Redamon

samugit833.2kstars

1# Redamon

README.mdMCP server

Transport: stdio
Status: Local

Power your agent

Add this server

Install from the publisher. Not a PlugMCP endpoint.

Run on PlugMCP

Host a copy with our keys and logs.

No packaged release in the registry yet. Follow the repository README.

RepositoryPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
License: MIT
Last checked: 2026-10-27

Stars: 3.2k
Tools: —
Uptime: —

Overview

About Redamon

Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Redamon?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Redamon need an API key?

No required environment variable is listed on this record.

What transport does Redamon use?

Redamon runs locally over stdio.

When was Redamon last checked?

Last checked 2026-10-27. Open-source, self-hosted AI penetration testing framework: maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens PRs that fix what it finds. MCP both ways: plug in any MCP server as a tool, or drive RedAmon from Claude Code or your own agent.

From the publisher

Documentation

🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box. Every solve ships a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag fell, tool call by tool call. Auditable, line by line. See the XBOW Validation Benchmark scorecard.

📊 Coverage, measured and self-scored: the Bug Bounty Coverage — The Full Taxonomy Audit (PDF, 124 pages) audits RedAmon against all 397 classes of web bug-bounty finding, one line at a time, naming the exact module, skill or scanner behind every verdict, and scoring the recon pipeline and the agentic system separately against their own remit. It is deliberately self-critical, it records what is missing as plainly as what is covered: 134 classes complete, 210 in the build backlog, 44 deliberately excluded, with one explicit decision for every class.

Roadmap & Community Contributions

We maintain a public Project Board with upcoming features open for community contributions. Pick a task and submit a PR!

Want to contribute? See CONTRIBUTING.md for how to get started.

Maintainers

Anthropic Cyber Verification Program: the team behind RedAmon is approved under Anthropic's Cyber Verification Program.

Quick Start

Prerequisites

Docker Engine 28.0.0 or newer & Docker Compose v2+ (check with docker version --format '{{.Server.Version}}')
- macOS: Docker Desktop, with Memory raised to at least 4 GB (8 GB with --gvm) in Settings → Resources. Clone under ~/ so the path is inside the default File Sharing list.
- Windows: Docker Desktop with the WSL2 backend, run from inside the WSL2 filesystem (~/), not /mnt/c/.

That's it. No Node.js, Python, or security tools needed on your host.

Minimum System Requirements

Resource	Without OpenVAS	With OpenVAS (full stack)
CPU	2 cores	4 cores
RAM	4 GB	8 GB (16 GB recommended)
Disk	80 GB free	110 GB free

Without OpenVAS runs 7 containers: webapp, postgres, neo4j, agent, kali-sandbox, recon-orchestrator, and docker-broker (a filtering Docker-socket proxy that the recon orchestrator's spawned scan containers go through, so they can only launch the known tool images). With OpenVAS adds 4 more runtime containers (gvmd, ospd-openvas, gvm-postgres, gvm-redis) plus ~8 one-shot data-init containers for vulnerability feeds (~170K+ NVTs). First launch takes ~30 minutes for GVM feed synchronization. Dynamic recon and scan containers are spawned on-demand during operations and require additional resources.

Disk sizing for a real deployment. The figures above are bare minimums to build and run the stack (fixed platform footprint: ~70 GB without OpenVAS, ~95 GB with - measured by true on-disk image size after deduplicating the shared Kali base layers). For an always-on server running real engagements, add ~100 GB of free space for operational data - the Neo4j attack graph, scan artifacts/outputs, Postgres, and container logs all grow with use. That means 200 GB without OpenVAS, 250 GB with OpenVAS, each leaving well over 100 GB free for operations. See the deployment guide for the full breakdown.

1. Clone & Install

git clone https://github.com/samugit83/redamon.git
cd redamon

# Without GVM (lighter, faster startup):
./redamon.sh install

# With GVM / OpenVAS (full stack, ~30 min first run):
./redamon.sh install --gvm

The script builds all images and starts the services.

2. Create Admin Account

At the end of the install (and on every ./redamon.sh up or ./redamon.sh update if no admin exists), you will be prompted in the terminal:

[WARN] No admin user found. Let's create one.

  Admin name: Your Name
  Admin email: [email protected]
  Admin password: ********
  Confirm password: ********

Admin name -- display name shown in the UI (e.g. Admin, your name, anything you want).
Admin email -- used to log in at http://localhost:3000/login.
Admin password -- minimum 12 characters.

After creation, open http://localhost:3000 and sign in with the email and password you just set.

No prompt appeared? On a heavy first boot (especially --gvm, or a small VM) the webapp can take a while to come up, so the automatic prompt may be skipped. Create the admin at any time with:
./redamon.sh create-admin
It waits for the webapp, then prompts for the same details. It is safe to re-run: reusing an existing admin's email resets that password, a new email adds another admin.

What the admin can do:

Switch between all users via the user dropdown in the header (including users without a password).
Create new users (with or without a password) and assign them admin or standard roles.
Set or change any user's password.
Delete users (except themselves).
Access the Users management page from the header navigation.

Standard users can only log in (if they have a password set by an admin), change their own password, and use the app within their own scope. They cannot switch users, create users, or access user management.

If you forget the admin password, reset it from the terminal:

./redamon.sh reset-password   # reset an EXISTING user's password
./redamon.sh create-admin     # create the first admin, or reset an admin by re-entering its email

Use create-admin when no admin exists yet (it upserts on email); reset-password only updates a user that already exists.

3. Configure

Open http://localhost:3000/settings (gear icon in the header) to configure everything. No .env file is needed.

LLM Providers -- add API keys for OpenAI, Anthropic, OpenRouter, AWS Bedrock, or any OpenAI-compatible endpoint (Ollama, vLLM, Groq, etc.). Each provider can be tested before saving. The model selector in project settings dynamically fetches available models from configured providers.
API Keys -- Tavily, Shodan, SerpAPI, NVD, Vulners, URLScan, and threat intelligence keys (Censys, FOFA, OTX, Netlas, VirusTotal, ZoomEye, CriminalIP) to enable extended agent capabilities (web search, OSINT, CVE lookups, passive threat intel). Uncover multi-engine search keys (Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet) expand target discovery across 13 search engines -- shared keys (Shodan, Censys, FOFA, etc.) are automatically reused. Supports key rotation -- configure multiple keys per tool with automatic round-robin rotation to avoid rate limits.
Tunneling -- configure ngrok or chisel for reverse shell tunneling. Changes apply immediately without container restarts.

All settings are stored per-user in the database. See the AI Model Providers wiki page for detailed setup instructions.

4. Open the Webapp

Go to http://localhost:3000 -- create a project, configure your target, and start scanning.

For a detailed walkthrough of every feature, check the Wiki.

Prefer video? Watch the Product Demos playlist on YouTube for step-by-step tutorials.

Having issues? See the Troubleshooting guide or the Wiki Troubleshooting page.

Management Commands

All lifecycle management is handled by a single script:

Command	Description
`./redamon.sh install`	Build + start lightweight (no GVM, no Knowledge Base, Tavily-only web search)
`./redamon.sh install --kbase`	Build + start with the local Knowledge Base (~4.4 GB heavier)
`./redamon.sh install --gvm`	Build + start with GVM/OpenVAS

Flags can be combined: ./redamon.sh install --gvm --kbase

Command	Description
`./redamon.sh update`	Pull latest version, smart-rebuild only changed services (preserves your install-time GVM/KB choice)
`./redamon.sh up`	Start services (auto-detects GVM and KB mode from install)
`./redamon.sh up dev`	Start in dev mode with hot-reload (auto-detects GVM and KB mode)
`./redamon.sh down`	Stop services (preserves data)
`./redamon.sh status`	Show running services, version, GVM mode, KB state, plugin platform state (and why it cannot run on this host, when it cannot)
`./redamon.sh clean`	Remove containers + images, keep data
`./redamon.sh create-admin`	Create the admin login (or reset it) -- use if no prompt appeared at install
`./redamon.sh reset-password`	Reset an existing user's password from the terminal
`./redamon.sh supply-chain-sync [ecosystems]`	Populate the offline OSV database for the supply-chain feature (default: `npm`; e.g. `npm PyPI Go`)
`./redamon.sh purge`	Remove everything including all data

Updating to a New Version

Just run:

./redamon.sh update

The script pulls the latest code from GitHub, detects which Dockerfiles and source files changed, rebuilds only the affected images, and restarts the updated services. Your databases, scan results, and reports are preserved -- volumes are never deleted.

One-time note when a release adds a new background service. update re-execs the freshly-pulled script so new build/start rules apply automatically -- but only for the script version you are updating from. When updating from a version that predates this self-heal (i.e. your first update onto it), run ./redamon.sh up once right after update so any newly added core service is started:
./redamon.sh update && ./redamon.sh up
up is idempotent -- it starts only what is missing and leaves running containers untouched. After this one-time step, plain ./redamon.sh update handles everything on its own.

Upgrading across 6.9 (repository reorganization). 6.9 grouped the top-level directories under scanners/, services/, testing/, tooling/ and docs/. git pull moves only tracked files, so data that git does not track -- the knowledge-base index, past scan outputs, and the single-host deploy .env and TLS material -- would otherwise be left behind at the old paths. update (and up/status) migrate it for you automatically and print what moved. If any file was written by a container as root and could not be moved, finish it with:
sudo ./redamon.sh migrate-layout

The webapp also checks for updates automatically and shows a notification in the UI when a new version is available.

Deploy to a Server (Production)

The Quick Start above runs RedAmon locally on localhost. To run a shared, internet-reachable instance on a Linux server (EC2, DigitalOcean, Hetzner, or bare metal), use the single-host deploy in tooling/deploy/single-host/. It drives redamon.sh over SSH from your laptop and wraps the stack in the internet-facing security layer RedAmon omits by default: nginx + TLS (Let's Encrypt), a host firewall, SSH hardening, and fail2ban, with a single public HTTPS origin so only the login page is reachable and everything else stays bound to loopback.

cd tooling/deploy/single-host
cp .env.example .env      # set HOST_IP, DOMAIN, SSH_KEY_PATH, OPERATOR_ALLOW_CIDRS,
                          # LETSENCRYPT_EMAIL, ADMIN_* ...
./deploy.sh init          # first build takes 30-60 min, then log in at https://<domain>/

Full walkthrough: Wiki: Deploying to a Server. Complete reference: tooling/deploy/single-host/README.md.

Development Mode

For contributors and active development with Next.js fast refresh:

./redamon.sh up dev           # auto-detects GVM mode from install

Tool images are built automatically on first run if they don't exist yet. The dev override swaps the production webapp image for a dev container with your source code volume-mounted. Every file save triggers instant hot-reload in the browser.

When to Rebuild vs Restart

What changed	Action needed
`webapp/src/` (frontend code)	Nothing -- Next.js hot-reload handles it in dev mode
`agentic/*.py` (agent Python code)	`docker compose build agent && docker compose up -d agent` (source is baked into the image, so `restart` alone won't pick up `.py` changes)
`recon_orchestrator/*.py`	`docker compose restart recon-orchestrator`
`mcp/servers/*.py` (MCP servers)	`docker compose restart kali-sandbox`
`agentic/Dockerfile` or `agentic/requirements.txt`	`docker compose build agent && docker compose up -d agent`
`recon_orchestrator/Dockerfile` or its `requirements.txt`	`docker compose build recon-orchestrator && docker compose up -d recon-orchestrator`
`mcp/kali-sandbox/Dockerfile`	`docker compose build kali-sandbox && docker compose up -d kali-sandbox`
`webapp/Dockerfile` or `webapp/package.json`	`docker compose build webapp && docker compose up -d webapp`
`recon/Dockerfile`	`docker compose --profile tools build recon`
`scanners/gvm_scan/Dockerfile`	`docker compose --profile tools build vuln-scanner`
`scanners/github_secret_hunt/Dockerfile`	`docker compose --profile tools build github-secret-hunter`
`scanners/trufflehog_scan/Dockerfile` (Secret Multiscanner)	`docker compose --profile tools build trufflehog-scanner`
`scanners/baddns_scan/Dockerfile` or `scanners/baddns_scan/entrypoint.sh`	`docker compose --profile tools build baddns-scanner`
`scanners/wcvs/Dockerfile` (web cache poisoning engine)	`docker compose --profile tools build wcvs`
`scanners/supply_chain_scan/Dockerfile` (L1 scanner)	`docker compose --profile tools build supply-chain`
`scanners/supply_chain_analyzer/` (DIRTY analyzer; entrypoint is baked)	`docker compose --profile tools build supply-chain-analyzer`
`docker-compose.yml`	`docker compose up -d` (re-creates affected containers)
`prisma/schema.prisma`	`docker compose exec webapp npx prisma db push`

Rebuild a single service:

docker compose build <service>                    # Rebuild one image
docker compose up -d --no-deps <service>          # Restart only that service

Common dev commands:

docker compose ps                                 # Check service status
docker compose logs -f <service>                  # Follow logs for a service
docker compose down                               # Stop all (preserves volumes)
docker compose --profile tools down --rmi local   # Remove built images
docker compose --profile tools down --rmi local --volumes --remove-orphans  # Full cleanup

Reclaim disk space:

docker system df                                  # Show Docker disk usage (add -v for per-image breakdown)
docker image prune -f                             # Remove dangling images (auto-run by `./redamon.sh install` and `update`)
docker builder prune -f                           # Drop unused build cache (auto-run after every successful build; opt out with REDAMON_NO_AUTO_PRUNE=1)
docker builder prune -af                          # Drop ALL build cache, including what the current images reuse -- frees no extra disk and makes the next rebuild cold
docker container prune -f                         # Remove stopped containers

For a complete development reference -- hot-reload rules, common commands, important rules, and AI-assisted coding guidelines -- see the Developer Guide.

Knowledge Base (RAG-Enhanced Web Search)

The agent's web_search tool includes a local Knowledge Base -- a RAG pipeline that searches curated security datasets (GTFOBins, LOLBAS, OWASP WSTG, NVD CVEs, ExploitDB, Nuclei templates, and agent skill docs) before falling back to Tavily web search. When the KB returns a high-confidence match, Tavily is skipped entirely for faster, offline-capable results.

How it works: When the KB is enabled, install / up / update builds a lightweight KB index (~1,200 chunks in 10-15 min on CPU). At query time, the agent runs a hybrid retrieval pipeline (FAISS vector search + Neo4j fulltext), reranks with a cross-encoder, and checks a confidence threshold. If the score is high enough, results come from the local KB. Otherwise, it falls back to Tavily or merges both.

Default behavior: The KB is opt-in. ./redamon.sh install produces a lightweight install (~4.4 GB lighter, Tavily-only web search). To enable the local KB, pass --kbase:

./redamon.sh install --kbase

On first install with --kbase, RedAmon detects your hardware (GPU / CPU / API) and offers a quick-start profile. The choice is persisted, so subsequent update / up commands respect it without re-passing the flag.

Speed up ingestion with API embeddings: By default, embeddings run locally on CPU/GPU. On CPU-only machines, large datasets (ExploitDB, NVD) can take hours. You can offload embedding to an external API by creating a .env file from the template:

cp .env.example .env

Then configure the embedding API in .env:

Variable	Default	Description
`KB_EMBEDDING_USE_API`	`false`	Set to `true` to use API-based embeddings instead of local model
`KB_EMBEDDING_API_BASE_URL`	(empty = OpenAI)	Any OpenAI-compatible endpoint (Ollama, vLLM, LiteLLM, Together AI, Azure)
`KB_EMBEDDING_API_KEY`	(empty)	API key for the embedding provider
`KB_EMBEDDING_API_MODEL`	`text-embedding-3-small`	Model name (provider-specific)
`NVD_API_KEY`	(empty)	Free NVD API key for 10x faster CVE ingestion

Example with Ollama (free, local, no API key cost):

KB_EMBEDDING_USE_API=true
KB_EMBEDDING_API_BASE_URL=http://host.docker.internal:11434/v1
KB_EMBEDDING_API_KEY=ollama
KB_EMBEDDING_API_MODEL=nomic-embed-text

Important: Ingestion and query must use the same model. If you switch models, rebuild the index: make -C services/knowledge_base kb-rebuild-lite MODE=docker

Manage the KB:

./redamon.sh kb build lite          # Build with lite profile (~30-60s with API)
./redamon.sh kb build standard      # Add NVD CVEs
./redamon.sh kb update nvd          # Incremental NVD refresh
./redamon.sh kb stats               # Show index statistics
./redamon.sh kb rebuild lite        # Wipe and rebuild from scratch

For full technical documentation -- query pipeline, data sources, ingestion profiles, scoring, security model -- see the Knowledge Base Technical Reference or the Wiki: Knowledge Base & Web Search.

Full Wiki Documentation
Overview
Built for Enterprise, Secure by Design
Security & Threat Model
Feature Highlights
System Architecture
Components
Documentation
Troubleshooting
RedAmon HackLab
Community Showcase
Legal

Overview

RedAmon is a modular, containerized penetration testing framework that chains automated reconnaissance, AI-driven exploitation, and graph-powered intelligence into a single, end-to-end offensive security pipeline. Every component runs inside Docker (no tools installed on your host) and communicates through well-defined APIs so each layer can evolve independently.

The platform is built around six pillars:

Pillar	What it does
Reconnaissance Pipeline	A parallelized fan-out / fan-in scanning pipeline that maps your target's entire attack surface (starting from a single domain, IP addresses / CIDR ranges, or a Domain batch of many domains scanned in turn) from subdomain discovery (5 concurrent tools) through port scanning, Nmap service detection and NSE vulnerability scripts, HTTP probing, resource enumeration, and vulnerability detection. Independent modules run concurrently via `ThreadPoolExecutor`, graph DB updates happen in a background thread, and results are stored as a rich, queryable graph. Complemented by standalone GVM network scanning, GitHub secret hunting, and Secret Multiscanner deep secret scanning modules.
AI Agent Orchestrator	A LangGraph-based autonomous agent that reasons about the graph, selects security tools via MCP, transitions through informational / exploitation / post-exploitation phases, and can be steered in real-time via chat.
Attack Surface Graph	A Neo4j knowledge graph with 17 node types and 20+ relationship types that serves as the single source of truth for every finding, and the primary data source the AI agent queries before every decision.
EvoGraph	A persistent, evolutionary attack chain graph in Neo4j that tracks every step, finding, decision, and failure across the attack lifecycle, bridging the recon graph and enabling cross-session intelligence accumulation.
CypherFix	Automated vulnerability remediation pipeline: one triage run scores every finding from the graph with a fixed risk model, groups the ones that share a fix, has an LLM check the evidence behind each, and writes one fix item per group. A CodeFix agent then clones the target repository, implements a fix using a ReAct loop with 11 code tools, and opens a GitHub pull request.
Project Settings Engine	500+ per-project parameters (exposed through the webapp UI) that control every tool's behavior, from Naabu thread counts to Nuclei severity filters to agent approval gates.

Built for Enterprise, Secure by Design

RedAmon is engineered to drop into a real security organization, not just a researcher's laptop.

Secure by design, STRIDE threat-modeled. The whole platform is assessed end to end under STRIDE and hardened in independently verified waves: code-level privilege separation, a filtering Docker broker in front of the host socket, fail-closed auth, SSRF egress guards, secret redaction, append-only audit trails, and a non-disableable guardrail that blocks government, military, and intergovernmental targets. See the Security Posture and Threat Model.
Fully isolated and containerized. Every tool, scanner, and agent runs in its own container with no host-level execution. Scan jobs are spawned as ephemeral sibling containers with their own filesystem and network namespace, then torn down on completion, keeping the host clean and containing the blast radius of any exploit.
Governed and multi-tenant. Multi-user / multi-project tenancy with admin and standard roles, DB-level user_id + project_id scoping on every node, Rules-of-Engagement enforcement, human-in-the-loop approval gates, and 500+ per-project settings give teams the control an enterprise engagement requires.

Deploy to a server in one command. Beyond local localhost, RedAmon ships a hardened single-host deploy that stands up a shared, internet-reachable instance and wraps the stack in nginx + TLS (Let's Encrypt), a host firewall, SSH hardening, and fail2ban, exposing a single public HTTPS origin:

cd tooling/deploy/single-host
cp .env.example .env      # set DOMAIN, HOST_IP, SSH_KEY_PATH, ADMIN_* ...
./deploy.sh init          # builds the full stack and brings it up over SSH

Full walkthrough: Wiki: Deploying to a Server.

Security & Threat Model

RedAmon is offensive software, so we hold it to the standard it tests others by. It is engineered secure by design and has been assessed end to end under the STRIDE methodology (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege), with findings remediated in sequenced, independently verified waves.

This is not a marketing claim. It is grounded in a published, evidence-based analysis you can read:

Security Posture - the full defense-in-depth control catalog: every layer implemented, mapped to the code.
Threat Model - the assets, trust boundaries, data flows, entry points, and network surface the analysis was built on.

Highlights of what is implemented:

Code-level privilege separation. The target-facing worker is the least trusted component and holds no secrets; a filtering docker-broker stands between the orchestrator and the host Docker socket (image allowlist, denies --privileged, host-root binds, dangerous capabilities).
Two deployment postures, one trust model. Local (backends bound to loopback) and a hardened public-internet deploy that adds nginx + TLS, an operator gate, login rate-limiting, and a single public origin.
Fail-closed by default. Unset auth tokens reject rather than serve, default database credentials are refused and rotated, WebSockets require a signed ticket plus a server-side same-origin check, and every request is scoped to its authenticated owner (per-user access control with anti-enumeration 404s).
Defense in depth. SSRF egress guards, secret redaction in logs, append-only audit trails, container-escape hardening, decompression and concurrency caps, and supply-chain pinning (sha256 + commit pins).
A non-disableable hard guardrail blocks government, military, and intergovernmental targets regardless of configuration.
Third-party plugins are contained, not trusted. The plugin platform installs only from an Ed25519-signed catalog, runs each plugin under its own UID in a runner with no internet and no database or LLM credentials, reaches the stack only through a two-route proxy that re-authorizes every call, and lets a plugin change the agent's instructions only through text a person approves.
Verified, release-gated remediation. Fixes ship in sequenced waves, each independently verified with live exploit reproduction before and after the patch. See the Changelog security entries.

Found a vulnerability? See our Security Policy for private disclosure.

Feature Highlights

Reconnaissance Pipeline

A fully automated, end-to-end external attack-surface mapper running inside a Kali Linux container. Give it one input (a root domain, a subdomain list, IP/CIDR ranges, or a Domain batch: a list of hostnames grouped by domain and scanned one group after another into a single graph) and the pipeline returns a complete, structured picture of the target: every subdomain, every live host, every open port, every HTTP service with its technology stack, every crawled endpoint and discovered parameter, every CVE the target is likely vulnerable to, plus dedicated scanners for GraphQL APIs, subdomain takeovers, hidden virtual hosts behind reverse proxies, web cache poisoning & deception, and an Adversarial AI Surface layer that tags AI runtimes / vector DBs / LLM frontends / proxies / MCP servers / chat / completion / embedding / RAG endpoints and prompt-injectable parameters using header / favicon / title / path / parameter-name signatures, then actively confirms them with a dedicated AI Surface Recon module (benign chat-shape probes, MCP handshake + tool-poisoning scan, vector-DB reads — no LLM calls).

Everything runs on a fan-out / fan-in architecture: each phase fires as many tools in parallel as the work allows, then converges before the next phase begins. 40+ industry tools integrate into one coordinated workflow, wildcard DNS poisoning is filtered out automatically with puredns, and stealth mode keeps the entire pipeline running on passive sources only when active probing is off-limits. Findings stream into the Neo4j knowledge graph on a background thread so the scan never blocks on database writes, and the raw JSON is preserved for download. The detailed tool-by-tool breakdown is in the matrix below.

Wiki: Running Reconnaissance | Technical: README.RECON.md

Recon Pipeline Tool Matrix

Settings Tab	Phase	Tools	Type	Execution
Discovery & OSINT	Subdomain Discovery	crt.sh, HackerTarget, Subfinder, Amass, Knockpy	Passive*	5 tools parallel
	Wildcard Filtering	Puredns	Active	Sequential
	WHOIS + URLScan	python-whois, URLScan.io API	Passive	Parallel
	DNS Resolution	dnspython	Passive	20 parallel workers
	OSINT Enrichment	Shodan / InternetDB	Passive	Parallel with port scan
	Uncover Expansion	ProjectDiscovery Uncover (13 engines: Shodan, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet)	Passive	Before port scan (GROUP 2b)
	Threat Intel Enrichment	Censys, FOFA, OTX (AlienVault), Netlas, VirusTotal, ZoomEye, CriminalIP	Passive	7 tools parallel (GROUP 3b)
Port Scanning	Port Scanning	Masscan, Naabu	Active / Passive	Both parallel (Naabu supports passive InternetDB mode)
Nmap Service Detection	Service Version Detection	Nmap (-sV, --script vuln)	Active	Sequential per target
Port Scanning	TLS Certificate Grab	tlsx: one handshake per open non-HTTP port (SMTPS 465, IMAPS 993, POP3S 995, LDAPS 636, FTPS 990, and any odd TLS port the port scan found), capturing issuer / SAN / validity / posture where httpx only reaches the five HTTPS ports it dials. In-scope SAN hostnames feed back as scan targets (apex-scoped, resolve-checked); optional JARM / JA3 fingerprints and TLS version / cipher enumeration	Active	After Nmap, before HTTP probing so discovered hostnames become probe targets (GROUP 3.6)
HTTP Probing	HTTP Probing	httpx	Active	Internal parallel
	Tech Detection	Wappalyzer	Passive	Sequential (post-probe)
	Banner Grabbing	Custom (Python sockets: SSH, FTP, SMTP, MySQL, etc.)	Active	Parallel workers
Resource Enum	Web Crawling	Katana, Hakrawler	Active	Parallel
	Archive Discovery	GAU (Wayback, CommonCrawl, OTX)	Passive	Parallel with crawlers
	Parameter Mining	ParamSpider (Wayback CDX)	Passive	Parallel with crawlers
	JS Analysis	jsluice	Active	Sequential (post-crawl)
	Directory Fuzzing	FFuf	Active	Sequential (post-jsluice)
	Browser Crawling	ZAP Ajax Spider	Active	Sequential (post-FFuf), per-seed Docker containers in parallel
	Parameter Discovery	Arjun	Active / Passive	Methods parallel (GET/POST/JSON/XML)
	API Discovery	Kiterunner	Active	Sequential per wordlist
	API Specification Import	OpenAPI / Swagger (declared endpoints, never called)	Active (documents only)	Sequential (after the other sources)
	Endpoint AI Classifier	Path + parameter classifier — tags `Endpoint.ai_interface_type` (`llm-chat`, `llm-completion`, `llm-embedding`, `llm-tool-call`, `sse-stream`, `mcp`, `llm-graphql`), `is_ai_rag_ingest`, `Parameter.is_ai_prompt_injectable` against catalogued AI signatures	Passive	Sequential (post-crawl)
JS Recon	JS Secret Detection	100 regex patterns + custom uploads	Passive	Parallel per file
	Key Validation	21 service validators (AWS, GitHub, Stripe, etc.)	Active	Rate-limited (1/sec/svc)
	Source Map Discovery	Comment, header, path probing	Active	Per JS file
	Dependency Confusion	npm registry check	Passive	Per scoped package
	Endpoint Extraction	REST, GraphQL, WebSocket, router patterns	Passive	Per JS file
	Framework Fingerprinting	12 built-in + custom signatures	Passive	Per JS file
	DOM Sink Detection	17 XSS/prototype pollution patterns	Passive	Per JS file
Serialized Object Scan	Serialized-Object Detection	Passive, in-memory detection of insecure-deserialization sinks across every major family (native Java `rO0`/`aced`, Jackson/FastJSON/XMLDecoder/XStream/SnakeYAML/Hessian, PHP `O:`/`a:` + PHAR, Python pickle, .NET BinaryFormatter + ASP.NET ViewState, Ruby Marshal) in response headers, `Set-Cookie`, enumerated parameters and crawled form fields; bomb-safe decode-and-recurse normalizer that never deserializes. Writes info-severity `:Vulnerability` candidates (`needs_agent_confirmation`) that the Insecure Deserialization agent skill then confirms with a non-destructive OOB oracle. Disabled by default	Passive	GROUP 5b (beside JS Recon)
Supply Chain Recon	Malicious Package Detection	Black-box harvest of the npm package set the target serves (source-map `node_modules` mining + `import`/`require` + Wappalyzer technologies), synthesized into a CycloneDX SBOM and verdicted against the offline OSV database. Writes `Package` + `MalPackageFinding` nodes, anchored to `BaseURL` via `DEPENDS_ON`. No new fetches (parses JS-recon output)	Passive (offline)	Post-JS-recon (GROUP 5.5)
AI Surface Recon	AI/LLM/MCP/Vector-DB Fingerprinting	Active confirmation of the surfaces the classifier flagged — chat-shape probes (dialect/streaming/latency), MCP handshake + `tools/list` + Cisco YARA tool-poisoning scan, OpenAPI/model-listing discovery, Julius YAML probe-pack engine, vector-DB confirmation reads (qdrant/chroma/weaviate/milvus). Writes `Endpoint.ai_` / `ai_mcp_`, `Parameter.is_ai_prompt_injectable`, confirmed `Technology(ai-*)`, and MCP tool-poisoning `Vulnerability` nodes	Active (benign, no LLM calls)	Hosts parallel, workloads sequential (GROUP 5c / Phase 4.5)
AI Gauntlet	Broad LLM Scan	garak — 40 probe families (prompt injection, DAN jailbreaks, encoding bypass, data-leak replay, system-prompt extraction, toxicity, malware / exploit generation, package hallucination)	Active (offensive)	Offensive follow-up to recon; one-shot per probe, ASR per family, local-judge graded
	Multi-Turn Jailbreaks	PyRIT — bounded conversational attacks (crescendo, skeleton-key, TAP, many-shot)	Active (offensive)	Multi-turn escalation, local attacker / judge model
	Quality + Safety Scan	Giskard — app-tailored detectors (prompt injection, information disclosure, hallucination, harmfulness, stereotypes, sycophancy, output formatting)	Active (offensive)	Test set generated from the app purpose, local judge
	Red-Team Eval	promptfoo — public attack datasets (Pliny, BeaverTails, HarmBench) + encoding strategies (base64, rot13, leetspeak, morse, pig latin)	Active (offensive)	Dataset eval, ASR per plugin, local judge
Vulnerability Scanning	Vulnerability Scanning	Nuclei (9,000+ templates + DAST + custom template upload)	Active	Parallel with GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)
GraphQL Security	GraphQL Security Testing	Endpoint discovery, introspection test, schema extraction, sensitive-field detection, graphql-cop (12 misconfig checks: alias/batch/directive DoS, GraphiQL, trace mode, GET/POST CSRF, field suggestions)	Active / Passive	Parallel with Nuclei + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)
Subdomain Takeover	Subdomain Takeover Detection	Subjack (Apache-2.0 DNS-first fingerprints) + Nuclei takeover templates (`http/takeovers/` + `dns/`) + BadDNS (AGPL-3.0 isolated sidecar: CNAME, NS, MX, TXT, SPF, DMARC, wildcard, NSEC, references, zonetransfer). Cross-tool dedup, 12+ auto-exploitable providers, confidence-scored `confirmed` / `likely` / `manual_review` verdicts	Active / Passive	Parallel with Nuclei + GraphQL Scan + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)
VHost & SNI Enumeration	Hidden Virtual Host Discovery	Curl-only dual-layer probing: L7 Host-header overrides + L4 TLS SNI swaps via `--resolve`, baseline-comparison anomaly detection, 4-tier severity ladder (`high` for L7/L4 routing inconsistency, `medium` for internal-keyword matches, `low`/`info` for status/size deltas), 2,471-entry default wordlist + custom + graph-derived candidates, discovery feedback loop into httpx	Active	Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)
Web Cache Poisoning	Web Cache Poisoning & Deception	Two-engine detection: WCVS (Hackmanit, Docker-in-Docker) breadth sweep across 10+ technique classes (unkeyed-header poisoning, parameter cloaking, path/cache-key normalization, cache-key injection, web cache deception) then a RedAmon-native 5-phase confirmation (cache oracle with silent-cache frozen-Date fallback, isolated cache-buster, fingerprint-gated framework packs for Next.js/Nuxt/Remix, baseline→poison→clean persistence check, verified against a never-poisoned control slot and reproduced on fresh slots, reflected + non-reflective differential detection). Confidence-scored `Confirmed`/`Strong`/`Tentative` tiers, min-confidence gate; benign `.invalid` canaries + isolated cache buckets so the real cache is never poisoned. Disabled by default	Active	Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Origin Discovery (GROUP 6 Phase A)
Origin Discovery	Origin-IP Discovery (CDN/WAF unmasking)	Finds the real origin server hidden behind a CDN/WAF by pivoting on the fingerprints the origin leaks: 44 non-CDN subdomain names, SPF/MX record IPs, crt.sh SANs, the favicon hash (mmh3), internet-wide scanners (Shodan/Censys/FOFA/ZoomEye/OTX/VirusTotal), and passive-DNS history (SecurityTrails/ViewDNS). It then confirms each candidate by fetching it directly and with a forged `Host:` header, scoring HTML 60% + TLS cert 25% + headers 15% (± status) against the fronted site. Fail-closed SSRF / CDN-range / current-resolution / RoE filters before any probe; per-scan keyed-search budget; per-target cache; never-raise; converges with the WAF-bypass finding via a tenant-scoped id. Disabled by default	Active / Passive	Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning (GROUP 6 Phase A)
Security Checks	Security Checks	WAF bypass, direct IP access, TLS expiry, missing headers, cache-control	Active	Parallel workers
CVE & MITRE	CVE Enrichment	NVD API, Vulners API	Passive	Sequential
	MITRE Enrichment	CWE / CAPEC mapping	Passive	Sequential

*Amass can run in active mode when configured. Knockpy performs active DNS probing.

Partial Recon

Run any single tool from the pipeline independently without re-running the entire scan. Up to 12 partial recons can run in parallel per project, each with independent logs, stop controls, and status badges visible in both the Graph toolbar and Project Settings header. Each tool section has a play button that opens a modal where you can review existing graph data, add custom targets (subdomains, IPs, ports, or URLs), and launch the tool in isolation. Results are merged back into the Neo4j graph using MERGE operations -- duplicates are updated, not recreated. The tool runs with all project settings (timeouts, wordlists, API keys, proxy) applied automatically. All pipeline tools support partial recon.

Wiki: Recon Pipeline Workflow -- Partial Recon

AI in Pipeline

Optional LLM-augmented decision points wired inside the recon pipeline where static look-ups historically drift -- Nuclei prunes its tag list to the detected tech stack, the WAF classifier catches header-stripped Cloudflare/AWS WAF/Imperva, and many others across FFuf, Nuclei false-positive filtering, and subdomain-takeover disambiguation. Each hook is a cascade fallback after the static path with a deterministic safe fallback, so an LLM outage cannot break a scan. One master toggle in the Target tab governs them all.

The recon pipeline uses TypeSafe Jev, a typed decision model, for nine decisions: what kind of page each URL is, which host Hakrawler crawls first, which directories and extensions FFuf fuzzes, whether a tool failed or just found nothing, which Nuclei tags to run, whether a WAF is in front, whether a takeover is real, and which serialization format a flagged blob is. Jev needs a token on the project owner's account; see how it works in the Jev Meets the Recon Pipeline walkthrough on redamon.org.

Wiki: TypeSafe Jev

Wiki: AI in Pipeline

AI Gauntlet: Offensive AI/LLM Testing

Where the recon pipeline finds the AI surface, the AI Gauntlet attacks it. Pick the discovered LLM endpoints (or type a custom URL), choose a tool, confirm the Rules of Engagement, and launch: a short-lived container runs the target through four industry red-team tools -- garak (broad single-shot scanner, 40 probe families), PyRIT (bounded multi-turn jailbreaks), Giskard (LLM-assisted safety scan), and promptfoo (dataset red-team eval) -- measuring an Attack Success Rate per attack and writing the confirmed weaknesses back onto the graph as OWASP-LLM / MITRE-ATLAS-mapped Vulnerability findings with evidence transcripts.

It is deterministic (seeds, fixed bounds, pinned tool versions) and runs with zero external egress: every judge / grader / embedding call is forced to a local Ollama model, so no payload or transcript ever leaves your machine. Off by default and RoE-gated, with live phase-by-phase progress, and findings surfaced in the Red Zone AI Gauntlet Vulnerabilities table and the pentest report.

Wiki: AI Gauntlet | Technical: AI_GAUNTLET_TECH_DOC.md

GVM Vulnerability Scanner

GVM/OpenVAS performs deep network-level vulnerability assessment with 170,000+ NVTs, probing services at the protocol layer for misconfigurations, outdated software, default credentials, and known CVEs. Complements Nuclei's web-layer findings. Seven pre-configured scan profiles from quick host discovery (~2 min) to exhaustive deep scanning (~8 hours). Findings are stored as Vulnerability nodes in Neo4j alongside the recon graph.

Wiki: GVM Vulnerability Scanning | Technical: README.GVM.md

AI Agent Orchestrator

A LangGraph-based autonomous agent implementing the ReAct pattern. It progresses through three phases: Informational (intelligence gathering, graph queries, Shodan, Google dorking), Exploitation (Metasploit, Hydra credential testing, social engineering simulation), and Post-Exploitation (enumeration, lateral movement). The agent executes 14 security tools via MCP servers inside a Kali sandbox, supports parallel tool execution via Wave Runner, and provides real-time chat interaction with guidance, stop/resume, and approval workflows. Deep Think mode enables structured strategic analysis before acting.

Wiki: AI Agent Guide | Technical: README.AGENTIC_SYSTEM.md

Agent Tool Arsenal

Category	Tool	Description	Phases	MCP Server
Intelligence	query_graph	Neo4j graph queries -- primary source of truth for recon data	All	--
	web_search	Internet search via Tavily for CVE details, exploit PoCs, advisories	All	--
	cve_intel	ProjectDiscovery `vulnx` -- structured CVE intelligence aggregating NVD + CISA KEV + EPSS + HackerOne + GitHub PoCs + Nuclei template availability. 69 lucene-filterable fields. Optional PDCP key (per-user, anonymous mode = 10 req/min)	All	network_recon :8000
	tradecraft_lookup	User-curated catalog of trusted security knowledge URLs (HackTricks, PayloadsAllTheThings, CVE PoC repos, vendor blogs) -- 6 auto-detected resource types, sitemap-driven section pick, sqlite+disk cache	Exploit, Post	--
	shodan	Shodan OSINT -- host details, reverse DNS, device search	Info, Exploit	--
	google_dork	Google dorking via SerpAPI -- exposed files, admin panels, directory listings	Info	--
Recon & OSINT	execute_subfinder	Passive subdomain enumeration via OSINT (CT logs, DNS datasets). No traffic to target	Info, Exploit	network_recon :8000
	execute_gau	Passive URL discovery from Wayback Machine, Common Crawl, AlienVault OTX, URLScan. No traffic to target	Info, Exploit	network_recon :8000
	execute_amass	OWASP Amass subdomain enumeration and network mapping (passive + active, ASN intel)	Info, Exploit	network_recon :8000
Scanning	execute_naabu	Fast port scanning and verification	Info, Exploit	network_recon :8000
	execute_nmap	Deep service detection (-sV), OS fingerprint, NSE scripts	All	nmap :8004
	execute_nuclei	CVE verification and exploitation with 9,000+ templates + custom uploads	Info, Exploit	nuclei :8002
	execute_httpx	HTTP probing and fingerprinting -- status codes, titles, server headers, tech detection	Info, Exploit	network_recon :8000
	execute_wpscan	WordPress vulnerability scanner -- detects vulnerable plugins, themes, users, misconfigurations	Info, Exploit	network_recon :8000
Web & HTTP	execute_curl	HTTP requests -- reachability, headers, status codes, banners	All	network_recon :8000
	execute_katana	Web crawling and endpoint discovery with JS parsing and known-file enumeration	Info, Exploit	network_recon :8000
	execute_jsluice	JavaScript static analysis for hidden API endpoints, URL paths, and secrets	Info, Exploit	network_recon :8000
	execute_arjun	HTTP parameter discovery by brute-forcing ~25,000 common parameter names	Info, Exploit	network_recon :8000
	execute_ffuf	Web fuzzing for hidden directories, files, virtual hosts, and parameters	Info, Exploit	network_recon :8000
	execute_playwright	Headless Chromium browser automation -- JS-rendered content extraction and interactive scripting for SPAs, form testing, XSS verification	All	playwright :8005
Exploitation	metasploit_console	Persistent msfconsole -- exploit execution, session management, post-exploitation	Exploit, Post	metasploit :8003
	msf_restart	Full Metasploit reset -- kills all sessions, clears module state	Exploit, Post	metasploit :8003
	execute_hydra	THC Hydra brute force -- 50+ protocols (SSH, FTP, RDP, SMB, HTTP, MySQL, etc.)	Exploit, Post	network_recon :8000
Code Execution	kali_shell	Full Kali Linux shell -- nikto, whatweb, testssl, commix, smuggler, h2csmuggler, sstimap, tplmap, ysoserial, phpggc, ruby, viewgen, dnsrecon, dnsx, subzy, enum4linux-ng, netexec, kerbrute, bloodhound-python, bhgraph, certipy-ad, bloodyAD, jwt_tool, graphql-cop, graphqlmap, clairvoyance, betterleaks, semgrep, hashcat, john, cewl, paramspider, Node.js + npm, Python libs (websockets, zeep, python3-saml, boto3, msal, azure-identity, google-auth, google-cloud-storage), pre-staged post-exploit toolkits at /opt/tools/{linux,windows}/ (linpeas, LinEnum, pspy64, deepce, winPEAS, PowerUp, PrivescCheck), and 70+ CLI tools	All	network_recon :8000
	execute_code	Write and run code files (Python, bash, Ruby, Perl, C, C++) -- no shell escaping	Exploit, Post	network_recon :8000
Supply Chain	execute_osv_scanner	Offline OSV verdict -- is a package known-malicious (`MAL-`) or known-vulnerable (`CVE`/`GHSA`)? Passive, zero network (reads the local OSV DB). Accepts a purl, lockfile, or SBOM	All	network_recon :8000
	execute_guarddog	Behavioural malware analysis of one package (install hooks, obfuscation, exfil, typosquat). Downloads the tarball, so it dispatches to the hardened analyzer sandbox -- never unpacked inline	Info, Exploit	network_recon :8000
Traffic (TrafficMind)	proxy_brain	DANGEROUS -- web hacking in code: it writes Python against a pre-imported `redamon` SDK to work the captured HTTP corpus (`search` / `get` / `sitemap` / `params` / `grep` / `diff` / `to_curl` / `query` reads, `decode` / `jwt().forge()` crypto, `replay` / `batch(parallel)` / `fuzz` active sends, and `browser(id)` to drive a real Chromium for DOM-based XSS / SPA / post-JS bugs). Reads run in any phase; active sends and the browser are host-pinned to the origin, tenant-scoped by a signed tag, exploitation-gated, budgeted, and re-captured. The agent reads its own on-demand cookbook via `redamon.manual()`. Replaces the former ten `proxy_*` tools	All (send: Exploit, Post)	network_recon :8000
Workspace FS	fs_read	Read workspace file with line numbers, auto-detects binary, stores snapshot for `fs_diff vs_last_read`	All	-- (in-process)
	fs_read_many	Batched read of multiple files, capped at `max_total_bytes` (default 200 KB)	All	-- (in-process)
	fs_stat	Metadata only -- size, mtime, mode, type, optional SHA-256	All	-- (in-process)
	fs_write	Atomic create/overwrite/append, auto-creates parents	All	-- (in-process)
	fs_edit	Exact-string replacement with uniqueness check, records undo entry	All	-- (in-process)
	fs_multi_edit	Multiple ordered edits in one call, all-or-nothing transaction	All	-- (in-process)
	fs_undo_edit	Roll back last `fs_edit` / `fs_multi_edit`, per-file undo stack capped at 20	All	-- (in-process)
	fs_delete	Delete file or directory (recursive flag required for dirs)	All	-- (in-process)
	fs_move	Move or rename a path, auto-creates destination parents	All	-- (in-process)
	fs_copy	Copy file or directory tree, permissions normalized so host user can edit	All	-- (in-process)
	fs_mkdir	Create directory, idempotent	All	-- (in-process)
	fs_chmod	Change permission bits (octal `0o755` or symbolic `+x`)	All	-- (in-process)
	fs_symlink_create	Create symlink, refuses endpoints that would escape the workspace	All	-- (in-process)
	fs_grep	Ripgrep over workspace with regex, 30s timeout, 1000-match cap, works on in-flight job logs	All	-- (in-process)
	fs_glob	Glob pattern search sorted newest-first, capped 500 results	All	-- (in-process)
	fs_find	Metadata search (name + mtime + size + type filters), 30s walk timeout, 5000-result ceiling	All	-- (in-process)
	fs_list	Single-directory listing with type / size / mtime, capped 200 entries	All	-- (in-process)
	fs_tree	Depth-limited ASCII tree, skips `.git`, `node_modules`, `__pycache__`	All	-- (in-process)
	fs_symbols	Tree-sitter AST outline (function / class / method names + line ranges), 15 languages (py, js, ts, tsx, jsx, java, go, rs, rb, php, c, cpp, cs, kt, swift, scala)	All	-- (in-process)
	fs_symlink_read	Resolve symlink to its raw target without following it	All	-- (in-process)
	fs_hash	SHA-256 or MD5 hash of a file, streams in 64 KB chunks	All	-- (in-process)
	fs_diff	Unified diff between two files, or between a file and its last `fs_read` snapshot (detects concurrent writes in fireteam)	All	-- (in-process)
	fs_extract	Safe extraction of tar / zip / gz archives, rejects zip-slip and tar-slip paths	All	-- (in-process)
	fs_archive	Bundle workspace paths into tar.gz or zip for one-click operator download	All	-- (in-process)
Background Jobs	job_spawn	Detach tool call as asyncio background task, output tee'd to `jobs/<id>.log` in real-time, phase / RoE checks at spawn	All	-- (in-process)
	job_status	Non-blocking status query -- current status, log size, last 40 lines of output, survives agent restart via `<id>.meta.json`	All	-- (in-process)
	job_wait	Block up to N seconds for the job to finish, returns same shape as `job_status`	All	-- (in-process)
	job_cancel	Cancel a running job, status flips to `cancelled`, no-op on terminal jobs	All	-- (in-process)
	job_list	List background jobs for the project, filter by `active=true` / `false` / omit for all	All	-- (in-process)

All MCP tools run inside a Kali Linux sandbox container. Workspace FS and Background Jobs tools run in-process inside the agent container and operate exclusively on the per-project workspace at /workspace/<projectId>/ -- path validation rejects every traversal trick (project-id injection, symlink escape, zip-slip, tar-slip). See Agent Workspace wiki page for the full reference. Tools marked as dangerous require manual confirmation before execution. Stealth mode restricts active tools to passive-only or single-target operations. Note: WPScan is licensed under the WPScan Public Source License (not MIT). Free for pentesting assessments and personal use; commercial use may require a separate license from wpscan.com.

MCP Tool Plugins (extending the agent's tool arsenal)

Beyond the 5 built-in MCP servers above, you can plug any Model-Context-Protocol server into the agent as a tool plugin (Shodan, GitHub, Censys, Hugging Face, mitmproxy, your own internal MCPs) without editing code, rebuilding containers, or running migrations. Open Global Settings → MCP Tool Plugins.

Two paths: pick one of 39 prefilled Quick-Add presets (OSINT, threat-intel, cloud, web-app scanners, reporting, reverse engineering; categories tagged on every card), or click Add MCP for a manual config. Three transports supported: stdio, sse, streamable_http. The orange Discover and add new tools button runs a live list_tools() against the draft, returns within 30 seconds, and auto-imports each discovered tool with its name, description, and a JSON-Schema-derived args_format (types, enums, defaults, min/max, per-property descriptions). Save → tools auto-appear in every project's Tool Matrix and in the agent's system prompt within ~1 second. No agent restart, no prisma db push.

Full operator manual (every form field, all 39 presets, the auth flow, the live discovery workflow, validation rules, troubleshooting, and the storage / security model): MCP Tool Plugins wiki page.

MCP Server: Your Own Agent Connecting Into RedAmon

The mirror image of the plugins above. Instead of RedAmon's agent reaching out to tools, your agent connects in and drives RedAmon: your Claude Code session, an internal triage assistant, a nightly CI job, anything that speaks the Model Context Protocol. Mint an access token in Global Settings → MCP Server and it gets 48 tools behind 17 permissions: list projects, read scan status and settings, query the attack-surface graph in plain English or raw Cypher, read findings / suppressed findings / remediations, see why a finding ranks where it does and read its evidence, submit a quoted evidence review (RedAmon recomputes the score; the agent never sets one), record a triage verdict, start or stop a Priority Board run (spaced and capped per project), mute and unmute findings behind their own opt-in permission, run saved graph views, compare saved scan versions, get an attack-surface overview, exploit paths and blast radius, start / stop / queue a recon run, open an engagement, manage recon presets, and (off by default, behind three independent switches) run a command in the Kali sandbox.

The token acts as you, inside your own projects. It is re-checked on every call, so a revoke takes effect on the agent's next call rather than its next reconnect; every graph read is rewritten to match only your tenant's nodes and runs in a read-only Neo4j session; and every write is a positive allowlist. Deliberately not exposed: the agent chat, deleting projects, your API keys, re-pointing a project's target, the engagement record, Mute Rules, setting a finding's score directly, changing a verdict a person made in the app, and any graph write beyond verdicts, reviews, triage runs and (opt-in) mutes. MCP_SERVER_ENABLED is off after a normal install and refused over plain HTTP on a server deploy, and MCP_DISABLED_TOOLS withdraws a single misbehaving tool without taking the whole surface down.

Agent Onboarding (teaching your agent how to use RedAmon)

Connecting an agent tells it that the tools exist. It does not tell it what RedAmon is, what the recon pipeline produces, or which of the 48 tools to reach for first. Agent Onboarding writes those instructions for you. Pick one of 14 Agent Profiles (bug bounty, penetration testing, continuous attack-surface monitoring, vulnerability management, triage assistance, asset inventory / CMDB, compliance evidence, DevSecOps CI gating, reporting, M&A and third-party risk, threat-intel correlation, SOC enrichment, research and training, or custom) and RedAmon ticks the permissions that job needs and generates a pack tailored to it: a SKILL.md plus reference files covering the operating model, the graph's shape, the tool sequence for that job, the traps specific to it, and tool by tool exactly what this token can and cannot do. The tool facts are read from the server's own live tool list at export time, so a pack can never describe a tool differently from how the server serves it. Clients that never load a skill file (Cursor, Windsurf, Cline, Goose, Gemini CLI, Codex CLI) receive a shorter version of the same guidance inline the moment they connect.

No profile ever ticks kali:exec or recon:overwrite for you, not even the ones that recommend them: a shell on a target-facing box and an irreversible graph wipe should never arrive as the side effect of choosing an item from a dropdown.

Agent Skills teach RedAmon's agent. Agent Onboarding teaches yours.

Wiki: MCP Server | Wiki: MCP API Reference | Technical: README.MCP.SERVER.md

Agent Workspace: Per-Project Filesystem, Background Jobs, Auto-Offload

Watch the demo: RedAmon Agent Workspace: AI Runs 4 Parallel Pentests and Writes Its Own Report (YouTube)

Every project gets a persistent /workspace/<projectId>/ directory that the agent, the kali-sandbox, and you (through the FileSystem Drawer in the Red Zone) all see at the same time. Four purpose-built folders are auto-created and protected from rename/delete: notes/ for the agent's scratch work and draft reports, tool-outputs/ for auto-offloaded huge outputs, jobs/ for background-job logs, and uploads/ for files you drop in for the agent to read. The agent is taught the layout on every think step via a WORKSPACE_LAYOUT_BLOCK, and when you drop files into uploads/ the block surfaces them under a CHECK THESE NOW directive so the agent reads them before continuing whatever else it was doing.

The agent gets 24 filesystem tools (fs_read, fs_write, fs_edit, fs_multi_edit, fs_undo_edit, fs_grep, fs_glob, fs_find, fs_diff, fs_symbols, fs_archive, fs_extract, and more) plus 5 background-job tools (job_spawn, job_status, job_wait, job_cancel, job_list). Long scans like nuclei or hydra detach as asyncio tasks and stream output to jobs/<id>.log, so the agent can fs_grep for hits mid-flight without blocking the next reasoning step. Outputs over 20 KB automatically offload to tool-outputs/<utc-iso>-<tool>.txt and the LLM receives a head/tail stub plus the file path, so a 5 MB Playwright DOM dump never derails the context window. The drawer surfaces all of this with breadcrumb navigation, drag-and-drop upload, inline preview, SHA-256 properties, per-folder tar.gz download, and a Jobs tab with live status badges and cancel.

Path validation rejects every traversal trick (project-id injection, symlink escape, zip-slip, tar-slip, protected-folder bypass via normalization) and is server-enforced. Jobs survive agent restart via on-disk metadata: orphan running jobs flip to interrupted on boot so the UI never shows a forever-spinning row.

Full operator manual (every drawer feature, all 29 workspace tools, the auto-offload policy map, the four protected folders, fireteam coordination patterns via fs_diff vs_last_read, and the path-validation safety model): Agent Workspace wiki page.

Fireteam: Parallel Specialist Sub-Agents

The agent's most powerful execution mode. When an objective decomposes into independent investigation angles (auth surface, route map, header policy; or 5 candidate CVEs to triage in parallel), the root agent fans out into N specialist sub-agents that work concurrently inside the same backend, each running its own multi-step ReAct loop with a focused mission. This is RedAmon's implementation of the Scatter-Gather ReAct (SG-ReAct) architectural pattern: a root agent that decides when to fan out, a bounded fireteam of specialists that work in parallel, and a fan-in step that merges their findings back into a single consolidated worldview.

Every safety guarantee that applies to the root agent also applies to every member: hard guardrails, soft guardrails, phase gating, Rules of Engagement, and dangerous-tool confirmations (handled per-member, in parallel; N members can each be awaiting your approval on their own panel simultaneously without serializing). Recursion is forbidden (a member cannot itself deploy a fireteam) and every wave has a hard cap on members, an iteration budget per member, and a wall-clock timeout. The result is wall-clock parallelism without coordination chaos, predictable termination, and an audit trail where every action is attributable to the specialist that produced it.

Wiki: Fireteam (Parallel Specialists) | Technical: README.AGENTIC_SYSTEM.md

AI Model Providers

Supports 5 providers and 400+ models: OpenAI (GPT-5.2, GPT-5, GPT-4.1), Anthropic (Claude Opus 4.6, Sonnet 4.5), OpenRouter (300+ models), AWS Bedrock, and any OpenAI-compatible endpoint (Ollama, vLLM, LM Studio, Groq, etc.). Models are dynamically fetched, no hardcoded lists.

OpenAI-compatible provider settings include a reasoning effort control. Enable it to send reasoning_effort with low, medium, high, or max; leave it disabled to send nothing and use the model's default. Enable it only for thinking-capable models: a model without the thinking capability rejects a level, and the agent transparently retries without it. The available effort levels are model-dependent. Canonical OpenAI providers and unrelated OpenAI-compatible endpoints keep their existing behavior.

Wiki: AI Model Providers

Attack Surface Graph

A Neo4j knowledge graph with 19 node types and 20+ relationship types, the single source of truth for the target's attack surface. The agent queries it before every decision via natural language → Cypher translation.

Wiki: Attack Surface Graph | Technical: GRAPH.SCHEMA.md

EvoGraph: Attack Chain Evolution

A persistent, evolutionary graph tracking everything the AI agent does: tool executions, discoveries, failures, and strategic decisions. Structured chain context replaces flat execution traces, improving agent efficiency by 25%+. Cross-session memory means the agent never starts from zero.

Wiki: EvoGraph | Technical: README.AGENTIC_SYSTEM.md

Multi-Session Parallel Attack Chains

Launch multiple concurrent agent sessions against the same project. Each session creates its own AttackChain in EvoGraph. New sessions automatically load findings and failure lessons from all prior sessions, avoiding redundant work.

Wiki: AI Agent Guide

TrafficMind: HTTP Traffic Capture

RedAmon's built-in, engagement-scoped proxy history: a credential-free man-in-the-middle proxy (powered by mitmproxy) sits between every offensive tool and its target, records the full request/response of each HTTP transaction, tags it with who produced it (project / user / run / tool via a signed HMAC context tag), and stores it in Postgres through a trusted, INSERT-only ingest worker. Think of an always-on HTTP history, except it turns on with a toggle, attributes every request to its source, and is queryable by the operator and the AI agent.

Capture is off by default and gated at two levels (a global master switch that runs the proxy, plus a per-project routing toggle). Eight recon tools and eight agent HTTP tools (execute_curl, execute_httpx, execute_playwright, execute_nuclei, execute_katana, execute_ffuf, execute_arjun, execute_wpscan) are routed, so both the pipeline's and the agent's own crawl/fuzz/scan traffic is captured, searchable, and replayable. The proxy holds no secrets, an SSRF egress guard with a DNS-rebinding IP pin keeps it from pivoting into internal infrastructure, sensitive headers are redacted, and passive signals (reflected params, missing security headers, cookie-flag issues) are computed for free on every response. A TrafficMind view in the top navigation exposes the corpus as a paginated, filterable, proxy-style table with a request/response detail drawer, CSV/JSON export, and reference-counted body cleanup.

The agent works the corpus through a single code-native tool, proxy_brain: it writes Python against a pre-imported redamon SDK and composes the attack itself (loops, conditionals, crypto, oracles) rather than picking from a fixed menu. The SDK's read calls (search, get, sitemap, params, grep, diff, to_curl, query) run in any phase; its active calls (replay, batch, fuzz) send live traffic and are gated to the exploitation phases, as is browser(id), which drives a real Chromium to confirm bugs that only surface after JavaScript runs (DOM-based XSS, SPA-only routes, JS-minted CSRF). proxy_brain runs in the Kali sandbox but holds no database credential: it reaches the corpus only through the agent's /traffic/exec (read), /traffic/replay (active) and /traffic/browser (browser) endpoints, tenant-scoped by a signed tag the sandbox cannot forge, host-pinned to the origin on every send, budget-capped, stealth-restricted, and re-captured. The agent reads its own on-demand cookbook with redamon.manual(). See docs/readmes/README.TRAFFIC.md for the architecture.

**[Wiki:

Resource

Without OpenVAS

With OpenVAS (full stack)

CPU

2 cores

4 cores

RAM

4 GB

8 GB (16 GB recommended)

Disk

80 GB free

110 GB free

git clone https://github.com/samugit83/redamon.git cd redamon # Without GVM (lighter, faster startup): ./redamon.sh install # With GVM / OpenVAS (full stack, ~30 min first run): ./redamon.sh install --gvm

Command

Description

./redamon.sh install

Build + start lightweight (no GVM, no Knowledge Base, Tavily-only web search)

./redamon.sh install --kbase

Build + start with the local Knowledge Base (~4.4 GB heavier)

./redamon.sh install --gvm

Build + start with GVM/OpenVAS

Command

Description

./redamon.sh update

Pull latest version, smart-rebuild only changed services (preserves your install-time GVM/KB choice)

./redamon.sh up

Start services (auto-detects GVM and KB mode from install)

./redamon.sh up dev

Start in dev mode with hot-reload (auto-detects GVM and KB mode)

./redamon.sh down

Stop services (preserves data)

./redamon.sh status

Show running services, version, GVM mode, KB state, plugin platform state (and why it cannot run on this host, when it cannot)

./redamon.sh clean

Remove containers + images, keep data

./redamon.sh create-admin

Create the admin login (or reset it) -- use if no prompt appeared at install

./redamon.sh reset-password

Reset an existing user's password from the terminal

./redamon.sh supply-chain-sync [ecosystems]

Populate the offline OSV database for the supply-chain feature (default: npm; e.g. npm PyPI Go)

./redamon.sh purge

Remove everything including all data

cd tooling/deploy/single-host cp .env.example .env # set HOST_IP, DOMAIN, SSH_KEY_PATH, OPERATOR_ALLOW_CIDRS, # LETSENCRYPT_EMAIL, ADMIN_* ... ./deploy.sh init # first build takes 30-60 min, then log in at https://<domain>/

What changed

Action needed

webapp/src/ (frontend code)

Nothing -- Next.js hot-reload handles it in dev mode

agentic/*.py (agent Python code)

docker compose build agent && docker compose up -d agent (source is baked into the image, so restart alone won't pick up .py changes)

recon_orchestrator/*.py

docker compose restart recon-orchestrator

mcp/servers/*.py (MCP servers)

docker compose restart kali-sandbox

agentic/Dockerfile or agentic/requirements.txt

docker compose build agent && docker compose up -d agent

recon_orchestrator/Dockerfile or its requirements.txt

docker compose build recon-orchestrator && docker compose up -d recon-orchestrator

mcp/kali-sandbox/Dockerfile

docker compose build kali-sandbox && docker compose up -d kali-sandbox

webapp/Dockerfile or webapp/package.json

docker compose build webapp && docker compose up -d webapp

recon/Dockerfile

docker compose --profile tools build recon

scanners/gvm_scan/Dockerfile

docker compose --profile tools build vuln-scanner

scanners/github_secret_hunt/Dockerfile

docker compose --profile tools build github-secret-hunter

scanners/trufflehog_scan/Dockerfile (Secret Multiscanner)

docker compose --profile tools build trufflehog-scanner

scanners/baddns_scan/Dockerfile or scanners/baddns_scan/entrypoint.sh

docker compose --profile tools build baddns-scanner

scanners/wcvs/Dockerfile (web cache poisoning engine)

docker compose --profile tools build wcvs

scanners/supply_chain_scan/Dockerfile (L1 scanner)

docker compose --profile tools build supply-chain

scanners/supply_chain_analyzer/ (DIRTY analyzer; entrypoint is baked)

docker compose --profile tools build supply-chain-analyzer

docker-compose.yml

docker compose up -d (re-creates affected containers)

prisma/schema.prisma

docker compose exec webapp npx prisma db push

docker compose ps # Check service status docker compose logs -f <service> # Follow logs for a service docker compose down # Stop all (preserves volumes) docker compose --profile tools down --rmi local # Remove built images docker compose --profile tools down --rmi local --volumes --remove-orphans # Full cleanup

docker system df # Show Docker disk usage (add -v for per-image breakdown) docker image prune -f # Remove dangling images (auto-run by `./redamon.sh install` and `update`) docker builder prune -f # Drop unused build cache (auto-run after every successful build; opt out with REDAMON_NO_AUTO_PRUNE=1) docker builder prune -af # Drop ALL build cache, including what the current images reuse -- frees no extra disk and makes the next rebuild cold docker container prune -f # Remove stopped containers

Variable

Default

Description

KB_EMBEDDING_USE_API

false

Set to true to use API-based embeddings instead of local model

KB_EMBEDDING_API_BASE_URL

(empty = OpenAI)

Any OpenAI-compatible endpoint (Ollama, vLLM, LiteLLM, Together AI, Azure)

KB_EMBEDDING_API_KEY

(empty)

API key for the embedding provider

KB_EMBEDDING_API_MODEL

text-embedding-3-small

Model name (provider-specific)

NVD_API_KEY

(empty)

Free NVD API key for 10x faster CVE ingestion

./redamon.sh kb build lite # Build with lite profile (~30-60s with API) ./redamon.sh kb build standard # Add NVD CVEs ./redamon.sh kb update nvd # Incremental NVD refresh ./redamon.sh kb stats # Show index statistics ./redamon.sh kb rebuild lite # Wipe and rebuild from scratch

Pillar

What it does

Reconnaissance Pipeline

A parallelized fan-out / fan-in scanning pipeline that maps your target's entire attack surface (starting from a single domain, IP addresses / CIDR ranges, or a Domain batch of many domains scanned in turn) from subdomain discovery (5 concurrent tools) through port scanning, Nmap service detection and NSE vulnerability scripts, HTTP probing, resource enumeration, and vulnerability detection. Independent modules run concurrently via ThreadPoolExecutor, graph DB updates happen in a background thread, and results are stored as a rich, queryable graph. Complemented by standalone GVM network scanning, GitHub secret hunting, and Secret Multiscanner deep secret scanning modules.

AI Agent Orchestrator

A LangGraph-based autonomous agent that reasons about the graph, selects security tools via MCP, transitions through informational / exploitation / post-exploitation phases, and can be steered in real-time via chat.

Attack Surface Graph

A Neo4j knowledge graph with 17 node types and 20+ relationship types that serves as the single source of truth for every finding, and the primary data source the AI agent queries before every decision.

EvoGraph

A persistent, evolutionary attack chain graph in Neo4j that tracks every step, finding, decision, and failure across the attack lifecycle, bridging the recon graph and enabling cross-session intelligence accumulation.

CypherFix

Automated vulnerability remediation pipeline: one triage run scores every finding from the graph with a fixed risk model, groups the ones that share a fix, has an LLM check the evidence behind each, and writes one fix item per group. A CodeFix agent then clones the target repository, implements a fix using a ReAct loop with 11 code tools, and opens a GitHub pull request.

Project Settings Engine

500+ per-project parameters (exposed through the webapp UI) that control every tool's behavior, from Naabu thread counts to Nuclei severity filters to agent approval gates.

Settings Tab

Phase

Tools

Type

Execution

Discovery & OSINT

Subdomain Discovery

crt.sh, HackerTarget, Subfinder, Amass, Knockpy

Passive*

5 tools parallel

Wildcard Filtering

Puredns

Active

Sequential

WHOIS + URLScan

python-whois, URLScan.io API

Passive

Parallel

DNS Resolution

dnspython

Passive

20 parallel workers

OSINT Enrichment

Shodan / InternetDB

Passive

Parallel with port scan

Uncover Expansion

ProjectDiscovery Uncover (13 engines: Shodan, Censys, FOFA, ZoomEye, Netlas, CriminalIP, Quake, Hunter, PublicWWW, HunterHow, Google, Onyphe, Driftnet)

Passive

Before port scan (GROUP 2b)

Threat Intel Enrichment

Censys, FOFA, OTX (AlienVault), Netlas, VirusTotal, ZoomEye, CriminalIP

Passive

7 tools parallel (GROUP 3b)

Port Scanning

Masscan, Naabu

Active / Passive

Both parallel (Naabu supports passive InternetDB mode)

Nmap Service Detection

Service Version Detection

Nmap (-sV, --script vuln)

Active

Sequential per target

Port Scanning

TLS Certificate Grab

tlsx: one handshake per open non-HTTP port (SMTPS 465, IMAPS 993, POP3S 995, LDAPS 636, FTPS 990, and any odd TLS port the port scan found), capturing issuer / SAN / validity / posture where httpx only reaches the five HTTPS ports it dials. In-scope SAN hostnames feed back as scan targets (apex-scoped, resolve-checked); optional JARM / JA3 fingerprints and TLS version / cipher enumeration

Active

After Nmap, before HTTP probing so discovered hostnames become probe targets (GROUP 3.6)

HTTP Probing

httpx

Active

Internal parallel

Tech Detection

Wappalyzer

Passive

Sequential (post-probe)

Banner Grabbing

Custom (Python sockets: SSH, FTP, SMTP, MySQL, etc.)

Active

Parallel workers

Resource Enum

Web Crawling

Katana, Hakrawler

Active

Parallel

Archive Discovery

GAU (Wayback, CommonCrawl, OTX)

Passive

Parallel with crawlers

Parameter Mining

ParamSpider (Wayback CDX)

Passive

Parallel with crawlers

JS Analysis

jsluice

Active

Sequential (post-crawl)

Directory Fuzzing

FFuf

Active

Sequential (post-jsluice)

Browser Crawling

ZAP Ajax Spider

Active

Sequential (post-FFuf), per-seed Docker containers in parallel

Parameter Discovery

Arjun

Active / Passive

Methods parallel (GET/POST/JSON/XML)

API Discovery

Kiterunner

Active

Sequential per wordlist

API Specification Import

OpenAPI / Swagger (declared endpoints, never called)

Active (documents only)

Sequential (after the other sources)

Endpoint AI Classifier

Path + parameter classifier — tags Endpoint.ai_interface_type (llm-chat, llm-completion, llm-embedding, llm-tool-call, sse-stream, mcp, llm-graphql), is_ai_rag_ingest, Parameter.is_ai_prompt_injectable against catalogued AI signatures

Passive

Sequential (post-crawl)

JS Recon

JS Secret Detection

100 regex patterns + custom uploads

Passive

Parallel per file

Key Validation

21 service validators (AWS, GitHub, Stripe, etc.)

Active

Rate-limited (1/sec/svc)

Source Map Discovery

Comment, header, path probing

Active

Per JS file

Dependency Confusion

npm registry check

Passive

Per scoped package

Endpoint Extraction

REST, GraphQL, WebSocket, router patterns

Passive

Per JS file

Framework Fingerprinting

12 built-in + custom signatures

Passive

Per JS file

DOM Sink Detection

17 XSS/prototype pollution patterns

Passive

Per JS file

Serialized Object Scan

Serialized-Object Detection

Passive, in-memory detection of insecure-deserialization sinks across every major family (native Java rO0/aced, Jackson/FastJSON/XMLDecoder/XStream/SnakeYAML/Hessian, PHP O:/a: + PHAR, Python pickle, .NET BinaryFormatter + ASP.NET ViewState, Ruby Marshal) in response headers, Set-Cookie, enumerated parameters and crawled form fields; bomb-safe decode-and-recurse normalizer that never deserializes. Writes info-severity :Vulnerability candidates (needs_agent_confirmation) that the Insecure Deserialization agent skill then confirms with a non-destructive OOB oracle. Disabled by default

Passive

GROUP 5b (beside JS Recon)

Supply Chain Recon

Malicious Package Detection

Black-box harvest of the npm package set the target serves (source-map node_modules mining + import/require + Wappalyzer technologies), synthesized into a CycloneDX SBOM and verdicted against the offline OSV database. Writes Package + MalPackageFinding nodes, anchored to BaseURL via DEPENDS_ON. No new fetches (parses JS-recon output)

Passive (offline)

Post-JS-recon (GROUP 5.5)

AI Surface Recon

AI/LLM/MCP/Vector-DB Fingerprinting

Active confirmation of the surfaces the classifier flagged — chat-shape probes (dialect/streaming/latency), MCP handshake + tools/list + Cisco YARA tool-poisoning scan, OpenAPI/model-listing discovery, Julius YAML probe-pack engine, vector-DB confirmation reads (qdrant/chroma/weaviate/milvus). Writes Endpoint.ai_* / ai_mcp_*, Parameter.is_ai_prompt_injectable, confirmed Technology(ai-*), and MCP tool-poisoning Vulnerability nodes

Active (benign, no LLM calls)

Hosts parallel, workloads sequential (GROUP 5c / Phase 4.5)

AI Gauntlet

Broad LLM Scan

garak — 40 probe families (prompt injection, DAN jailbreaks, encoding bypass, data-leak replay, system-prompt extraction, toxicity, malware / exploit generation, package hallucination)

Active (offensive)

Offensive follow-up to recon; one-shot per probe, ASR per family, local-judge graded

Multi-Turn Jailbreaks

PyRIT — bounded conversational attacks (crescendo, skeleton-key, TAP, many-shot)

Active (offensive)

Multi-turn escalation, local attacker / judge model

Quality + Safety Scan

Giskard — app-tailored detectors (prompt injection, information disclosure, hallucination, harmfulness, stereotypes, sycophancy, output formatting)

Active (offensive)

Test set generated from the app purpose, local judge

Red-Team Eval

promptfoo — public attack datasets (Pliny, BeaverTails, HarmBench) + encoding strategies (base64, rot13, leetspeak, morse, pig latin)

Active (offensive)

Dataset eval, ASR per plugin, local judge

Vulnerability Scanning

Nuclei (9,000+ templates + DAST + custom template upload)

Active

Parallel with GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)

GraphQL Security

GraphQL Security Testing

Endpoint discovery, introspection test, schema extraction, sensitive-field detection, graphql-cop (12 misconfig checks: alias/batch/directive DoS, GraphiQL, trace mode, GET/POST CSRF, field suggestions)

Active / Passive

Parallel with Nuclei + Subdomain Takeover + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)

Subdomain Takeover

Subdomain Takeover Detection

Subjack (Apache-2.0 DNS-first fingerprints) + Nuclei takeover templates (http/takeovers/ + dns/) + BadDNS (AGPL-3.0 isolated sidecar: CNAME, NS, MX, TXT, SPF, DMARC, wildcard, NSEC, references, zonetransfer). Cross-tool dedup, 12+ auto-exploitable providers, confidence-scored confirmed / likely / manual_review verdicts

Active / Passive

Parallel with Nuclei + GraphQL Scan + VHost & SNI + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)

VHost & SNI Enumeration

Hidden Virtual Host Discovery

Curl-only dual-layer probing: L7 Host-header overrides + L4 TLS SNI swaps via --resolve, baseline-comparison anomaly detection, 4-tier severity ladder (high for L7/L4 routing inconsistency, medium for internal-keyword matches, low/info for status/size deltas), 2,471-entry default wordlist + custom + graph-derived candidates, discovery feedback loop into httpx

Active

Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + Web Cache Poisoning + Origin Discovery (GROUP 6 Phase A)

Web Cache Poisoning

Web Cache Poisoning & Deception

Two-engine detection: WCVS (Hackmanit, Docker-in-Docker) breadth sweep across 10+ technique classes (unkeyed-header poisoning, parameter cloaking, path/cache-key normalization, cache-key injection, web cache deception) then a RedAmon-native 5-phase confirmation (cache oracle with silent-cache frozen-Date fallback, isolated cache-buster, fingerprint-gated framework packs for Next.js/Nuxt/Remix, baseline→poison→clean persistence check, verified against a never-poisoned control slot and reproduced on fresh slots, reflected + non-reflective differential detection). Confidence-scored Confirmed/Strong/Tentative tiers, min-confidence gate; benign .invalid canaries + isolated cache buckets so the real cache is never poisoned. Disabled by default

Active

Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Origin Discovery (GROUP 6 Phase A)

Origin Discovery

Origin-IP Discovery (CDN/WAF unmasking)

Finds the real origin server hidden behind a CDN/WAF by pivoting on the fingerprints the origin leaks: 44 non-CDN subdomain names, SPF/MX record IPs, crt.sh SANs, the favicon hash (mmh3), internet-wide scanners (Shodan/Censys/FOFA/ZoomEye/OTX/VirusTotal), and passive-DNS history (SecurityTrails/ViewDNS). It then confirms each candidate by fetching it directly and with a forged Host: header, scoring HTML 60% + TLS cert 25% + headers 15% (± status) against the fronted site. Fail-closed SSRF / CDN-range / current-resolution / RoE filters before any probe; per-scan keyed-search budget; per-target cache; never-raise; converges with the WAF-bypass finding via a tenant-scoped id. Disabled by default

Active / Passive

Parallel with Nuclei + GraphQL Scan + Subdomain Takeover + VHost & SNI + Web Cache Poisoning (GROUP 6 Phase A)

Security Checks

WAF bypass, direct IP access, TLS expiry, missing headers, cache-control

Active

Parallel workers

CVE & MITRE

CVE Enrichment

NVD API, Vulners API

Passive

Sequential

MITRE Enrichment

CWE / CAPEC mapping

Passive

Sequential

Add this server

Host a copy with our keys and logs.

Server facts

About Redamon

Tools

Questions

How do I install Redamon?

Does Redamon need an API key?

What transport does Redamon use?

When was Redamon last checked?

Documentation

Roadmap & Community Contributions

Maintainers

Quick Start

Prerequisites

Minimum System Requirements

1. Clone & Install

2. Create Admin Account

3. Configure

4. Open the Webapp

Management Commands

Updating to a New Version

Deploy to a Server (Production)

Development Mode

When to Rebuild vs Restart

Knowledge Base (RAG-Enhanced Web Search)

Table of Contents

Overview

Built for Enterprise, Secure by Design

Security & Threat Model

Feature Highlights

Reconnaissance Pipeline

Recon Pipeline Tool Matrix

Partial Recon

AI in Pipeline

AI Gauntlet: Offensive AI/LLM Testing

GVM Vulnerability Scanner

AI Agent Orchestrator

Agent Tool Arsenal

MCP Tool Plugins (extending the agent's tool arsenal)

MCP Server: Your Own Agent Connecting Into RedAmon

Agent Onboarding (teaching your agent how to use RedAmon)

Agent Workspace: Per-Project Filesystem, Background Jobs, Auto-Offload

Fireteam: Parallel Specialist Sub-Agents

AI Model Providers

Attack Surface Graph

EvoGraph: Attack Chain Evolution

Multi-Session Parallel Attack Chains

TrafficMind: HTTP Traffic Capture

Add this server

Host a copy with our keys and logs.

Server facts

About Redamon

Tools

Questions

How do I install Redamon?

Does Redamon need an API key?

What transport does Redamon use?

When was Redamon last checked?

Documentation

Roadmap & Community Contributions

Maintainers

Quick Start

Prerequisites

Minimum System Requirements

1. Clone & Install

2. Create Admin Account

3. Configure

4. Open the Webapp

Management Commands

Updating to a New Version

Deploy to a Server (Production)

Development Mode

When to Rebuild vs Restart

Knowledge Base (RAG-Enhanced Web Search)

Table of Contents

Overview

Built for Enterprise, Secure by Design

Security & Threat Model

Feature Highlights