T3MP3ST Security Harness
Turn a connected coding agent into an orchestrated workflow for authorized security testing.
- Source repo
- elder-plinius/T3MP3ST
- Stars
- ★ 6.9k
- Last updated
- 1mo ago
- License
- AGPL-3.0
- Primary language
- TypeScript
- FA score
- 55/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A penetration-testing team with written authorization needs local War Room-driven asset discovery, service fingerprinting, and mission evidence for a web application assessment.
- Not a fit if
- Teams expecting reliable end-to-end multi-agent swarm exploitation — it is unbenchmarked and unreliable
- Organizations wanting defensive-only or compliance work without offensive tooling
- Teams that cannot send target data to third-party hosted model providers such as Novita
- Source review
- 55/100 · Major gaps
What does this agent do, and when should you use it?
T3MP3ST is a multi-agent offensive-security framework for authorized testing, research, and education. It connects an already authenticated local coding agent or an API provider through a browser War Room, CLI, HTTP API, and MCP server. Mission Control, the Target Model, the Arsenal, and eight operator roles organize missions; the README marks the reconnaissance engine, mission engine, and evidence/reporting flow as stable while describing much of the coordinated downstream chain as experimental. It covers tool-backed web reconnaissance, white-box source analysis, CTF work, coordinated disclosure, and scaffolding for cloud, mobile, and binary static detection. It is designed for local or self-hosted deployment, and the documented Docker service binds only to 127.0.0.1:3333 by default.
An operator connects Claude Code, Codex, Hermes, OpenCode, or Oh My Pi in the War Room Settings, describes an authorized target to Op Admiral, and starts a mission. Mission Control coordinates the Target Model and Arsenal; the README describes Recon as a tool-backed loop that drives nmap, DNS, HTTP, and fingerprinting, with built-in networked tools refusing public hosts outside mission scope as well as loopback and private addresses. The system produces mission status, findings, evidence, reports, and coordinated-disclosure drafts. npm run server starts the HTTP API, while node dist/mcp-server.js exposes security_recon to MCP-aware clients. npm run verify-claims recomputes the README's benchmark claims from committed JSON under bench/.
- A penetration-testing team with written authorization needs local War Room-driven asset discovery, service fingerprinting, and mission evidence for a web application assessment.
- A security researcher reviewing open-source robotics, OT, or embedded software needs an OSV novelty, live-PoC, refuter-panel, and CVSS workflow for coordinated-disclosure drafts.
- A CTF learner working in an isolated authorized challenge environment wants to run hint-free Cybench-style tasks through a connected local coding agent.
- An application-security engineer needs white-box ingestion and decomposed vulnerability analysis for Python, JavaScript, TypeScript, Go, Java, C, or C++ repositories.
- A self-hosting team wants to expose
security_reconto an MCP-aware agent while retaining local agent authentication or switching to OpenAI, Anthropic, OpenRouter, or Venice providers.
How do you install or deploy this agent?
Install and start the local War Room:
npm install
npm run serverOpen http://127.0.0.1:3333/ui/ and connect a local agent in Settings. Alternatively, configure OPENROUTER_API_KEY, VENICE_API_KEY, ANTHROPIC_API_KEY, or OPENAI_API_KEY for a provider path. For offline use, run ollama serve && ollama pull llama3, set TEMPEST_LOCAL_BASE_URL=http://localhost:11434/api and TEMPEST_LOCAL_MODEL=llama3, then run npm run build and npx tempest. For Docker, run cp .env.example .env and then docker compose up -d.
How do you use this agent?
Connect a local agent in War Room Settings, describe an authorized target to Op Admiral, and launch the mission. Check the local service with curl http://localhost:3333/api/health; the README also documents curl http://localhost:3333/api/bounty/platforms as an API example. For MCP integration, run node dist/mcp-server.js and use its exposed security_recon capability. Run npm run verify-claims when you want to recompute the repository's published benchmark claims.
What are this agent's strengths and limitations?
- It can use an already authenticated local coding agent while also documenting OpenRouter, Venice, Anthropic, OpenAI, and local OpenAI-compatible model paths; the local-agent path does not require a new API key.
- War Room, CLI, HTTP API, and MCP
security_reconprovide both an operator interface and integration surface for MCP-aware workflows. - The README documents
verify-claimsas recomputing published metrics from committed benchmark JSON and reports black-box and white-box XBEN results separately. - Default egress-scope containment rejects out-of-scope public hosts plus loopback and private addresses, and the documented Docker deployment listens only on the local loopback interface.
- This is an offensive-security tool for owned or explicitly authorized targets only; adopters remain responsible for legal scope and rules of engagement.
- The README explicitly says end-to-end coordinated swarm exploitation is unbenchmarked and unreliable; several downstream operators and white-box source analysis remain experimental.
- Cloud, mobile, and binary modules are primarily static-detection or interface scaffolding, without benchmarks for live cloud exploitation, mobile dynamic exploitation, or binary solving/pwn work.
- Local operation depends on npm, shell access, and either a local authenticated agent or configured model provider; Docker deployment and update workflows add Docker or Git dependencies.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| T3MP3ST Security Harness This agent | 55 · Major gaps | CLIFree + model costs | ★ 6.9k | 1mo ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| Agency Orchestrator: One Sentence to Orchestrate an AI Expert Team | 61 · Some gaps | CLIFree + model costs | ★ 2.5k | 3d ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
| RedAmon: Autonomous AI Red Team Framework | 48 · Major gaps | CLIFree + model costs | ★ 3.3k | 1d ago | Python | OpenAI API · Claude API |
| Superagent SDK | 39 · Major gaps | Library / SDKFreemium | ★ 6.8k | 2mo ago | TypeScript | Claude Code · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
least_privilege: 1 - There are permission controls (e.g., scope restrictions, gated dangerous tools), but no full evidence of least privilege principle. user_confirmation: 2 - Update flow requires user confirmation, but other operations (e.g., mission start) do not explicitly require confirmation. data_flow_transparency: 1 - Documentation mentions data flows (e.g., evidence vault, credential store), but does not detail data flow and usage. sensitive_data_handling: 2 - Protected paths (.env, key files) and data handling guidelines exist, but no encryption or redaction details. dependency_security: 2 - Dependency overrides and npm audit report exist, but no full vulnerability scan evidence. external_effects: 1 - Tools perform real operations (e.g., port scanning), but no side-effect control or rollback mechanism. rollback: 2 - Updater provides rollback and protected paths, but no task-level rollback. source_attribution: 1 - Contributor guidelines exist, but no clear source attribution mechanism.
self_consistency: 2 - Documentation and code structure are consistent, status table is clear. dependency_availability: 2 - Dependency list is complete, but no availability guarantee. failure_messages: 1 - Error handling scripts exist, but no user-friendly error messages.
audience_and_scenarios: 2 - Clear target users and scenarios (authorized testing, CTF, etc.). capability_boundaries: 2 - Status table clearly distinguishes stable, experimental, and planned features. trigger_precision: 1 - Mission start relies on natural language, but no precise trigger mechanism. environment_fit: 2 - Supports multiple environments (local, Docker, offline).
information_architecture: 2 - Documentation structure is clear, with index and navigation. install_notes: 2 - Installation steps and Docker guide provided. naming_stability: 2 - Naming is consistent, with version numbers. examples_and_faq: 2 - Quick start and documentation links provided. known_limitations: 2 - Status table clearly lists limitations. license: 2 - AGPL-3.0 license provided. versioning_changelog: 1 - Version number exists but no changelog. maintenance_responsibility: 1 - Contribution guidelines exist but no maintainer information.
output_usability: 2 - Reports and evidence provided, but no output format details. marginal_value: 2 - Unique features (e.g., multi-agent, offline) provided. cost_benefit: 2 - Emphasizes no extra API key cost, but no performance data.
claim_traceability: 2 - verify-claims script and benchmark data provided. cross_source_corroboration: 1 - Relies on single source, no external verification. fact_inference_separation: 2 - Clearly distinguishes facts and inferences (e.g., status table).
- This is an offensive security tool, intended for authorized testing only, but carries risk of misuse.
- Publisher identity is unverified; treat with caution.
- Dependency security relies on npm audit report only, no full vulnerability scan evidence.
- Data flow transparency is insufficient; further review needed.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v1.0.0 v1.0.0 — Certified source checkpoint
Release notes excerpt
This release marks a source commit that passed T3MP3ST's deterministic release quality gates. The single attached asset is the certified source ZIP. It was created by the tag workflow, extracted for a clean locked install and build, and verified against its SHA-256 and signed SLSA provenance before publication. Changes include reliable mission-control acknowledgements and status handling, configuration isolation for local verification, expanded release checks, and dependency updates with zero reported vulnerabilities. …View on GitHub ↗
FAQ
Do I need to buy a new model API?
Can I point it at any public target?
Has the eight-operator swarm been proven to exploit targets reliably?
Can it run without a cloud model?
npx tempest.