Feroxmute

feroxmute

LLM-powered penetration testing framework with autonomous agents.

⚠️ **Vibecoded and under heavy development.** Expect breaking changes, rough edges, and the occasional chaos.

feroxmute automates security testing using a hierarchy of specialized AI agents. An orchestrator plans the engagement and delegates to recon, scanner, exploit, and report agents - all executing tools inside a Kali Linux Docker container while you watch from a terminal UI.


Features

• Hierarchical agent architecture - Orchestrator delegates to specialist agents (recon, scanner, exploit, report, script)
• Multi-provider LLM support - Anthropic, OpenAI, Gemini, Cohere, xAI, DeepSeek, Azure, Perplexity, Ollama, and LiteLLM (powered by rig). Tested primarily with Gemini 3 Pro and Gemini 3 Flash.
• CLI agent providers - Drive Claude Code, Codex, or Gemini CLI as LLM backends via the Agent Client Protocol (ACP). Tools are exposed over an ephemeral MCP server.
• Docker isolation - All tools run inside a Kali Linux container
• Terminal UI - Live dashboard showing agent activity, tool output, and findings
• Session persistence - SQLite-backed state with resumable sessions
• Agent memory - Persistent scratchpad for orchestrator context (press p in TUI to view)
• SAST support - Link source code to web targets for combined analysis
• Engagement controls - Passive mode, port restrictions, rate limiting, scope limitations

Vulnerability Playbooks

Agents have access to 17 specialized playbooks that guide testing for specific vulnerability classes. Scanner and exploit agents can request playbooks using the `get_playbook` tool when they identify potential attack vectors.

Each play