Repository intelligence

Armur-Ai/Pentest-Swarm-AI

An open-source pentesting platform built on a real swarm architecture where dozens of agents work a target surface concurrently, coordinating through a shared stigmergic blackboard.

CLOUDM0N decision

REVIEW BEFORE ADOPTION

Trust REVIEW · 65/100

Good fit if

Security teams needing to test changing attack surfaces at machine speed with evidence-backed reports

Watch out for

The stigmergic swarm scheduler is currently in alpha status

Practical intelligence

What matters before you adopt it

Decision first · detail on demand

Problem it solves

The gap between automated security scanners that flag thousands of unverified potential issues and expensive human consultants who only show up once a year.

Best for

Security teams needing to test changing attack surfaces at machine speed with evidence-backed reports

Users wanting to run automated, authorized penetration testing with full privacy and zero API costs using local LLMs

Participants in authorized bug bounty programs, CTF competitions, or educational research

Main trade-offs

The stigmergic swarm scheduler is currently in alpha status

The Postgres blackboard backend is in beta, with the runner temporarily defaulting to an in-memory board

The live dashboard interface is in alpha status with live campaign wiring still in progress

Why it stands out

Runs on any model (Claude, OpenAI-compatible, security-tuned open models, or fully local Ollama/LM Studio)

Exploits what it finds and captures real evidence to prove vulnerabilities before writing reports

Enforces strict scope control at both the tool layer and execution layer to prevent out-of-scope testing

Trust & CVEs

Security evidence without the noise

Trust remains a decision signal; CVEs and scanner evidence explain what is driving the risk.

Security findings

CLOUDM0N scanner findings

Critical

High

Medium

Low

View trust evidence & security findings▼

Why this score

No trust rationale was stored for this scan.

CLOUDM0N findings

HIGH

Remote download piped or chained into a shell requires manual review. 1 sample match(es) found.

MEDIUM

The project can spawn operating-system processes; review command construction and input handling. 2 sample match(es) found.

Architecture from code41 modules · 0 edges▼

Structural evidence

Modules and dependency edges extracted from repository code. This is code evidence, not README inference.

Code files

Modules

Dependency edges

Core modules

deploy

1 files

legacy

1 files

training

9 files

web

9 files

Dependency flow

No dependency edges were extracted.

Detected languages

Go · Python · TypeScript · SQL · JavaScript · Shell

Detected frameworks

Anthropic SDK · NumPy · PyTorch · Pydantic · scikit-learn

Architecture evidence details

flowchart TD
    %% repo — high-level architecture (DRAFT, refine me)
    n0["deploy · 1 file"]
    n1["legacy · 1 file"]
    n2["training · 9 files"]
    n3["web · 9 files"]

Evidence, security & integrations▼

Integrations

ClaudeOllamaLM StudioOrcaRouterProjectDiscovery toolchain (subfinder, httpx, nuclei, naabu, katana, dnsx, gau)nmapPostgres 16 + pgvectorRedis 7

Security notes

• Target scope is strictly enforced at both the tool layer and executor layer to prevent out-of-scope traffic

• Full data privacy is preserved when using 100% local models (Ollama/LM Studio), ensuring no data leaves the local environment

• Unauthorized testing of systems without explicit written permission from the owner is illegal

• Future roadmap includes agent-memory poisoning hardening (MINJA / MemoryGraft defences)

Still unknown

• The README does not provide concrete system resource requirements (e.g., CPU, RAM) or recommended hardware for running local swarms

• No official performance benchmarks or comparisons against human teams are included (noted as planned for a future Wave 3 release)

• The README does not specify how 'budget exhaustion' or target cost limits are configured or calculated

Adoption guidance▼

Adopt if

+ You need a parallel, machine-speed pentesting tool that actually exploits vulnerabilities and collects evidence rather than just listing static findings

+ You require strict local data privacy and zero API costs using local LLMs (Ollama/LM Studio) or air-gapped setups

+ You want to deploy automated, scope-safe security testing directly inside CI/CD pipelines via GitHub Actions

Avoid if

– You require a highly stable, production-ready stigmergic swarm scheduler or live dashboard, which are currently in alpha status

– You plan to distribute modifications or host the engine as a paid SaaS but are unwilling to open-source your changes under the AGPL-3.0 license

– You do not have explicit authorization or ownership over the target network systems

How it works & getting started▼

How it works

1.Multiple independent agents run their own trigger predicates and monitor a shared Postgres/in-memory blackboard

2.An agent writes a newly discovered finding (e.g., PORT_OPEN) onto the blackboard

3.The finding gains a type-specific pheromone weight which attracts relevant specialist agents (e.g., classifier, exploit)

4.The pheromone weight naturally decays over time to clear stale paths and focus the swarm on active chains

5.Vulnerabilities are validated and exploited to capture concrete proof, which the reporting agent compiles into a final document

Getting started

→ To run a demo campaign offline: run 'pentestswarm demo'

→ To spin up an offline Juice Shop local lab: use the '--lab' flag

→ To scan a real target with your configured model: run 'pentestswarm' with your target URL and model settings

Agent handoff

Use with any agent

JSON API

Alternatives

Nearby repositories worth comparing before adoption.

Compare top options →

signoz

SigNoz/signoz

Fit

SigNoz is an open-source, OpenTelemetry-native observability platform for your team and their AI agents. Get logs, metrics, and traces in one tool with features like APM, distributed tracing, log management, infra monitoring, etc. Combined with SigNoz MCP and a native AI teammate (in SigNoz Cloud) it helps you build more resilient apps.

Trust REVIEW · 90

Compare →

agentops

AgentOps-AI/agentops

Fit

Python SDK for AI agent monitoring, LLM cost tracking, benchmarking, and more. Integrates with most LLMs and agent frameworks including CrewAI, Agno, OpenAI Agents SDK, Langchain, Autogen, AG2, and CamelAI

Trust REVIEW · 80

Compare →

coze-loop

coze-dev/coze-loop

Fit

Next-generation AI Agent Optimization Platform: Cozeloop addresses challenges in AI agent development by providing full-lifecycle management capabilities from development, debugging, and evaluation to monitoring.

Trust REVIEW · 80

Compare →