$ show santosomar/AI-agents-for-cybersecurity
This is an educational repository of Python scripts, mini-projects, and markdown guides for building LLM-based AI agents applied to cybersecurity. The code is organized into five progressive parts: foundational LLM/embeddings usage, prompt templates, prompt chaining, RAG over security data, and agentic workflows. It demonstrates multiple agent frameworks (LangChain, LangGraph, CrewAI, DeepAgents) and MCP server integrations for tools like nmap and Shodan. The dominant character is application/tutorial code rather than data research, although it bundles small datasets (CVE embeddings, sample RAG corpora) and commits Chroma vector stores for offline exercises. The repo is not a single deployable service; it is a collection of entry-point scripts and small frameworks. Architecture is a set of standalone examples with shared patterns: state graphs for orchestration, YAML-configured crews, MCP adapters, and RAG ingestion/query pipelines. Most scripts require OpenAI-compatible API keys and/or local tools such as nmap/Ollama. Simulated data and placeholder responses in some examples make it a learning environment rather than production security tooling. Maintenance is current but drift is moderate: some examples use deprecated langchain vectorstore imports, documentation is duplicated across subdirectories, several referenced files are missing, and hardcoded model strings like gpt-5.4-mini appear dated or fictional. There is no root-level automated test suite; only the Shodan MCP subproject contains tests. The strongest reusable patterns are the MCP server wrapping, LangGraph conditional-state orchestration, CrewAI declarative crew configuration, and the hierarchical SOC agent supervisor.
The LLM identified 5 files worth highlighting for reuse:
Exposes nmap scanning and CISA KEV retrieval as Model Context Protocol tools. The self-contained FastMCP server pattern can be extracted and adapted to wrap any CLI or web security API for LLM agents, demonstrating the MCP tool-adapter pattern.
Implements a pentest workflow as a LangGraph state graph with node functions, state merging, and conditional routing. This demonstrates a reusable pattern for multi-stage agent orchestration where each node returns partial state and a router decides next actions.
Defines a vulnerability-management crew using CrewAI's @CrewBase decorator and YAML agent/task configuration, with custom nmap/CVE tools. The separation of agent and task definitions from execution logic is a clean template for any multi-agent automation project.
Implements a SOC supervisor agent that delegates to five specialized subagents (triage, enrichment, investigation, correlation, response). The hierarchical delegation pattern is self-contained and reusable for other security operations or support-team automation.
Builds a complete retrieval-augmented generation pipeline using Chroma, embeddings, and LCEL. It is a compact reference architecture for RAG over domain documents, with separation between ingestion, retrieval, and generation steps.