Description
Authorized pentesting and bug-bounty recon front-loads a lot of repetitive work: enumerate subdomains, scan ports, crawl historical assets, dig endpoints out of JS, and read a pile of output to decide the next step. Handing that to an AI agent means not wanting target data sent to the cloud — and recursive autonomous recon runs into thousands of LLM calls per session, which makes cloud APIs like GPT-4 or Claude prohibitively expensive.
AIRecon takes the fully local, offline route: a self-hosted Ollama LLM, a Kali Linux Docker sandbox, and a real-time Textual TUI, with no API keys and no target data leaving the machine. It drives a fixed RECON → ANALYSIS → EXPLOIT → REPORT pipeline autonomously, running 60+ tools like nmap, subfinder, amass, nuclei and ffuf inside the sandbox, archiving output to a workspace, and generating a CVSS-scored Markdown report.
It ships a skills knowledge base (57 skill files, 289 keyword-to-skill mappings), connects an optional local security dataset (~1.09M records), and integrates the Caido proxy natively for request replay and automated fuzzing. The whole chain runs offline, and sessions resume.
This is a tool for authorized security testing only: the project states you must obtain explicit permission and follow the law and program scope. MIT licensed.
Fully local and offline: Self-hosted Ollama plus a Kali Docker sandbox, no API keys, and target intel, tool output and reports never leave the machine.
Autonomous pipeline: Drives a RECON → ANALYSIS → EXPLOIT → REPORT structure automatically, with the agent choosing the next step and running tools in the sandbox.
60+ security tools: The sandbox bundles nmap, naabu, subfinder, amass, nuclei, nikto, ffuf, sqlmap and sixty-odd more, plus a custom fuzzer, Schemathesis API fuzzing and Semgrep SAST.
Skills knowledge base: 57 built-in skill files and 289 keyword mappings, extendable with a community skill library, distilling CTF, bug-bounty and pentest playbooks for reuse.
Native Caido integration: Built-in list, replay, automated fuzz (§FUZZ§), findings and scope tools that take proxy requests straight into replay and batch testing.
TUI and session resume: A real-time Textual TUI shows progress and the workspace file tree, sessions resume, and a status bar reports Ollama/Docker/model state.
Authorized use only: The project requires use solely for authorized security testing, with permission obtained beforehand and law and scope respected.
AIRecon takes the fully local, offline route: a self-hosted Ollama LLM, a Kali Linux Docker sandbox, and a real-time Textual TUI, with no API keys and no target data leaving the machine. It drives a fixed RECON → ANALYSIS → EXPLOIT → REPORT pipeline autonomously, running 60+ tools like nmap, subfinder, amass, nuclei and ffuf inside the sandbox, archiving output to a workspace, and generating a CVSS-scored Markdown report.
It ships a skills knowledge base (57 skill files, 289 keyword-to-skill mappings), connects an optional local security dataset (~1.09M records), and integrates the Caido proxy natively for request replay and automated fuzzing. The whole chain runs offline, and sessions resume.
This is a tool for authorized security testing only: the project states you must obtain explicit permission and follow the law and program scope. MIT licensed.
Features
Fully local and offline: Self-hosted Ollama plus a Kali Docker sandbox, no API keys, and target intel, tool output and reports never leave the machine.
Autonomous pipeline: Drives a RECON → ANALYSIS → EXPLOIT → REPORT structure automatically, with the agent choosing the next step and running tools in the sandbox.
60+ security tools: The sandbox bundles nmap, naabu, subfinder, amass, nuclei, nikto, ffuf, sqlmap and sixty-odd more, plus a custom fuzzer, Schemathesis API fuzzing and Semgrep SAST.
Skills knowledge base: 57 built-in skill files and 289 keyword mappings, extendable with a community skill library, distilling CTF, bug-bounty and pentest playbooks for reuse.
Native Caido integration: Built-in list, replay, automated fuzz (§FUZZ§), findings and scope tools that take proxy requests straight into replay and batch testing.
TUI and session resume: A real-time Textual TUI shows progress and the workspace file tree, sessions resume, and a status bar reports Ollama/Docker/model state.
Authorized use only: The project requires use solely for authorized security testing, with permission obtained beforehand and law and scope respected.
