DarkMoon

A self-hosted AI penetration testing platform that validates vulnerabilities with real payloads and works with local LLMs through Ollama or llama.cpp.

DarkMoon runs autonomous penetration tests for security teams, DevSecOps engineers and red teamers. It discovers a target's technology stack, assigns specialist AI agents and tests vulnerabilities across connected systems.

Broad attack coverage: Agents assess web apps, APIs, Active Directory, Kubernetes, AWS, Azure, GCP, CI/CD, databases and IoT firmware, including attack paths across systems.
AI endpoint testing: A dedicated agent probes AI inference endpoints for the OWASP LLM Top 10.
Evidence-backed findings: Reports include the commands, payloads and raw output behind findings, with separate exploited, confirmed and unconfirmed classifications and Markdown or JSON exports.
Local data masking: The Privacy Gateway replaces sensitive addresses, hostnames and credentials with placeholders before model requests, restores values locally for tool execution and masks the output again.
Development integrations: GitHub Actions, GitLab CI/CD and Jenkins bring assessments into build pipelines, while VS Code and JetBrains integrations let developers view findings in their editors.

The free, open-source command-line engine is self-hosted under GPL-3.0 and runs security tools inside Docker. It supports local LLMs through Ollama and llama.cpp, plus external providers Anthropic, OpenAI and OpenRouter. Local models keep assessment reasoning on your infrastructure; external providers receive masked model requests. A controlled MCP gateway checks tool calls rather than giving the model direct shell access. The paid self-hosted Pro edition adds the web dashboard and human-reviewed automated remediation; a managed testing service is also available.