redcell orchestrates a team of LLM agents that execute authorized penetration tests inside a Kali container and generate the final report, with a human operator steering every run.
| Tool | martian56/redcell — multi-agent AI platform that runs penetration tests end to end and writes the report |
| Category | Autonomous offensive-security agent platform (orchestration + execution + reporting) |
| Primary Use | Authorized pentests and lab engagements where LLM agents plan, delegate, run real tools like nmap, nuclei, and sqlmap, and produce a PDF/SARIF report |
| Safe Use | Strictly for education, research, and legal, authorized testing of systems you own or have explicit written permission to test within an agreed scope; the README ships bundled practice targets (DVWA, Juice Shop, WebGoat) for lab use |
| Telemetry Note | Runs execute real tools (nmap, nuclei, Metasploit modules, chisel tunnels) from a Kali container, so defenders see ordinary scanning and exploitation traffic; the platform itself leaves per-session records in PostgreSQL, Redis, and MinIO, and checkpoints every run |
redcell is an ambitious attempt to wrap an entire penetration test — planning, execution, loot handling, and reporting — inside one multi-agent LLM pipeline. The README describes an orchestrator agent that plans the engagement and delegates objectives to executor agents, which run real offensive tools inside a Kali container and report findings, loot, and hosts back into a shared state. What distinguishes it from thin CLI wrappers around a chat model is the operator console: a human sits in the loop with a chat that steers the live orchestrator, a live agent graph, terminals on caught reverse shells, and a browser view of the agent-driven Chromium, and the screenshot even shows the agent pausing to ask permission before dumping a user table. That interaction model — agent proposes, operator approves — is the responsible design choice that makes this interesting rather than reckless.
The engine is a LangGraph plan/act loop with LiteLLM as the model abstraction layer, which means the operator can point it at OpenAI, Anthropic, Google, GLM, DeepSeek, Kimi, or a local Ollama instance. This provider-agnostic design matters for two reasons: cost control (you can run cheap local models for grunt work) and data governance (an engagement's findings never need to leave your infrastructure if you choose an on-prem model). Every run checkpoints as it goes, so a crash or restart resumes mid-engagement instead of burning tokens re-scanning targets — a practical detail that suggests the authors have actually run long engagements with flaky infrastructure.
Structured tools are where the architecture gets thoughtful. Rather than letting the model freestyle shell commands for everything, redcell ships dedicated wrappers for nmap, nuclei, directory and vhost discovery, and Metasploit search and execution, each parsing its own output into the attack surface and findings stores so a scan records hosts and vulnerabilities without a follow-up step. A generic run_command tool covers the long tail. This is the correct pattern for agent reliability: parse structured tool output into typed state once, instead of hoping the LLM correctly re-reads raw nmap stdout on every turn. The findings triage workflow — verify, dismiss, merge duplicates — is another signal that the authors understand LLM output is noisy and that a report full of hallucinated findings destroys client trust.
Execution happens in a Kali container driven over docker exec, selectable per session as localhost or a saved remote server, with the remote path running the same container over SSH with host networking. Two capabilities stand out for authorized engagement realism: the agent browser, which drives a real Chromium for login flows and JavaScript-heavy apps shell tools cannot reach, with live operator takeover; and network pivoting, where tool traffic routes through a caught reverse shell via a chisel reverse SOCKS tunnel to reach hosts only visible from the compromised machine, with nmap running through the tunnel automatically. The pivot support in particular tells you this is aimed at multi-segment internal assessments, not just web app scans. All of these are capabilities to exercise only inside an explicitly scoped, contracted engagement or a lab.
The stack is serious, not a weekend script: Python 3.12, FastAPI, async SQLAlchemy + asyncpg, Alembic migrations, arq workers, PostgreSQL, Redis pub/sub, MinIO for files, asyncssh, and a React 18 + Vite + TypeScript + Tailwind frontend with TanStack Query and xterm. Critically, the API process never runs agents — it queues a run, the worker executes it, and output flows back over Redis channels relayed to the browser via WebSockets. That separation of control plane and execution plane is the kind of decision you see in production systems, and it maps cleanly onto horizontal scaling if you wanted multiple concurrent engagements. Tooling choices (uv for Python, bun for the frontend) are modern and fast.
Installation is a standard multi-service bring-up: docker compose -f docker-compose.dev.yml up -d for infrastructure, then uv sync --group live, uv run rc db upgrade, and uv run rc seed, before running the API, worker, and web app as three processes — or honcho start off the included Procfile. The default login is admin / admin, which you should change immediately on anything beyond a local trial. The Kali execution image lives at ghcr.io/martian56/redcell-kali:latest, and a REDCELL_RUN_MODE=sim switch in .env makes runs replay against canned output instead of touching anything real — a genuinely useful mode for evaluating the platform, demoing it, or training operators without a target range.
The bundled practice targets deserve emphasis for the authorized-use posture: docker compose -f docker-compose.targets.yml up -d spins up DVWA, Juice Shop, and WebGoat locally, giving newcomers an entirely legal surface to aim the agents at. The README's legal notice is unusually specific — acceptable use is limited to your own systems, deliberately vulnerable practice targets, CTF events, and contracted engagements with the target owner's explicit written permission and a defined scope, with a pointed reminder about criminal liability. A self-hosting path via ./deploy.sh handles Docker install, Caddy reverse proxy, Let's Encrypt certificates, and three deployment topologies including behind Cloudflare, and only ports 80 and 443 are published while Postgres, Redis, and MinIO stay on the internal network.
Reporting closes the loop: the session's model generates the write-up, cleaned up to read naturally, with an executive summary, methodology, findings, and prioritized remediation, exported as PDF plus JSON and SARIF. The SARIF output means findings can be ingested directly into defect trackers and code-scanning pipelines, which positions redcell as a potential continuous-assessment component rather than a one-off engagement tool. The code-scan session mode — point it at a public git repo or local folder for source review with findings mapped to file and line — extends it toward the audit side of the house.
From a defensive and operational-risk standpoint, the documentation set is a good sign: docs/HARDENING.md covers threat model, secrets, scope guardrails, and retention; docs/PRE-AUTH-SURFACE.md enumerates what an unauthenticated client can observe; docs/COST.md addresses token accounting, which is the silent failure mode of agent platforms. Provider API keys and scope guardrails live in the Settings page and are stored encrypted, with REDCELL_SECRET_KEY as the Fernet key for stored credentials. Watch items for any deployer: the admin password bootstrap, the sim/live mode defaulting to live (real tools run by default), and the fact that an agent with run_command and Metasploit access is only as scoped as your guardrail configuration. As an object lesson in how to build human-in-the-loop offensive AI, redcell is well worth study; as a tool, it belongs squarely in labs and contracted engagements.
martian56/redcell.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.