agent-smith
The pentest framework built for the tester who wants to think, not babysit. You bring the expertise. agent-smith brings 50+ tools, the methodology, and the execution — and the two of you close findings that neither could reach alone.
⚠️ Authorized testing only. Use against systems you own or have explicit written permission to test. Unauthorized access is illegal.
Why agent-smith
- 🧠 The LLM is the brain, not a payload library. Skills teach methodology; the LLM invents the actual attacks. No two scans look 100% alike.
- 🔗 Skills chain themselves.
/pentesterfinds an injection point and pivots into/web-exploit;/codebasefinds an LLM call site and pivots into/ai-redteam. The agent decides what runs next based on what it just found. - 🛠 Bring your own LLM. Claude Code, OpenAI Codex, OpenCode (any provider — OpenAI, Gemini, Ollama, OpenRouter, local models), or any MCP-capable client. Smith auto-scales its context budget to small / local models, so it even runs fully local on your own GPU — no API bills, nothing leaving your network. (setup →)
- 📦 End-to-end deliverables. Findings, PoCs (Burp-ready
.httpfiles), threat models, code patches, GitHub issues, and CVE submission packages — all generated for you. - 🐳 Sandboxed by default. Every scanner runs inside an ephemeral Docker container. Hard cost / time / call-count limits enforced server-side.
- 🔍 Depth enforcement. A background QA daemon watches Smith and pushes it to go deeper — catching stalls, premature completion, and shortcut behaviour, escalating to you when it's genuinely stuck. (details →)
- 🧪 Evidence, not guesses. Every finding is artifact-backed and passes a senior-review adjudication gate. Blind vulns are confirmed out-of-band via a callback server; multi-step attacks are recorded as proven exploit chains; white-box findings carry a source trace whose
file:lineis resolved against the repo — a hallucinated location is rejected at the door. - 📊 A dashboard built for collaboration. Watch findings, topology, coverage, and the threat model populate in real time at
localhost:7777— and steer Smith mid-scan, respond to intervention pauses, and fulfill its resource wishlist. (API →)
The new way: skills as pattern teachings
Most pentest automation ships a giant payload library and runs it linearly. agent-smith does the opposite. Skills are not scripts — they are prompts that teach the LLM a way of thinking. A skill describes the vulnerability class, the surface area, the verification logic, and the chaining rules, then leaves the actual attacks to the model.
| Traditional security tools | agent-smith |
|---|---|
| Fixed payload list | LLM-generated payloads, contextual to each target |
| One tool per phase | Skills compose — /codebase enriches /pentester, which enriches /post-exploit |
| Stops at first success | Keeps probing until the cost / time / coverage budget is hit |
| Generates a PDF | Findings, PoCs, patches, threat models, coverage matrix, CVE packages, and more |
| Same scan every time | Two runs against the same target produce different attack paths |
The skills are inspiration. The LLM is the operator.
See it in action
What you can do
Drop any of these the moment you start your client. /pentester orchestrates everything; the single-purpose skills give you laser focus.
| Command | What it does |
|---|---|
/pentester scan https://staging.example.com depth=thorough |
Full hands-off engagement: OSINT → recon → web-exploit → post-exploit → report |
/codebase path=./src |
White-box OWASP ASVS 5.0 review across 16 chapters / 427 requirements |
/analyze-cve lodash 4.17.20 CVE-2021-23337 |
Traces a CVE from user input to sink in your tree, decides if you're exploitable, writes a Burp PoC |
/ai-redteam https://your-app.com/api/chat depth=thorough |
OWASP LLM Top 10 (2025) + AITG v1 + MCP Top 10 runtime attacks |
/request-cves |
MITRE CVE form + GHSA draft + disclosure report + vendor email, per qualifying finding |
/threat-modeling |
PASTA + STRIDE — component map, data-flow diagram, attack tree, risk register |
💡 35+ skills total — full catalog and chaining map in docs/skills.md.
Two ways to work with Smith
The industry is racing toward full automation. We think that's the wrong finish line.
The best pentests have always been about the interplay between a skilled tester and their tooling — the tester brings context, intuition, and judgment; the tools provide speed, coverage, and consistency. agent-smith is built around that conviction. Autonomous mode exists and it's genuinely powerful, but Augmented mode is where the framework does its best work: Smith handles 50+ parallel tool runs, tracks coverage, and writes the deliverables, while you stay in the loop to redirect scope, respond to intervention pauses, and make the calls that no AI should make alone.
The dashboard isn't a progress bar — it's the collaboration interface.
Quick start
| Requirement | Notes |
|---|---|
| Docker Desktop | Must be running — all scanners are sandboxed |
| Poetry | curl -sSL https://install.python-poetry.org | python3 - |
| One LLM client | Claude Code · Codex · OpenCode (BYO LLM) · any MCP client |
| Node.js v18+ | Optional — server-side Mermaid pre-rendering |
git clone --recursive <repo>
cd agent-smith
./installers/install.sh # Claude Code (or install_codex.sh / install_opencode.sh)
⚠️ After install, fully restart your client — the MCP server connects at startup.
Full setup — other clients (Codex, OpenCode, custom MCP), self-hosted local models (vLLM / DGX Spark), Windows / PowerShell, and the optional Kali & Metasploit images → docs/installation.md.
🛡️ Running a real engagement? Smith ingests attacker-controlled data and can run commands, so prompt injection is a design reality — run it in an isolated, disposable VM. See docs/production-isolation.md.
How it works
You (/pentester scan target.com)
└── Your LLM (Claude / GPT / Gemini / local …)
└── MCP server (python