React web viewer for reviewing results. Scans run inside Docker sandboxes with a Caido interception proxy sidecar, allowing agents to execute shell commands, browse applications, modify requests, and apply patches. The architecture follows a multi-agent coordination pattern where a root agent delegates tasks to child agents, tracks coverage, manages budgets, and produces comprehensive reports including CVSS-scored vulnerabilities, proof-of-concept exploits, and fix recommendations. The codebase demonstrates strong engineering practices with extensive test coverage, atomic file operations, output bounding, MCP tool integration, and a sophisticated IPC protocol between the Python backend and Go TUI. Key features include: multi-agent orchestration with parent/child messaging and budget enforcement; Docker sandboxed execution with Caido proxy integration; support for multiple LLM providers (OpenAI, Anthropic, LiteLLM, Bedrock, etc.); MCP (Model Context Protocol) tool integration; SARIF and PDF report generation; cloud platform integration for managed scans; and a local web viewer with live transcript and vulnerability triage. The repository is primarily an application but includes data-oriented components like LLM cost tracking, coverage ledgers, and vulnerability deduplication using LLM-based comparison.
Nebula is a local-first security assessment workbench designed for penetration testing and red teaming operations. It functions as a desktop application built with a Tauri shell (Rust) wrapping a React/TypeScript frontend and a Python FastAPI backend sidecar. The system manages security engagements, scope policies, evidence collection, and AI-assisted analysis, emphasizing operator control, auditability, and data privacy through local-first execution and content-addressed artifact storage. The architecture follows a sidecar pattern where the Python Core service handles database operations (SQLite with Alembic), containerized command execution (Kali Linux via Docker/Podman), and AI provider integration. The frontend manages the UI state and terminal sessions via WebSocket. Key data flows involve user actions triggering API calls that validate against scope policies before executing commands in isolated containers, with all outputs stored as immutable artifacts for evidence integrity. The codebase demonstrates strong engineering practices with extensive test coverage (Pytest, Vitest, Playwright), a robust diagnostic system with secret redaction, and a policy engine for deterministic scope enforcement. It supports multiple AI providers and includes features for knowledge indexing, mission orchestration, and report generation. The project is actively maintained with recent commits and zero security alerts, though it is currently in alpha release.
Vigil is an open-source AI SOC (Security Operations Center) platform that orchestrates autonomous threat hunting, incident response, and case management through a multi-agent architecture. The system ingests security findings from SIEMs (Splunk, Elastic, Azure Sentinel), EDRs (CrowdStrike, Microsoft Defender), and other sources via Kafka or webhooks, then uses LLM-driven agents (hunt, root_cause, adjudicate, investigate, compose, chat) to analyze, enrich, and respond. A TypeScript agent layer with event-sourced ledgers and budget enforcement runs investigations, while a Python daemon handles polling, deduplication, and orchestration. The platform exposes its own tools via MCP (Model Context Protocol) and integrates with 30+ external security tools through a descriptor-based plugin system. The frontend is a React SPA with a setup wizard, dashboards, and case management UI. Deployment is via Docker Compose or Helm, with PostgreSQL, Redis, and optional Kafka as backing services.
This repository contains only documentation and configuration files (README, CONTRIBUTING, issue templates, .gitignore) with no actual source code present. The README describes SpiderSuite as a cross-platform web crawler for security professionals, but the codebase itself is empty in this snapshot. No functional analysis is possible. The repository appears to be a stub or the source code is hosted elsewhere. Given the absence of any executable or library code, this repository provides no reusable software assets.