RedAmon

RedAmon is an open-source, self-hosted AI penetration testing framework that maps your attack surface into a graph, autonomously exploits it from a Kali sandbox with human approval gates, and opens pull requests that fix what it finds.

It runs with local models through Ollama or with cloud LLMs, and works with MCP in both directions. On the XBOW validation benchmarks it solved 101 of 104 challenges, fully black-box, with the complete agent transcript published for every solve.

Runs with Docker on your own machine or server. MIT-licensed.