RedTeam Agent
Turns Claude Code, OpenCode or Codex into a recon → test → exploit → report pentest workflow for authorized targets.
- Source repo
- NeoTheCapt/RedteamAgent
- Stars
- ★ 159
- Last updated
- 3mo ago
- Primary language
- Python
- FA score
- 39/100 · Major gaps
At a glance
- How it runs
- Works with
- Portable with changesClaude CodeCodex · OpenAI API · Claude API (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Security engineers running an unattended overnight pass on an authorized CTF box or lab target with /autoengage.
- Not a fit if
- Teams that need native Windows/PowerShell support
- Anyone scanning live production systems without written authorization
- Users unwilling to configure an LLM provider and the Docker toolchain
- Source review
- 39/100 · Major gaps
What does this agent do, and when should you use it?
RedTeam Agent is an autonomous red-team simulation agent that runs inside Claude Code, OpenCode or Codex and converts a workspace into a penetration-testing environment for CTF and lab targets. Eight specialized subagents (operator, recon-specialist, source-analyzer, vulnerability-analyst, exploit-developer, fuzzer, osint-analyst, report-writer) drive a five-phase flow: RECON → COLLECT → TEST → EXPLOIT → REPORT. The TEST phase is a SQLite-backed case queue where mitmproxy, Katana, recon and spec act as producers and dispatcher.sh routes each case by stage and type to the right consumer agent in a serialized one-fetch-plus-one-task loop. All offensive tooling is containerized (Kali toolbox, mitmproxy, Katana, optional Metasploit RPC for OpenCode), shipped with 31 attack methodology skills and 79 reference files covering OWASP Top 10:2025, API Security 2023 and AD/Kerberos. Artifacts land in engagements/<timestamp-target>/ as findings.md, report.md, log.md, intel.md, intel-secrets.json, auth.json and surfaces.jsonl coverage tracking, and any engagement can be resumed. An optional local Orchestrator GUI adds project, live-run, timeline and artifact views.
Given a target URL via /engage or /autoengage, the operator agent walks the five phases. RECON runs recon-specialist and source-analyzer in parallel and seeds intel.md. COLLECT imports discovered endpoints into the SQLite queue and starts the Katana crawler. TEST hands each case to vuln-analyst, source-analyzer, fuzzer or exploit-developer based on its stage and one of 15 case types (api, form, graphql, upload, websocket, javascript, page, stylesheet, data, unknown, api-spec and more); dispatcher.sh serializes the loop so each turn does one fetch plus one subagent task. EXPLOIT runs osint-analyst alongside exploit-developer: OSINT enriches intel.md with CVE, breach, DNS-history and social data, exploit-developer performs chain analysis and impact assessment, and intel_changed_check.sh triggers a fresh OSINT correlation pass when intelligence changes. REPORT has report-writer assemble coverage statistics and the intelligence summary. Along the way the agent writes findings, logs, auth material and high-risk surface coverage into the per-engagement directory and can capture authenticated traffic through a mitmproxy interception proxy.
- Security engineers running an unattended overnight pass on an authorized CTF box or lab target with /autoengage.
- Red teamers who want to review early-phase output on a newly authorized web app before letting /engage continue autonomously.
- Teams standardizing on OWASP Top 10, API Security and AD/Kerberos tactics via the bundled 31 skills and 79 references.
- Developers already using Claude Code or OpenCode who want a workspace with a Dockerized Kali toolchain instead of installing tools locally.
- Long assessments that get interrupted and need /resume to pick up from queue and artifact state.
- Operators managing several workspaces who want a local web UI for projects, live runs, timelines and artifacts via orchestrator/run.sh.
How do you install or deploy this agent?
Prerequisites: Docker with Docker Compose; and, unless you use the Docker all-in-one runtime, at least one of Claude Code, OpenCode or Codex plus curl, jq and sqlite3. Native Windows/PowerShell is not supported.
Docker all-in-one runtime (recommended):
bash <(curl -fsSL https://raw.githubusercontent.com/NeoTheCapt/RedteamAgent/v0.1.1/install.sh) docker
# or:
./install.sh docker ~/redteam-dockerInstall per CLI:
bash <(curl -fsSL https://raw.githubusercontent.com/NeoTheCapt/RedteamAgent/v0.1.1/install.sh) opencode
./install.sh claude ~/my-project
./install.sh codex ~/my-projectThen configure your LLM provider in .opencode/opencode.json (Anthropic, OpenAI, Google and Ollama are supported). Installation help:
./install.sh -hHow do you use this agent?
Docker runtime:
cd ~/redteam-docker
./run.sh
/engage http://your-ctf-target:8080
/autoengage http://your-ctf-target:8080OpenCode / Claude Code runtime:
cd ~/redteam-agent
opencode
/engage http://your-ctf-target:8080Codex does not support slash commands; invoke in natural language:
engage http://your-ctf-target:8080
autoengage http://your-ctf-target:8080Other useful commands: /resume to continue an interrupted engagement, /status for queue and progress, /proxy start to intercept logins via mitmproxy, /auth cookie "session=abc123" for credentials, /report to generate the report, /stop to shut down background containers. Local GUI:
./orchestrator/run.sh
# default URL http://127.0.0.1:18000
./orchestrator/stop.shWhat are this agent's strengths and limitations?
- OpenCode is the single source of truth: install.sh generates the Claude Code and Codex variants at install time, so prompts and commands stay in sync across CLIs.
- A SQLite case queue plus dispatcher.sh routes work by stage and case type with zero-token dispatch and a resumable serialized consume-test loop.
- All offensive tooling is containerized (Kali, mitmproxy, Katana, optional Metasploit RPC) instead of installed on the host.
- Built-in unattended hardening covers auto-resume after stalls, permission-stall guards, finding deduplication and automatic report synthesis.
- Ships 31 attack methodology skills and 79 reference files (OWASP Top 10:2025, API Security 2023, AD/Kerberos) so you do not start from a blank prompt.
- License is listed as unknown; confirm terms before commercial use or redistribution.
- Native Windows/PowerShell is explicitly unsupported, so only macOS and Linux hosts qualify.
- You must supply and pay for an LLM provider (Anthropic, OpenAI, Google and others); cost scales with usage.
- Setup spans Docker, a CLI and JSON config files, which is heavier than a single-command tool.
- Failures in auth, proxy or queue stages require reading logs (for example Katana container logs or ProviderModelNotFoundError).
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| RedTeam Agent This agent | 39 · Major gaps | CLIFree + model costs | ★ 159 | 3mo ago | Python | Claude Code |
| RedAmon: Autonomous AI Red Team Framework | 48 · Major gaps | CLIFree + model costs | ★ 3.3k | 1d ago | Python | OpenAI API · Claude API |
| Decepticon Autonomous Red Team Agent | 65 · Some gaps | CLIFreemium | ★ 6.6k | 2d ago | Python | OpenAI API · Claude API |
| T3MP3ST Security Harness | 55 · Major gaps | CLIFree + model costs | ★ 6.9k | 2mo ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
README shows containerized tooling, a scope-check hook (blocking in Claude, warning-only in OpenCode), and explicit warnings that intel-secrets.json/auth.json are sensitive and should not be shared — positive signals. However /autoengage is described as zero-interaction, auto-proceeding every phase and auto-using discovered credentials, and OpenCode scope enforcement only warns, weakening authorization boundaries and user confirmation. Dependency security, external effects, and rollback have no substantive evidence (no lockfiles/audit notes, no rollback or cleanup mechanism described), so each scores 1.
A troubleshooting table (Docker build, Katana, empty queue, ProviderModelNotFoundError) shows failure-message awareness, but dependency availability rests on 'retry the build' assertions with no version pinning or image digests. Internal inconsistencies exist (repo name RedteamAgent vs directory RedteamOpencode; install paths ~/redteam-agent vs ~/redteam-docker), so self-consistency is 1.
Targets authorized labs/CTF and web pentest scenarios, supports Claude Code/OpenCode/Codex plus a Docker all-in-one runtime, with a reasonably clear audience and scenario description (2). Capability boundaries are only a one-line 'authorized testing only' note, lacking explicit prohibited-target, rate-limit, or collateral-damage guardrails; trigger precision mixes slash commands and natural language (Codex lacks slash commands); environment fit explicitly excludes native Windows/PowerShell, so the rest score 1.
Information architecture is clear (three-layer split, single-source design, CLI compatibility table) and install notes are thorough (multiple CLIs, Docker, GUI, dry-run), scoring 2. But the License section only states 'authorized testing only' with no actual license, and metadata is unknown, so license scores 0; versioning appears only as v0.1.1 in install URLs with no CHANGELOG; naming stability is deducted for repo/directory/install-path mismatches; maintenance responsibility is unstated (unverified publisher); examples are mostly a command table without FAQ depth — all 1.
Outputs are well defined (findings.md, report.md, log.md, intel.md, cases.db, etc.) with automatic report synthesis and dedup, so output usability is 2. Marginal value depends on many external components (Docker, Kali toolchain, LLM CLI, optional Metasploit) and cost/benefit is unquantified; scale claims (79 references/31 skills/8 agents) lack independent corroboration, so marginal value and cost-benefit are 1.
The README describes architecture, phases, commands, and config concretely, with some traceable file paths (e.g., config.py:17, dispatcher.sh), giving partial claim traceability. But key capability claims (autonomy, coverage, auto-recovery) have no test or log evidence, and only a single README source exists, so cross-source corroboration is impossible; facts and inferences (e.g., 'suitable for long unattended sessions') are blended without separation — all three score 1.
- /autoengage is described as zero-interaction, auto-using discovered credentials and auto-proceeding through all phases, while OpenCode scope checks only warn rather than block — real risk of out-of-scope testing and collateral impact; use only in isolated, authorized environments.
- No actual open-source license is provided, only an 'authorized testing only' statement, leaving legal terms unclear.
- Publisher identity is unverified and maintenance responsibility/update path are unclear; repo name, directory name, and install paths are inconsistent, which may confuse installation.
- No dependency locking or audit notes; supply-chain risk of the Docker/Kali toolchain and LLM CLIs is unassessed, and no rollback or cleanup mechanism is described.
- Scale and autonomy claims in the README lack test or log corroboration; this is a static source review with no execution performed.
FAQ
Can I point /autoengage at a production system?
Which CLI should I start with?
Where does my data go?
What happens if a run is interrupted?
Can I switch model providers?
.opencode/opencode.json for Anthropic, OpenAI, Google or Ollama, or set it per project through the GUI's Model tab, which injects REDTEAM_OPENCODE_MODEL and related env vars.