RedAmon

RedAmon is an AI penetration testing framework for security teams testing systems they're authorized to assess. It connects attack-surface discovery, exploit testing and code fixes in one self-hosted workspace.

• Attack-surface mapping: Discover domains, exposed services, endpoints, leaked secrets and vulnerabilities, then explore their connections in a queryable Neo4j graph.
• Agent-led testing: Let AI agents choose tools such as Nmap, Nuclei, Metasploit and Playwright, investigate independent attack paths in parallel, and retain findings across sessions.
• Human oversight: Apply rules of engagement and approval gates to sensitive tools and phase changes, and steer an active assessment through chat.
• Fix pull requests: Have a coding agent implement fixes in the target repository and open GitHub pull requests.
• MCP connections: Add MCP servers as agent tools or let clients such as Claude Code, Codex CLI and Cursor drive the platform within assigned permissions.

The open-source Docker stack runs on your own machine or server under the MIT license, free for personal and commercial use. Testing tools run in isolated containers. The core stack requires at least 7 GB RAM and 80 GB free disk space; adding OpenVAS raises those minimums to 10 GB and 110 GB. Scan jobs and stored findings need additional capacity.

For local models, it supports Ollama, vLLM and LM Studio through OpenAI-compatible endpoints. Cloud providers include OpenAI, Anthropic, Gemini and AWS Bedrock; choosing those sends model requests to the selected provider. Scans don't require an external account. The security knowledge base works offline, with an external web-search fallback when local results aren't sufficient.