[opensourcedex]

Dark-Moon is a free, open source ai security & privacy project written in Python and released under GPL-3.0. It has 957 GitHub stars, 159 forks and 3 open issues, and was last pushed 18 hours ago. On this registry it ranks #26 of 39 tracked projects in AI Security & Privacy, with 5 head-to-head comparisons available.

What is Dark-Moon?

DarkMoon is a self-hosted, GPL-3.0 autonomous AI penetration testing platform for security teams, red teams and AI security engineers who point it at infrastructure they are authorised to test and let a local or cloud model run the whole assessment unattended, returning a working exploit as proof for every finding.

What it is

DarkMoon is an open source, Python-based autonomous penetration testing platform distributed under GPL-3.0 and driven from the command line. It lives in the autonomous AI red-teaming and AI security tooling ecosystem, sitting alongside local LLM runtimes such as Ollama and llama.cpp and using an MCP-based command stream. One agentic system reasons over the target, plans, and dispatches 50 specialist agents across whatever surfaces it discovers, chaining web, APIs, Active Directory, Kubernetes, cloud, CI/CD, databases, IoT firmware and AI/LLM endpoints together in a single run.

The concrete problem it solves is the manual, tool-by-tool chain of reconnaissance, exploitation and triage that a human operator normally drives. Pointed at an authorised target, DarkMoon fingerprints the stack, confirms the attack surface, decides from what it detects which specialists to deploy, and then returns each vulnerability with the exact command that triggered it, the raw output and a working exploit — which the README describes as leaving almost nothing to triage. It replaces that hand-driven assessment loop, together with the reporting step that follows it, while keeping sensitive target values off the model itself.

Key capabilities

  • One agentic system reasons, plans and dispatches 50 specialist agents across every surface it discovers on the target.
  • Coverage spans web, APIs, Active Directory, Kubernetes, cloud (AWS, Azure, GCP), CI/CD, databases, IoT firmware and AI/LLM endpoints, including the OWASP LLM Top 10.
  • Every finding ships with the exact command, the raw output and a working exploit; the project's benchmark reports 57 real vulnerabilities on OWASP Juice Shop.
  • The Privacy Gateway performs reversible local tokenisation, turning real IPs, hosts, URLs and credentials into deterministic placeholders that are rehydrated locally only at the moment a tool runs.
  • Models can be cloud providers (Anthropic, OpenAI, OpenRouter) or fully local ones (Ollama, llama.cpp).
  • Each agent's methodology is plain Markdown that can be read, diffed and forked.
  • Runs stream live from the terminal, and ./darkmoon.sh --log records every command and its raw output, timestamped, over the MCP stream.

Who uses it and how

  • Security teams assessing their own perimeter, where the Privacy Gateway keeps real IPs, hosts and credentials on the organisation's boundary while the model reasons only over placeholders.
  • AI and LLM red teams testing model endpoints against the OWASP LLM Top 10 as part of an agentic assessment.
  • Cloud, Kubernetes and identity teams that need AWS, Azure, GCP, cluster and Active Directory checks chained end to end rather than run as separate tools.
  • Organisations with data-residency or confidentiality constraints that run the entire assessment on a local model instead of a hosted provider.
  • Contributors who fork or diff the Markdown agent methodology; the project carries 957 stars and 159 forks on GitHub, with 3 open issues and a last push in September 2026.

Getting started

Clone the repository, change into Dark-Moon and run ./install.sh, which configures the LLM provider interactively (no editing of docker-compose.yml required) and builds the full stack; an existing .opencode.env is reused, and ./install.sh --init forces reconfiguration. Assessments then run as ./darkmoon.sh "TARGET: example.com", with ./darkmoon.sh --log to follow the session live; the prerequisites are Docker with Docker Compose and either an LLM API key or a local model.

How it compares

The facts provided name no competing tools and no list of paid products that DarkMoon replaces, so it stands alone in this registry. The only contrast the project itself draws is internal: the open source engine is the self-hosted, GPL-3.0 command line tool, while Darkmoon Pro is a paid edition of the same project that adds a web dashboard and automated remediation.

When to use it — and when not to

A self-hoster has to operate Docker and Docker Compose, provide an LLM API key or stand up a local model, and work from the CLI; GPU setup, environment variables and the full flags reference live in docs/full.md rather than the README, so reading that file is part of the setup. It should not be used against systems you are not authorised to test, since it runs real exploits by design. Teams that need a graphical dashboard or automated remediation should look at the paid Pro edition, because the open source engine is command line only.

project readme (upstream, from github) — read inline

DarkMoon

Open-source autonomous AI penetration testing platform that finds and proves every vulnerability with a real exploit, on a local model

GitHub stars Latest release License GPLv3 Made with local LLM Autonomous AI pentesting

⭐ Star DarkMoon · 🚀 Quick Start · 📊 Benchmark · 🔒 Darkmoon Pro · ▶️ Watch the demo (Pro)

DarkMoon is autonomous AI penetration testing for your own infrastructure. Point it at an authorized target and it runs the whole assessment on its own, then returns proof for every finding.

  • 🟢 Truly open source. GPLv3 and self-hosted, every agent's methodology is plain Markdown you can read, diff and fork.
  • 🎯 Finds AND proves. Each vulnerability ships with the exact command, the raw output and a working exploit, so there is almost nothing to triage.
  • 🔒 Runs on a local LLM + Privacy Gateway. The gateway tokenizes your real IPs, hosts and credentials locally, so the model reasons on placeholders while real values stay on your perimeter.

See the open source engine (CLI)

The open source Darkmoon is a command line tool. This is what you get when you clone the repo. You launch an assessment from the command line and watch every agent, command and finding stream past in real time.

Kick off a run from the CLI. One TARGET line and DarkMoon takes over the whole assessment.

Autonomous agents reason and exploit, live in your terminal. Here a sub-agent flags CVE-2019-9978 and pivots straight to exploitation.

Recon and environment model. DarkMoon fingerprints the stack and confirms the attack surface before it strikes.

Live MCP stream. Every command the agent runs and its raw output, timestamped, with ./darkmoon.sh --log <session>.

Signal to agent dispatch. DarkMoon decides which specialist agents to deploy from exactly what it detects on the target.

As featured in Help Net Security · Cyber Security News · DevOps.com · SecurityBrief · LinuxLinks · IT Brief · ChannelLife

Quick Start

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh

install.sh configures your LLM provider interactively (no need to edit docker-compose.yml) and builds the full stack:

./install.sh           # skip form if .opencode.env already configured
./install.sh --init    # force reconfiguration (cloud or local model)
./install.sh --help    # show usage

Supports cloud providers (Anthropic, OpenAI, OpenRouter…) and local models (Ollama, llama.cpp). Then run your first assessment and watch it live:

./darkmoon.sh "TARGET: example.com"
./darkmoon.sh --log <session_id>

Prerequisites: Docker & Docker Compose, and an LLM API key (or a local model). GPU setup, environment variables and the full flags reference live in the Full Documentation.

Feature grid
🧠 50 specialist agents One agentic system reasons, plans and dispatches specialist agents across every surface it discovers.
🌐 Every surface Web, APIs, Active Directory, Kubernetes, cloud (AWS, Azure, GCP), CI/CD, databases, IoT firmware and AI/LLM endpoints, chained end to end.
🔒 Privacy Gateway Reversible local tokenization turns real IPs, hosts, URLs and credentials into deterministic placeholders, rehydrated only locally at the moment a tool runs.
🏠 Local model Run the whole assessment on a local LLM (Ollama, llama.cpp) so your infrastructure values stay on your own perimeter.
🧾 Proof, not scores Every finding ships with the exact command, raw output and a reproducible exploit.
🛡️ Security by design The AI never runs a command directly, every action flows through a controlled, logged MCP interface.
🤖 Pentests your AI too A dedicated LLM agent probes AI/LLM inference endpoints for the OWASP LLM Top 10 with garak-backed probes.
♾️ CI/CD native Trigger a pentest in the pipeline and get findings back as artifacts.
🔌 MCP + n8n Orchestrate 50+ offensive tools over MCP, and drive DarkMoon from an n8n workflow.
🔧 Fix it (Pro) The paid Pro tier turns findings into human-reviewed pull requests, retested against the original exploit.

Built for security teams, DevSecOps engineers, red teamers and ethical hacking professionals.

🔒 Darkmoon Pro — paid edition: web dashboard and automated remediation

🔒 These are Darkmoon Pro features (paid). The open source edition is the CLI shown above; the web dashboard and the automated remediation to pull requests are not in the open source build.

The screenshots below are the paid Darkmoon Pro web dashboard. They are not part of the open source repository you clone. The open source edition is the command line tool shown in the section above.

Pro: live web dashboard. Projects, targets and campaigns at a glance, with every finding bucketed by severity.

Pro: findings with CVSS and ATT&CK mapping. Each finding carries CVSS, MITRE ATT&CK and ISO 27001 mapping with an EXPLOITED status backed by a real exploit.

Pro: exportable web reports. A management summary in plain language plus full technical detail, exportable to Markdown and PDF.

Pro: interactive attack-surface map. A graph of nodes, connections and per-node vulnerabilities across the whole target.

Pro: scheduled recurring runs. Recurring automated campaigns with FOCUS, severity and recurrence built into the web dashboard.

Pro: campaign view. Every vulnerability in a campaign with its severity and confirmation status.

🔒 Pro: from finding to fix (automated remediation, paid)

🔒 Paid Pro feature. The open source engine finds and proves vulnerabilities. Automated remediation into pull requests is available only in Darkmoon Pro.

In the paid Pro tier, every finding flows finding → sandbox-validated fix → human-reviewed pull request, retested against the original exploit, and is never auto-merged. On our OWASP Juice Shop demonstration, the Pro remediation agent fixed 42 of 57 findings end-to-end with a clean live exploit-retest (a fix only counts when the original exploit is re-run and confirmed closed). See the remediation benchmark, the remediation agent docs and the 57 open PRs on ASCIT31/juice-shop.

▶️ Watch the demo (shows the Darkmoon Pro web dashboard)

What is DarkMoon?

DarkMoon is an open-source AI penetration testing platform. Point it at a target you are authorized to test, and it runs the whole assessment on its own: it reasons, plans, and dispatches 50 specialist agents that execute real offensive operations through a controlled MCP layer, then reports every vulnerability with the exact command, the raw output and the proof behind it.

It does not replace the pentester. It clears the repetitive part of an assessment with evidence, so your experts spend their time on judgment, not toil.

📊 Benchmark: 57 real vulnerabilities on OWASP Juice Shop

Real, reproducible black-box run against OWASP Juice Shop on a local LLM (nothing leaves your infrastructure):

Metric Result
Vulnerabilities found 57 (8 critical / 24 high / 21 medium / 4 low)
Wall-clock time 28.5 min
Proof-of-exploitation per finding
LLM local (Ollama / llama.cpp)

Reproduce it and compare tools yourself: ASCIT31/Darkmoon-Benchmarks.

🆚 How DarkMoon compares

DarkMoon strix shannon PentAGI
Runs on local LLM (data never leaves) ✅ ❌ cloud ❌ cloud partial
Privacy Gateway (local tokenization) ✅ ❌ ❌ ❌
Active Directory + Kubernetes ✅ ❌ ❌ partial
Proof-of-exploitation ✅ ✅ ✅ ✅
Open source ✅ GPL-3.0 ✅ ✅ ✅

Compiled from public repos/docs (2026-08); corrections welcome via PR.

How It Works

DarkMoon operates as a strategic AI security agent orchestrator aligned with ISO 27001, NIST SP 800-115, and MITRE ATT&CK methodologies.

When you provide a target, the platform automatically:

  1. 🔍 Discovers the target environment (ports, services, protocols)
  2. 🧠 Fingerprints the technology stack (frameworks, CMS, APIs)
  3. 🎯 Models the attack surface
  4. 🚀 Deploys specialized sub-agents based on detected technologies
  5. 🔬 Executes an intelligent vulnerability scanning loop with reactive adaptation
  6. ✅ Validates findings with evidence (requests, payloads, responses)
  7. 📝 Generates a structured audit report

Sub-Agent Orchestration

DarkMoon dynamically selects and dispatches specialized agents depending on the technologies discovered:

Detected Technology Agent Triggered
WordPress, Drupal, Joomla, Magento, PrestaShop, Moodle CMS-specific agent
PHP, Node.js, Flask, ASP.NET, Spring Boot, Ruby on Rails, Go Stack-specific agent
GraphQL GraphQL agent
LLM / AI inference endpoint (OpenAI-compatible, Ollama, vLLM, TGI) LLM agent
Active Directory AD agent
Kubernetes Kubernetes agent
AWS, Azure, GCP Cloud-provider agent
Entra ID (Microsoft identity) Identity agent
GitHub, GitLab, Jenkins SCM & CI/CD agent
Terraform, Ansible Infrastructure-as-Code agent
Docker, container registries Container agent
HashiCorp Vault Secrets agent
PostgreSQL, MySQL, MSSQL, Oracle Database agent
Redis, RabbitMQ, Kafka, MQTT Messaging & cache agent
Firmware / IoT images Firmware agent
Headless browser required Headless browser agent

Multiple agents can execute in parallel across hybrid architectures.

Planes that require credentials to be meaningful (cloud accounts, CI/CD, secret stores, databases, Active Directory, Kubernetes) are never dispatched on inference. They fire only when a concrete artifact is found (a key, a token, a reachable metadata endpoint) or when you authorize them explicitly, and are otherwise flagged in the report.

Note: For the complete list of agents, their structure, lifecycle, and how to create custom agents, see Full Documentation, AI Agents.

Architecture Overview

User ──> DarkmoonCLI ──> OpenCode (AI Brain) ──> MCP (Security Gatekeeper) ──> Docker Toolbox (Real Tools)

sequenceDiagram
  participant U as User
  participant O as OpenCode
  participant A as AI Agent
  participant M as MCP Darkmoon
  participant T as Docker Toolbox

  U->>O: User prompt
  O->>A: Delegate task
  A->>M: MCP function call
  M->>T: Execute real tool
  T-->>M: Results
  M-->>A: Structured output
  A-->>O: Next decision
  O-->>U: Summary / result

The AI reasons and plans. The MCP controls what can be executed. The Toolbox runs isolated tools inside Docker. The AI never directly touches the system, this is security by design.

Note: For the full architecture breakdown (deployment diagrams, network flows, security boundaries), see Full Documentation, Architecture.

Scope Definition

DarkMoon supports flexible scope definition directly from the command line.

Quick pentest (zero config):

./darkmoon.sh "TARGET: http://172.19.0.3:3000"

Bug bounty mode (flags activate automatically):

./darkmoon.sh "TARGET: http://172.19.0.3:3000 PROGRAM=\"Juice Shop\" FOCUS=sqli,xss,idor NOISE=moderate FORMAT=h1"

Key flags include FOCUS, EXCLUDE, CREDS, TOKEN, NOISE, SEVERITY, FORMAT, and more, all interpreted naturally by the AI.

Note: For the complete flags reference, asset types, EXCLUDE/FOCUS free-form syntax, and advanced multi-target scoping, see Full Documentation, Scope Definition.

Integrated Toolbox

DarkMoon ships with a purpose-built Docker image containing 50+ security tools compiled and optimized in a multi-stage build:

Category Tools (examples)
Port scanning Naabu (discovery), nmap (targeted service probes)
Web scanning Nuclei, ffuf, dirb, sqlmap, Arjun, wafw00f
Recon & crawling Subfinder, Katana, Waybackurls, httpx
CMS WPScan, CMSeeK, WhatWeb
Active Directory NetExec, BloodHound, Impacket (30+ scripts)
Kubernetes kubectl, Kubescape, Kubeletctl, kube-bench, rbac-police
Cloud CLIs aws, az, gcloud, gsutil, bq
Databases & cache psql, mysql, redis-cli, sqlite3
Firmware / IoT binwalk, unsquashfs, sasquatch, firmwalker
Cracking hashcat, john, 7z2john
Network Hydra, curl, dig, SNMP tools
Browser Lightpanda (headless)

All tools are directly accessible, no path configuration needed.

Note: For the complete tools list with installation details and how to add new tools, see Full Documentation, Toolbox.

📖 Documentation Guide

DarkMoon's Full Documentation covers everything you need to operate the platform. Here is a quick reference to the most important sections:

Topic What You'll Find Link
GPU & Driver Setup NVIDIA troubleshooting for Docker, WSL, and native Linux GPU Guide
Environment Variables LLM provider configuration, API keys, model selection Environment Config
Startup & Build install.sh behavior, docker compose build, stack management Build & Launch
Scope & Flags TARGET syntax, bug bounty mode, FOCUS/EXCLUDE, credentials Scope Definition
Assessment Workflow Step-by-step: discovery, fingerprinting, agents, reporting Assessment Engine
Real-Time Session Logs Monitor commands executed by the MCP server live Session Logs
AI Agents Agent structure, lifecycle, how to create or modify agents AI Agents
Architecture Deployment diagrams, security boundaries, execution flow Architecture
Toolbox Complete tool list, adding tools, Docker image internals Toolbox
MCP Workflows Workflow structure, creating custom workflows, best practices MCP Workflows
Available Tools List Full table of 50+ tools with paths and sources Tools List
Training Labs Recommended vulnerable labs to train DarkMoon Pentester Labs
Remediation Agent (Pro) Findings → sandbox-validated fix → pull request for human review (never merged) Remediation Agent
n8n Integration Community node to trigger a pentest, pull findings and review fix PRs from an n8n workflow n8n Node

Use Cases

DarkMoon is designed as a versatile security testing platform for:

  • 🔒 Security teams, run continuous automated penetration testing across your infrastructure
  • ⚙️ DevSecOps pipelines, integrate AI-driven security research into CI/CD workflows
  • 🎯 Bug bounty hunters, accelerate ethical hacking with autonomous target analysis
  • 🔬 Security researchers, explore attack surfaces with an AI cybersecurity platform that adapts in real time
  • 🎓 Training & education, learn offensive security with guided, reproducible assessments

Example Prompts

# Web application pentest
./darkmoon.sh "TARGET: http://172.19.0.3:3000"

# Active Directory assessment
./darkmoon.sh "TARGET: 192.168.1.10"

# Bug bounty with specific focus
./darkmoon.sh "TARGET: https://app.example.com PROGRAM=\"Example BB\" FOCUS=sqli,rce,ssrf EXCLUDE=H1 FORMAT=h1"

Note: For more prompt examples including DVGA, Juice Shop, and headless browser scenarios, see Full Documentation, Prompt Examples.

Contributing

DarkMoon is open source and welcomes contributions. Whether you want to add new agents, integrate tools, create workflows, or improve documentation, see CONTRIBUTING.md for guidelines.

License

This project is licensed under the GNU General Public License v3.0. See LICENSE for details.

Built by ASC-IT with 💚 for the global security community

🔒 Open Source · 🤖 AI-Powered · 🇫🇷 Made in France

⭐ Star us on GitHub · 📖 Full Documentation · ▶️ Watch the Demo (Pro dashboard)

Frequently asked questions

Is Dark-Moon free to use?

Dark-Moon is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does Dark-Moon do?

Open source autonomous AI penetration testing platform. 50+ specialist agents for AI security testing across web, API, cloud, Active Directory, Kubernetes, IoT

What is Dark-Moon written in?

Dark-Moon is primarily written in Python. Its source is publicly available at https://github.com/ASCIT31/Dark-Moon, and it has 957 GitHub stars.