RedAmon: Autonomous AI Red Team Framework
An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation, then automatically triages findings, fixes code, and opens PRs.
- Source repo
- samugit83/redamon
- Stars
- ★ 3.2k
- Last updated
- today
- License
- MIT
- Primary language
- Python
- FA score
- 48/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Security teams conducting authorized penetration tests on internal applications, comprehensively mapping attack surface with minimal manual effort
- Not a fit if
- Teams that cannot run Docker or containerized environments
- Users with limited hardware: 4-8 GB RAM and 80+ GB disk required
- Source review
- 48/100 · Major gaps
What does this agent do, and when should you use it?
RedAmon is a modular, containerized penetration testing framework that integrates automated reconnaissance, AI-driven exploitation, and graph-powered intelligence into a single end-to-end offensive security pipeline. The pipeline starts with a 6-phase recon engine mapping the target's attack surface, then a LangGraph autonomous agent validates CVE exploitability, tests credential policies, and maps lateral movement paths. Every finding is recorded in a Neo4j knowledge graph, and CypherFix, an AI triage and remediation pipeline, correlates, deduplicates, and prioritizes findings, then clones the repository, implements fixes using 11 code tools, and opens a GitHub pull request. The entire framework runs in Docker containers, requiring no tool installation on the host, and is managed through a web UI. Security is paramount: the platform is STRIDE threat-modeled, fully container-isolated, multi-tenant, and offers a hardened single-host production deploy.
RedAmon performs end-to-end security assessments: it runs parallel reconnaissance across 40+ tools like subfinder, amass, naabu, nmap, and httpx to map subdomains, ports, services, and vulnerabilities. The autonomous agent executes 14 security tools via MCP servers, including Metasploit, Hydra, and nuclei, with real-time chat steering. Findings are stored in a Neo4j graph, and CypherFix triages and automatically fixes code, opening PRs. It also includes GVM/OpenVAS scanning, AI Gauntlet for offensive AI/LLM testing, TrafficMind for HTTP traffic capture and analysis. All operations are controlled through a web interface with multi-user, multi-project support, Rules-of-Engagement enforcement, and approval gates.
- Security teams conducting authorized penetration tests on internal applications, comprehensively mapping attack surface with minimal manual effort
- Red team members validating CVE exploitability and testing credential policies, leveraging parallel multi-agent execution to accelerate tasks
- Development teams integrating automated remediation into CI flows, turning security findings directly into code fixes and PRs
- Security researchers testing AI/LLM endpoints for vulnerabilities using the built-in AI Gauntlet with tools like garak
- Enterprise security operations performing continuous exposure monitoring, complemented by deep GVM vulnerability assessments
How do you install or deploy this agent?
Requirements: Docker and Docker Compose v2+. Clone the repository and run ./redamon.sh install (optionally add --gvm for OpenVAS, --kbase for local knowledge base). The script builds images and starts services, then prompts for admin account creation. Minimum system: 2 cores, 4 GB RAM, 80 GB free disk (without OpenVAS).
How do you use this agent?
After installation, open http://localhost:3000 to log in. In settings, add LLM providers (OpenAI, Anthropic, etc.) and API keys (Tavily, Shodan, etc.). Create a project, configure the target, and start scanning. All operations are managed through the web UI. Use ./redamon.sh commands for lifecycle management: update, start, stop, etc.
What are this agent's strengths and limitations?
- Fully automated pipeline from recon to PR with zero manual intervention
- Parallel multi-agent execution drastically reduces assessment time
- Neo4j knowledge graph provides structured attack surface, queryable in natural language
- Secure container isolation and STRIDE threat modeling protect the host
- Requires substantial hardware resources, especially with OpenVAS (8 GB RAM minimum)
- First-time install and updates are slow, especially GVM sync (~30 min)
- Heavily dependent on Docker; not suitable for non-containerized environments
- As a security tool, usage must comply with laws and authorizations despite MIT license
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| RedAmon: Autonomous AI Red Team Framework This agent | 48 · Major gaps | CLIFree + model costs | ★ 3.2k | today | Python | OpenAI API · Claude API |
| PentAGI | 44 · Major gaps | Self-hosted serviceFree + model costs | ★ 31k | 9d ago | Go | OpenAI API · Claude API |
| CyberStrike — Open-Source AI Penetration Testing & Red Team Platform | 43 · Major gaps | CLIFree + model costs | ★ 3.2k | 4d ago | TypeScript | — |
| Scanners-Box Security Arsenal | 19 · Major gaps | Web appFree | ★ 9.1k | 2d ago | — | — |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows user confirmation mechanisms (approval requests), data flow transparency (tool call tracing), sensitive data handling (tests avoid leaking secrets), dependency security (security policy and vulnerability reporting), external effects (legal disclaimer), rollback (update and clean commands), source attribution (maintainer info). However, least privilege not explicit, user confirmation may be auto-approved, data flow transparency partial, sensitive data handling not fully covered in tests, dependency security lacks specific fixes, external effects not detailed, rollback lacks data recovery, source attribution unverified.
Self-consistency good, tests and docs align; dependency availability not explicit but Docker images provided; failure messages handled in tests but not comprehensive.
Audience clear (security testers), scenarios diverse (recon, exploitation, post-exploitation), capability boundaries stated (authorized testing), trigger precision partial (approval mechanisms), environment fit good (Docker, Kali, multi-platform).
Information architecture clear (README, Wiki, docs), install notes detailed, naming stable (version numbers), examples and FAQ present, known limitations partial (disclaimer), license MIT, versioning changelog not provided, maintenance responsibility clear (maintainers).
Output usability high (reports, PRs), marginal value high (automated fixes), cost-benefit not explicit (high resource requirements).
Claim traceability partial (tests), cross-source corroboration insufficient (single source), fact-inference separation partial (tests and docs).
- This is an offensive security tool for authorized testing only; misuse may be illegal.
- Auto-approval mechanisms may bypass user confirmation; configure carefully.
- Dependency security lacks specific fixes; update regularly.
- High resource requirements; assess hardware before deployment.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v6.14.1 v6.14.1 - update no longer refuses to pull after a scan
Release notes excerpt
Highlights Fixed: ./redamon.sh update no longer refuses to pull after a scan, and its error no longer makes the problem permanent ([#185](https://github.com/samugit83/redamon/issues/185)). A scan bind-mounts recon/ read-write into the spawned recon container, and two git-tracked data directories are re-downloaded there on a 24h cache miss (the MITRE CVE/CAPEC/CWE database and the Wappalyzer fingerprint cache). That left tracked files modified, so git pull --ff-only refused. The restore meant to prevent this was dead code -- it pointed at a .last_update marker that had since …View on GitHub ↗ -
v6.2.5 v6.2.5 - LAN WebSocket + Neo4j Auth Fixes
Release notes excerpt
Highlights Fixed: LAN/remote access hung on "Connecting…" (#159). Opening RedAmon by IP or hostname on a plain docker compose up deploy (no reverse proxy) left the Terminal and AI Agent stuck on "Connecting…" forever, because the browser dialed the web port, which runs no WebSocket server. Only localhost worked. The server now injects a runtime routing hint so the browser reaches the agent's published port directly (ws://<host>:8090/ws/*) with zero config. Reverse-proxied and single-host deploys keep same-origin routing untouched. Runtime-tunable (no rebuild) via AGENT_WS_MODE …View on GitHub ↗ -
v6.2.2 v6.2.2 — Agent File-Download Hardening
Release notes excerpt
RedAmon v6.2.2 — Agent File-Download Hardening A security patch release. Closes an unauthenticated OS command-injection (RCE) in the agent's GET /files in-chat download endpoint (CWE-78), responsibly disclosed by threatroute66 and tracked as [GHSA-vqf8-hfgc-v5cf](https://github.com/samugit83/redamon/security/advisories/GHSA-vqf8-hfgc-v5cf). 🛡️ Unauthenticated /files command injection closed (Critical, CVSS 9.8) …View on GitHub ↗