[opensourcedex]

Cairn is a free, open source ai development platforms project written in Python and released under AGPL-3.0. It has 2,834 GitHub stars, 379 forks and 10 open issues, and was last pushed 11 days ago. On this registry it ranks #127 of 139 tracked projects in AI Development Platforms, with 5 head-to-head comparisons available.

What is Cairn?

Cairn is a general-purpose AI state-space search engine, written in Python and licensed AGPL-3.0, that takes a known origin and a defined goal and searches for a path through an unknown problem space — validated first on autonomous penetration testing, and aimed at security teams, red-teamers, CTF players and AI agent developers facing problems with a clear starting point, a clear success condition and an unknown route between them.

What it is

Cairn is a problem-solving engine built on a Blackboard Architecture with an explicit fact-intent graph. It defines no roles and no workflows. Three primitives are all it needs: a Fact, which is a confirmed objective finding written to the board; an Intent, which is a declared direction of exploration not yet executed; and a Hint, which is human judgment injected at any time and absorbed by agents on their next read. The graph grows from origin toward goal, where every new Fact is a stepping stone and every Intent is a step into the unknown. Agent Workers run an OODA loop — Observe the full graph, Orient to the current state, Decide on next intents, Act to explore — and write findings back as new Facts. Workers have no fixed roles, and tasks are generated at runtime from the graph's current state rather than from predefined job descriptions.

The concrete problem it solves is the cost of hand-authoring agent roles and workflow definitions for LLM-driven search tasks. It lives in the AI agent and security automation ecosystem, alongside topics such as llm, ai-agent, penetration-testing, red-teaming and security-automation. What it replaces is the predefined, role-based agent framework and the fixed penetration-testing playbook: instead of writing job descriptions and step sequences in advance, the operator supplies an origin and a goal, and coordination happens exclusively through the shared board (stigmergy), with no direct agent-to-agent communication and no information silos.

Key capabilities

  • Explicit fact-intent graph over a Blackboard Architecture, using three primitives only: Fact, Intent and Hint.
  • Stigmergic coordination: Agent Workers communicate only through the shared board, never directly.
  • Three task types, all executed by the same Worker: Bootstrap (attempt direct solve at project start), Reason (read the full graph, decide whether the goal is met and what to explore next) and Explore (claim one Intent, execute, report one Fact).
  • Cairn Server maintains graph consistency; Cairn Dispatcher reads the graph, schedules tasks, manages containers and is the sole writer to the protocol; a Read/Write API sits between them.
  • Per-project Worker Containers, each running multiple Agent Workers concurrently.
  • Local mode runs workers directly on the dispatcher host, with no Docker required.
  • Supported worker backends: Claude Code, Codex and Pi.

Who uses it and how

  • Red teams and penetration testers use it on engagements where the origin is a known target IP or target system and the goal is a shell or a captured flag.
  • CTF players and competition teams use it for challenge solving; the pipeline was validated at the Tencent Cloud Hackathon AI Penetration Testing Challenge, 2nd Edition, against 610 teams and 1,345 participants from top universities and security firms across China, solving 54 of 54 problems as the only team to achieve AK and finishing 3rd.
  • Vulnerability researchers and others whose work has the same shape — a known start, a defined success condition and an unknown path — apply it beyond security, since the README names vulnerability research, mathematical proof and CTF challenges as belonging to the same class of problems.
  • Multi-project operators run one Worker Container per project under a shared dispatcher, with Agent Workers inside each container.
  • Human operators inject Hints mid-run, which workers absorb on the next read without stopping the search.

Getting started

Deployment runs through Cairn Dispatcher, which schedules tasks and spins up per-project Worker Containers, with the worker backend set to Claude Code, Codex or Pi. Workers can alternatively run directly on the dispatcher host in local mode, which requires no Docker.

How it compares

The provided facts name no paid products that Cairn replaces, and name no comparable tools. Cairn stands alone in this registry as a general-purpose state-space search engine validated first on autonomous penetration testing.

When to use it — and when not to

A self-hoster must operate the Cairn Server, the Cairn Dispatcher and per-project Worker Containers, or accept local mode on a single host. It is a poor fit for teams that want packaged, role-based turnkey pentest tooling, or that cannot run containers. Honest limitations: validation has been demonstrated only on penetration testing, the supplied material gives no versioned release or packaged install command, and the AGPL-3.0 licence is copyleft, which matters for anyone embedding it in a closed product.

project readme (upstream, from github) — read inline

Cairn

More Than Just AI Penetration Testing — Towards General State-Space Search

Cairn is a general-purpose problem-solving engine.
It defines no roles, no workflows. Given an origin and a goal, it searches for a path through an unknown state space.
AI Penetration Testing is one such problem — and a proven one.

Discord X

What is Cairn?

Penetration testing is fundamentally a directed search through a near-infinite state space:

  • Origin: known (target IP, target system)
  • Goal: defined (get a shell, capture the flag)
  • Path: unknown

This structure is not unique to penetration testing. Vulnerability research, mathematical proof, CTF challenges — any problem with a clear starting point, a clear success condition, and an unknown path in between shares the same shape.

Cairn is built for this class of problems. Penetration testing is the first domain it has been validated on.

The engine is built on a Blackboard Architecture with an explicit fact-intent graph. Three primitives are all it needs:

Concept Meaning
Fact A confirmed, objective finding written to the board
Intent A declared direction of exploration, not yet executed
Hint Human judgment injected at any time; absorbed by agents on the next read

The graph grows from origin toward goal. Every new Fact is a stepping stone; every Intent is a step into the unknown.

Agent Workers run an OODA loop — Observe the full graph, Orient to the current state, Decide on next intents, Act to explore — and write their findings back as new Facts. Workers have no fixed roles. Tasks are generated at runtime from the graph's current state, not from predefined job descriptions.

Agents coordinate exclusively through the shared board (Stigmergy). No direct communication. No information silos.

Cairn in Action

https://github.com/user-attachments/assets/e557b1ac-dda4-41cb-87dd-9d56dbf05133

How It Works

Three task types, all executed by the same Worker:

Task What it does Output
Bootstrap At project start, attempts to solve the problem directly Fact + possible Complete
Reason Reads the full graph: is the goal met? What should be explored next? Complete / new Intents / no-op
Explore Claims one Intent, executes the exploration, reports findings One Fact

System architecture:

          ┌──────────────────────────────────┐
          │           Cairn Server           │
          │    Facts + Intents + Hints       │
          └─────────────────┬────────────────┘
                            │
                     Read / Write API
                            │
          ┌─────────────────┴────────────────┐
          │             Dispatcher           │
          │   Schedules tasks, manages       │
          │   containers, writes protocol    │
          └──────────┬───────────────┬───────┘
                     │               │
     ┌───────────────┴──┐     ┌──────┴──────────────┐
     │  Worker Container│     │  Worker Container   │
     │   (Project A)    │     │   (Project B)       │
     │  ┌────┐  ┌────┐  │     │  ┌────┐  ┌────┐     │
     │  │ W. │  │ W. │  │     │  │ W. │  │ W. │     │
     │  └────┘  └────┘  │     │  └────┘  └────┘     │
     └──────────────────┘     └─────────────────────┘

Cairn Server maintains graph consistency only.

Cairn Dispatcher reads the graph, schedules tasks, spins up and tears down worker containers, and is the sole writer to the protocol. Each project gets its own Worker Container; multiple Agent Workers run concurrently inside it. Agent Workers only receive a prompt and return structured output.

Workers can also run directly on the dispatcher host instead of in per-project containers — local mode, no Docker required. See Local mode below.

Supported worker backends: Claude Code, Codex, and Pi.

Results

Tencent Cloud Hackathon · AI Penetration Testing Challenge · 2nd Edition

610 teams · 1,345 participants · top universities and security firms across China

Metric Value
Problems solved 54 / 54 — only team to AK
Final ranking 3rd

The system had never been tested before the competition. The full pipeline came online for the first time at 4 AM on race day. No training, no tuning, no domain-specific tooling. Zero MCP tools, zero RAG, zero predefined agent roles.

Further Reading

Getting Started

Prerequisites

  • macOS or Linux
  • Python ≥ 3.12
  • Docker (container execution only — not needed for local mode)

Pull required images

Both setup methods require the worker container image:

docker pull --platform=linux/amd64 ghcr.io/oritera/cairn-worker-container:latest

Create your local dispatcher configuration and fill in your LLM endpoints and API keys:

cp dispatch.example.yaml dispatch.yaml

Docker Compose (recommended)

Pull the base image used to build Cairn:

docker pull ghcr.io/astral-sh/uv:python3.13-trixie

docker compose up --build

This starts cairn-server on port 8000 and cairn-dispatcher once the server passes its health check. The dispatcher mounts dispatch.yaml from the project root and connects to Docker via the host socket. Data is persisted to ./datas/cairn/.

Manual

# Start the server
uv run --project cairn cairn serve
 
# Run the dispatcher
uv run --project cairn cairn dispatch --config dispatch.yaml
 
# Run startup health checks only
uv run --project cairn cairn dispatch --config dispatch.yaml --startup-healthcheck-only

Local mode (no Docker)

Instead of one container per project, workers can run directly on the dispatcher host, reusing the machine's already-configured claude / codex / pi CLIs — no Docker, and no API keys in the config.

cp dispatch.local.example.yaml dispatch.yaml

# Start the server
uv run --project cairn cairn serve

# Run the dispatcher on the same host, where the CLIs are installed and logged in
uv run --project cairn cairn dispatch --config dispatch.yaml

Local mode is selected by runtime.execution: local (see dispatch.local.example.yaml). On startup the dispatcher checks each configured worker CLI is installed and runnable, and reminds you they must already be logged in. Each project gets an isolated working directory under local.workspace_root (default: the dispatcher's current directory). Run the dispatcher directly on the host — not inside Docker — since the agents run with your user's permissions and no sandbox.

Tests

Run the fast regression suite without Docker or live model endpoints:

uv run --project cairn --group dev pytest

Disclaimer

Cairn is a general-purpose problem-solving engine. Although it supports penetration testing, CTF solving, security assessment, and vulnerability research workflows, it is intended to be used only in environments where you have explicit authorization to operate.

You are solely responsible for how you use this project. Do not use Cairn against systems, networks, applications, or data without clear prior permission from the owner or operator. Unauthorized security testing, exploitation, or data access may be illegal and may

readme truncated — read the full docs on github

Frequently asked questions

Is Cairn free to use?

Cairn is open source under the AGPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Cairn do?

A AI general-purpose state-space search engine, validated first on autonomous penetration testing.

What is Cairn written in?

Cairn is primarily written in Python. Its source is publicly available at https://github.com/oritera/Cairn, and it has 2,834 GitHub stars.