VulnClaw
AI-driven penetration testing CLI that turns natural language into a full pentest workflow: recon, discovery, exploitation, and reporting.
- Source repo
- Netw0rkNoob/VulnClaw
- Stars
- ★ 3.7k
- Last updated
- 13d ago
- License
- MIT
- Primary language
- Python
- FA score
- 48/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Authorized penetration testing: Security testers assess targets they own or have explicit permission to test, describing the objective in natural language and letting the agent handle recon and exploitation.
- Not a fit if
- Teams needing production-grade stability: the project is public Alpha
- English-only users: documentation is primarily in Chinese
- Source review
- 48/100 · Major gaps
What does this agent do, and when should you use it?
VulnClaw is an AI-powered penetration testing CLI (Python 3.10+, MIT license) that combines an LLM Agent with the MCP toolchain and Skill references. It accepts natural language input and automatically executes the complete pentest flow—from information gathering to vulnerability exploitation—and generates structured Markdown reports and Python PoC scripts. The default model-driven 'solve' engine lets the model decide each step, backed by an AgentState evidence memory and an anti-hallucination gate that only accepts claims found verbatim in real tool outputs. It supports 14 LLM providers (OpenAI, Anthropic, MiniMax, DeepSeek, Zhipu, Moonshot, Qwen, SiliconFlow, Doubao, Baichuan, StepFun, SenseTime, Yi, and local Ollama) and optional MCP services (fetch, memory, chrome-devtools, burp). Delivery modes include CLI, REPL, TUI, a Web UI, and Docker. It bundles 50 specialized Skills covering CTF, web, intranet, and reverse engineering, plus built-in tools for encoding/decryption, batch HTTP probing, runtime differential analysis, and more. Intended only for authorized security testing.
VulnClaw takes a natural language command such as 'pentest http://target.example.com' and executes an autonomous multi-round loop. It uses the built-in fetch tool (based on httpx) to send HTTP/HTTPS requests with configurable methods, headers, params, cookies, and bodies; http_probe_batch to compare multiple URL/parameter/header variants in one pass; nmap_scan for port scanning; crypto_decode for encoding/decryption (29 operations); python_execute to run Python code; shell_command for local commands (e.g., php -r, curl, rg); source_extract to pull clean source code from HTML; runtime_diff_probe to test filter/parser inconsistencies; brute_force_login for login brute-forcing; and load_skill_reference to fetch Skill documents on demand. Every tool result is written into AgentState.evidence, which the model can query via evidence_search/evidence_view. Finally, the solve engine deterministically generates a Markdown retrospective report including the reasoning path, key evidence, reproducing request packets, curl commands, response snippets, and an evidence index—plus a runnable Python PoC script.
- Authorized penetration testing: Security testers assess targets they own or have explicit permission to test, describing the objective in natural language and letting the agent handle recon and exploitation.
- CTF competitions: Competitors use VulnClaw to automate web challenge probing, leveraging the ctf-web, ctf-crypto, and ctf-misc knowledge bases, while the anti-hallucination gate prevents false flag claims.
- Security training: Instructors demonstrate pentest methodology in lab environments, and students observe model decisions and tool calls to learn attack chains.
- Red team exercises: Red teamers run long-duration persistent mode (vulnclaw persistent) for deep assessments, with auto-generated reports each cycle and support for incremental discoveries.
- Rapid vulnerability validation: Researchers use single-command modes like
vulnclaw scan --ports 80,443for quick port scans orvulnclaw exploit --cve CVE-2024-1234to verify specific vulnerabilities.
How do you install or deploy this agent?
Install from PyPI (recommended):
pip install vulnclawOr from source:
git clone https://github.com/Netw0rkNoob/VulnClaw.git
cd VulnClaw
pip install -e .Optional Docker deployment:
cp .env.example .env # fill in VULNCLAW_LLM_API_KEY etc.
docker compose up --build
# open http://127.0.0.1:7788Requires Python 3.10+. You must configure an LLM API key before use.
How do you use this agent?
- Choose a provider:
vulnclaw config provider minimax(or openai/anthropic/deepseek, etc.) - Set the API key:
vulnclaw config set llm.api_key sk-your-key-here - Launch the REPL:
vulnclaw - Type a natural-language instruction like "pentest 192.168.1.100"
Common commands:
- vulnclaw solve target.com --goal "find the flag" — goal-driven solve
- vulnclaw run 192.168.1.100 — one-shot full pentest
- vulnclaw recon target.com — recon only
- vulnclaw scan target.com --ports 80,443 — vulnerability scan
- vulnclaw exploit target.com --cve CVE-2024-1234 --cmd id — exploit step
- vulnclaw report session.json — generate report
- vulnclaw web — start the Web UI (default 127.0.0.1:7788)
- vulnclaw tui — start the TUI workbench
Run vulnclaw doctor to verify the environment. Optionally configure MCP servers (e.g., chrome-devtools and burp) for browser automation and HTTP interception.
What are this agent's strengths and limitations?
- Model-driven solve engine: the model decides each step, adapting to unknown targets rather than following a fixed script.
- Evidence-level anti-hallucination gate: conclusions are only accepted if they match real tool output verbatim or cite an evidence ID, preventing fabricated flags.
- 14 LLM providers including local Ollama, reducing vendor lock-in.
- Rich built-in toolchain: fetch, http_probe_batch, crypto_decode, python_execute, shell_command, and more work out of the box.
- Comprehensive Skill library: 50 skills covering CTF, web, intranet, reverse engineering, etc., loaded on demand to avoid context bloat.
- Public Alpha stage: not yet stable for production security use.
- Relies on external LLM APIs: requires API keys and may incur significant costs in long sessions.
- High-risk experimental features: python_execute and shell_command can run arbitrary code; sandboxing is the user's responsibility.
- MCP services (chrome-devtools, burp) require extra deployment and configuration.
- Documentation is primarily in Chinese; English support is limited.
How does this agent compare with similar options?
Unlike traditional frameworks such as Metasploit, VulnClaw's core is an LLM agent that makes autonomous decisions rather than composing predefined modules. Compared to general coding agents like Codex or Claude Code, VulnClaw is specialized for security testing, with built-in evidence gates, WAF bypass libraries, and a CTF-oriented skill set.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| VulnClaw This agent | 48 · Major gaps | CLIFree + model costs | ★ 3.7k | 13d ago | Python | — |
| HexStrike AI MCP | 22 · Major gaps | MCP serverFree | ★ 13k | 2mo ago | Python | Claude.ai |
| Strix AI Pentesting | 62 · Some gaps | CLIFreemium | ★ 70k | today | Python | ChatGPT · Codex · Claude Code · OpenAI API · Claude API |
| PentesterFlow | 73 · Some gaps | CLIFree + model costs | ★ 1.4k | 1mo ago | TypeScript | OpenAI API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README declares authorized use, security statement, and sandbox prompts, but no actual permission control details; user confirmation mechanisms exist (e.g., TUI scope confirmation), but not all operations require confirmation; data flow transparency is good with AgentState evidence recording and traffic storage; sensitive data handling (API key storage) not detailed; dependency security not mentioned vulnerability scanning or pinning; external effects (e.g., network scanning) have authorization statements but no technical restrictions; rollback has target state snapshots and rollback functionality; source attribution has author info but unverified. Deductions: least privilege, user confirmation, sensitive data handling, dependency security, external effects, rollback, and source attribution lack concrete implementation evidence.
Evidence shows: README and test files are internally consistent, module division clear; dependencies declared in pyproject.toml, but availability not verified; failure messages mentioned (e.g., stall guard), but no specific error handling examples. Deductions: dependency availability unverified, failure message details insufficient.
Evidence shows: clearly targets authorized pentesting, CTF, teaching scenarios; capability boundaries have security statements and authorization requirements; trigger precision has natural language keyword triggers and explicit commands; environment fit has Docker, multi-platform CI, and multiple LLM providers. Deductions: capability boundaries not detailed to specific tool limits, trigger precision may be imprecise due to natural language.
Evidence shows: README structure clear with installation, usage, architecture, configuration sections; installation instructions detailed (pip, source, Docker); naming stable (vulnclaw command); examples and FAQ present (REPL examples); known limitations mentioned (e.g., python_execute not sandbox); license MIT; version in pyproject.toml, but no CHANGELOG content; maintenance responsibility has contribution guide but no clear maintainer. Deductions: naming stability not verified historically, known limitations not comprehensive, version changelog missing, maintenance responsibility unclear.
Evidence shows: output usability has report and PoC generation; marginal value high with full-process automation; cost-benefit lacks actual performance data. Deductions: cost-benefit lacks data support.
Evidence shows: README feature claims have some test coverage (e.g., test files), but no specific evidence links; cross-source verification insufficient, relying only on single repository; fact-inference separation unclear. Deductions: claim traceability insufficient, cross-source verification missing, fact-inference not clearly separated.
- This is a penetration testing tool; must only be used on authorized targets, otherwise illegal.
- python_execute and shell_command tools are not strong isolation sandboxes, posing code execution risks.
- Dependencies are not pinned, posing supply chain risks.
- API key storage method is not clear; handle with caution.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
VulnClaw v0.4.1 Windows TUI 粘贴/闪退修复 + REPL LLM 错误显示。 修复与改进 - 修复 Windows TUI 无法粘贴 — Windows 无 bracketed paste（crossterm 0.28 仅在 Unix 解析该序列），Ctrl+V 此前落入空分支被静默丢弃；现在 Ctrl+V / Shift+Insert / 鼠标右键三个触发器均直接读取系统剪贴板粘贴到输入框（#296） - 剪贴板访问改为 Win32 API 直调 — TUI 的复制/粘贴不再通过 powershell.exe 子进程（每次需 1-3 秒 .NET 冷启动），改为 FFI 直调 OpenClipboard/GetClipboardData/SetClipboardData，微秒级完成且零新增依赖；同时消除复制路径的临时文件落盘（#296） - 修复剪贴板子进程隐藏 TUI 窗口的问题 — 从 TUI 内 spawn powershell.exe 时 -WindowStyle Hidden 会隐藏 TUI 自身的共享控制台窗口（表现为按粘贴键整个窗口"消失"）；全部剪贴板子进程改用 CREATE_NO_WINDOW 创建标志（#296） …View on GitHub ↗ -
Release notes excerpt
What's Changed * feat(kb): 中文感知 BM25 检索 + 可选 cross-encoder 重排序 by @SummerCaptain in https://github.com/Netw0rkNoob/VulnClaw/pull/252 * fix(i18n): add missing cli.host_no_set English translation by @Shxiao101 in https://github.com/Netw0rkNoob/VulnClaw/pull/257 * docs: remove README references to nonexistent docs/keyless-auth.md by @Shxiao101 in https://github.com/Netw0rkNoob/VulnClaw/pull/259 * fix(cli): paste and scroll classic /config panel by @JMAN730 in https://github.com/Netw0rkNoob/VulnClaw/pull/264 …View on GitHub ↗ -
Release notes excerpt
What's Changed * fix(ci): point release preflight at tests/meta/test_release.py by @Unclecheng-li in https://github.com/Netw0rkNoob/VulnClaw/pull/199 * Dev by @Unclecheng-li in https://github.com/Netw0rkNoob/VulnClaw/pull/201 * Unclecheng li patch 2 by @Unclecheng-li in https://github.com/Netw0rkNoob/VulnClaw/pull/202 * Unclecheng li patch 1 by @Unclecheng-li in https://github.com/Netw0rkNoob/VulnClaw/pull/204 * Dev by @Unclecheng-li in https://github.com/Netw0rkNoob/VulnClaw/pull/205 …View on GitHub ↗