VulnClaw

What does this agent do, and when should you use it?

VulnClaw is an AI-powered penetration testing CLI (Python 3.10+, MIT license) that combines an LLM Agent with the MCP toolchain and Skill references. It accepts natural language input and automatically executes the complete pentest flow—from information gathering to vulnerability exploitation—and generates structured Markdown reports and Python PoC scripts. The default model-driven 'solve' engine lets the model decide each step, backed by an AgentState evidence memory and an anti-hallucination gate that only accepts claims found verbatim in real tool outputs. It supports 14 LLM providers (OpenAI, Anthropic, MiniMax, DeepSeek, Zhipu, Moonshot, Qwen, SiliconFlow, Doubao, Baichuan, StepFun, SenseTime, Yi, and local Ollama) and optional MCP services (fetch, memory, chrome-devtools, burp). Delivery modes include CLI, REPL, TUI, a Web UI, and Docker. It bundles 50 specialized Skills covering CTF, web, intranet, and reverse engineering, plus built-in tools for encoding/decryption, batch HTTP probing, runtime differential analysis, and more. Intended only for authorized security testing.

VulnClaw takes a natural language command such as 'pentest http://target.example.com' and executes an autonomous multi-round loop. It uses the built-in fetch tool (based on httpx) to send HTTP/HTTPS requests with configurable methods, headers, params, cookies, and bodies; http_probe_batch to compare multiple URL/parameter/header variants in one pass; nmap_scan for port scanning; crypto_decode for encoding/decryption (29 operations); python_execute to run Python code; shell_command for local commands (e.g., php -r, curl, rg); source_extract to pull clean source code from HTML; runtime_diff_probe to test filter/parser inconsistencies; brute_force_login for login brute-forcing; and load_skill_reference to fetch Skill documents on demand. Every tool result is written into AgentState.evidence, which the model can query via evidence_search/evidence_view. Finally, the solve engine deterministically generates a Markdown retrospective report including the reasoning path, key evidence, reproducing request packets, curl commands, response snippets, and an evidence index—plus a runnable Python PoC script.

1. Authorized penetration testing: Security testers assess targets they own or have explicit permission to test, describing the objective in natural language and letting the agent handle recon and exploitation.
2. CTF competitions: Competitors use VulnClaw to automate web challenge probing, leveraging the ctf-web, ctf-crypto, and ctf-misc knowledge bases, while the anti-hallucination gate prevents false flag claims.
3. Security training: Instructors demonstrate pentest methodology in lab environments, and students observe model decisions and tool calls to learn attack chains.
4. Red team exercises: Red teamers run long-duration persistent mode (vulnclaw persistent) for deep assessments, with auto-generated reports each cycle and support for incremental discoveries.
5. Rapid vulnerability validation: Researchers use single-command modes like vulnclaw scan --ports 80,443 for quick port scans or vulnclaw exploit --cve CVE-2024-1234 to verify specific vulnerabilities.

What are this agent's strengths and limitations?

How do you install or deploy this agent?

Install from PyPI (recommended):

pip install vulnclaw

Or from source:

git clone https://github.com/Netw0rkNoob/VulnClaw.git
cd VulnClaw
pip install -e .

Optional Docker deployment:

cp .env.example .env  # fill in VULNCLAW_LLM_API_KEY etc.
docker compose up --build
# open http://127.0.0.1:7788

Requires Python 3.10+. You must configure an LLM API key before use.

How do you use this agent?

1. Choose a provider: vulnclaw config provider minimax (or openai/anthropic/deepseek, etc.)
2. Set the API key: vulnclaw config set llm.api_key sk-your-key-here
3. Launch the REPL: vulnclaw
4. Type a natural-language instruction like "pentest 192.168.1.100"

Common commands:
- vulnclaw solve target.com --goal "find the flag" — goal-driven solve
- vulnclaw run 192.168.1.100 — one-shot full pentest
- vulnclaw recon target.com — recon only
- vulnclaw scan target.com --ports 80,443 — vulnerability scan
- vulnclaw exploit target.com --cve CVE-2024-1234 --cmd id — exploit step
- vulnclaw report session.json — generate report
- vulnclaw web — start the Web UI (default 127.0.0.1:7788)
- vulnclaw tui — start the TUI workbench

Run vulnclaw doctor to verify the environment. Optionally configure MCP servers (e.g., chrome-devtools and burp) for browser automation and HTTP interception.

How does this agent compare with similar options?

FAQ