DarkMoon Autonomous Pentesting
Automates authorized penetration tests through controlled tool execution and a local privacy gateway.
- Source repo
- ASCIT31/Dark-Moon
- Stars
- ★ 1.2k
- Last updated
- 10d ago
- License
- GPL-3.0
- Primary language
- Python
- FA score
- 48/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- An authorized internal security team wants recurring infrastructure assessments with reviewable vulnerability evidence.
- Not a fit if
- Teams needing a web dashboard or auto-remediation, which are paid Pro only
- Environments that cannot run Docker and Docker Compose
- Users without authorization to define their own test scope
- Source review
- 48/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
DarkMoon is an open-source automated penetration-testing platform that orchestrates security assessments with AI security agents. A target enters through DarkmoonCLI; OpenCode performs reasoning and delegation, MCP Darkmoon controls execution, and Docker Toolbox runs security tools in isolated containers. The platform can dispatch specialized sub-agents for web stacks, Active Directory, Kubernetes, CMS targets, and headless-browser work based on discovered technologies, then produces structured audit reports with evidence. Its privacy gateway replaces IP addresses, hostnames, credentials, and internal paths with deterministic placeholders, rehydrates them locally immediately before tool execution, and masks them again in results. It fits authorized security teams seeking automated assessments within a self-hosted boundary, provided they can operate Docker and configure a cloud or local LLM path.
When you run ./darkmoon.sh "TARGET: example.com", DarkmoonCLI passes the target to OpenCode, which selects and delegates work to an AI Agent. The agent makes MCP Darkmoon function calls; MCP governs the action and sends the command to Docker Toolbox, then returns structured tool output for the next decision. The documented flow discovers ports, services, and protocols; fingerprints technologies; models the attack surface; dispatches sub-agents; scans and adaptively validates findings; and generates a structured audit report with request, payload, and response evidence. Example toolbox components include Naabu, Masscan, Nuclei, ffuf, sqlmap, NetExec, BloodHound, kubectl, Kubescape, and Lightpanda.
- An authorized internal security team wants recurring infrastructure assessments with reviewable vulnerability evidence.
- A DevSecOps team wants to run automated security testing after a build and identify critical issues before production.
- An authorized Active Directory assessor needs a workflow that can use NetExec, BloodHound, and Impacket tooling.
- A Kubernetes security practitioner needs to include kubectl, Kubescape, and Kubeletctl in an assessment workflow.
- A permitted bug-bounty researcher wants to narrow an assessment with scope instructions such as
FOCUS=sqli,xss,idor. - A training team needs reproducible web, network, or directory-service assessment exercises.
How do you install or deploy this agent?
Prerequisites: Docker, Docker Compose, and either an LLM API key (OpenRouter, Anthropic, OpenAI, and others) or a local model. Run:
git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh --initConfigure a cloud or local model interactively, then run ./install.sh to build and launch the full stack.
How do you use this agent?
For a first assessment, run:
./darkmoon.sh "TARGET: example.com"Monitor it with:
./darkmoon.sh --log <session_id>The documented scoped example is:
./darkmoon.sh "TARGET: http://172.19.0.3:3000 PROGRAM=\"Juice Shop\" FOCUS=sqli,xss,idor NOISE=moderate FORMAT=h1"The README also documents EXCLUDE, CREDS, TOKEN, SEVERITY, and FORMAT as scope-related flags.
What are this agent's strengths and limitations?
- Uses a separated OpenCode → MCP Darkmoon → Docker Toolbox execution path, so the model does not directly execute system tools.
- Its privacy gateway applies reversible local deterministic placeholders to sensitive values and masks them again in tool results.
- Dynamically dispatches CMS, application-stack, GraphQL, Active Directory, Kubernetes, and headless-browser sub-agents based on discovered technology.
- Bundles more than 50 security tools in Docker Toolbox and documents evidence-based structured reporting.
- Deployment requires Docker and Docker Compose, and the installation flow builds and launches a full container stack.
- It requires either an LLM API key or a local model runtime; cloud configuration introduces a provider dependency.
- Because it executes real offensive-security operations, adopters must ensure target authorization and correct scope themselves.
- The supplied material does not document report export formats, CI/CD integration mechanics, access controls, or recovery behavior after failures.
How does this agent compare with similar options?
Against traditional manual penetration testing, DarkMoon is positioned to automate discovery, agent dispatch, validation, and reporting; the README also states that it is not intended to replace the pentester.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| DarkMoon Autonomous Pentesting This agent | 48 · Major gaps | CLIFree + model costs | ★ 1.2k | 10d ago | Python | OpenAI API · Claude API |
| PentestCode | 55 · Major gaps | CLIFree + model costs | ★ 930 | 1d ago | TypeScript | OpenAI API · Claude API |
| PentesterFlow | 73 · Some gaps | CLIFree + model costs | ★ 1.4k | 2mo ago | TypeScript | OpenAI API |
| PentestAgent | 50 · Major gaps | CLIFree + model costs | ★ 3.2k | 11d ago | Python | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: architecture isolates AI from tool execution via MCP gateway, tests prove sensitive values are tokenized, commands rehydrated locally, output sanitized, exfiltration blocked. But user confirmation mechanism only mentioned authorization, not detailed; dependency security not mentioned; rollback not mentioned; publisher identity unverified. Thus, least privilege, data flow transparency, sensitive data handling score 2; user confirmation, external effects, source attribution score 1; dependency security, rollback score 0.
Evidence shows: README and test files consistent, architecture description clear, tests cover privacy gateway. But dependency availability not verified, failure messages not detailed. Thus, self-consistency scores 2; dependency availability, failure messages score 1.
Evidence shows: targets security teams, DevSecOps, bug bounty hunters, supports multiple scenarios, capability boundaries clear (e.g., credential-related agents require authorization), triggers based on technology detection, environment fit supports Docker and local LLM. Thus, each scores 2.
Evidence shows: README structure clear, install notes detailed, examples abundant, license GPL-3.0. But naming stability not mentioned, known limitations not explicit, versioning changelog missing, maintenance responsibility only via contributing guide. Thus, information architecture, install notes, examples/FAQ score 2; naming stability, known limitations, maintenance responsibility score 1; license scores 3; versioning changelog scores 0.
Evidence shows: output is structured report with evidence, marginal value high (automated pentesting), but cost-benefit not quantified. Thus, output usability, marginal value score 2; cost-benefit scores 1.
Evidence shows: benchmark claims 57 vulns but no reproduction details; external media mentions exist but no independent verification; facts and inferences not clearly separated. Thus, each scores 1.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Publisher identity unverified; assess supply chain risk carefully.
- Dependency security not mentioned; check for vulnerable dependencies.
- Rollback mechanism absent; consider failure recovery.
- Benchmark claims 57 vulns but no reproduction details; verify independently.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.6.0 DarkMoon v1.6.0 — Signal-driven vulnerability scanning
Release notes excerpt
DarkMoon v1.6.0 — Signal-driven vulnerability scanning This release makes the open-source engine find the vulnerabilities a version string already proves, without the slow, blind scans that used to block a campaign. The sub-agents now dispatch nuclei / vulnx the way a human pentester would: only once a product and version are confirmed, scoped to that product, and bounded in time. 🎯 Targeted vuln sweep — generic, signal-driven, fast …View on GitHub ↗ -
v1.5.0 DarkMoon v1.5.0 — DarkMoon everywhere
Release notes excerpt
DarkMoon v1.5.0 — DarkMoon everywhere This release brings DarkMoon into the tools you already build with, and sharpens the open-source engine. 🧩 DarkMoon everywhere — official integrations Run DarkMoon from your IDE, CI/CD, automation and SOC. Integrations marked OSS + Pro work with this open-source edition (local CLI + JSON); the rest consume the DarkMoon Pro REST API. | Platform | What it does | Get it | Edition | |---|---|---|---| …View on GitHub ↗ -
v1.4.0 Darkmoon v1.4.0 — LLM/AI endpoint pentest agent, privacy gateway hardening & garak toolbox
Release notes excerpt
This release adds a dedicated LLM / AI inference-endpoint pentest agent, closes several privacy-gateway leaks found during live engagements, and extends the toolbox with NVIDIA's garak LLM vulnerability scanner. Everything below was validated end to end — detection → dispatch → exploitation → report — with no regression to the existing agent roster. --- 🔒 Privacy gateway hardening …View on GitHub ↗
FAQ
Does the model receive my real IPs, hostnames, or credentials?
Is a cloud model mandatory?
How can I inspect what an assessment actually ran?
./darkmoon.sh --log <session_id>; the README says real-time session logs show commands executed by the MCP server.Can I constrain the test scope?
TARGET, FOCUS, EXCLUDE, CREDS, TOKEN, NOISE, SEVERITY, and FORMAT.