vulnerator-ai chains a Hermes LLM agent to a containerized Kali runtime over MCP, running autonomous Observe-Orient-Decide-Act pentest loops for authorized assessments and lab environments.
| Tool | irraz/vulnerator-ai — an autonomous OODA-loop pentesting agent built on Hermes, Kali tooling, and MCP |
| Category | LLM-driven offensive security automation / agentic pentesting framework |
| Primary Use | Automating authorized penetration tests in lab or contract-scope environments, where a Hermes-driven loop orchestrates nmap, nuclei, ffuf, sqlmap and a playwright browser end to end |
| Safe Use | Strictly for authorized penetration tests, practice labs such as the bundled OWASP Juice Shop, and security research — the README itself warns the engine ships with no guardrails and must only be pointed at targets you are licensed to test |
| Telemetry Note | Against a monitored target the Kali container behaves like standard tooling (nmap, nuclei, ffuf scans, Chromium-driven browsing, Caido proxy traffic), so defenders will see conventional scanning and fuzzing signatures; internally every tool call is traced in the web GUI with terminal replays |
vulnerator-ai is a Python project, currently at 202 stars with an MIT license, that attempts something the offensive-security community has been circling for a while: a genuinely autonomous pentest loop rather than an LLM chat wrapper around a tool list. The design is an OODA loop — Observe, Orient, Decide, Act — where the reasoning brain is Hermes from Nous Research and the hands are a Kali Linux container governed by an MCP server. Hermes decides what to run and launches it directly against the target through kali-mcp, with MITRE ATT&CK serving as what the README calls the Orient language of the loop. The whole thing is documented, containerized with Docker, and explicitly framed for authorized use.
The architecture diagram in the README reveals a deliberately flat topology. There is no core service, no REST API of its own, no UI layer in the control path, and — the README is blunt about this — no gates. The moving parts are the agent itself (ooda-agent, running nousresearch/hermes-agent with an OpenAI-compatible API server on :8642), the kali-mcp tool server on :8900, a playwright-mcp headless-Chromium server on :8931, the Caido web-security toolkit reachable only on the internal network, a thin vulnerator-mcp front door, a web GUI, and two live-screen containers that mirror what the agent is doing. The agent talks straight to the MCPs; the GUI observes but never drives.
The kali container is the deterministic runtime for a curated pentest arsenal: the README names nmap, whatweb, nuclei, ffuf, sqlmap, and Prowler among others. The key architectural choice is that tool execution is decoupled from reasoning — Hermes emits tool calls over MCP, the Kali container executes them deterministically, and results feed back into the next Orient phase. This is a sensible split: LLMs are unreliable executors of precise CLI syntax, so pushing execution into a governed container keeps the agent honest about what actually ran and what it returned. An opt-in scope-guard is described in docs/security.md, which matters given the default posture.
The web surface is handled by playwright-mcp, a real headless Chromium that backs the web-pentest skill. More interesting is browser-view, a visible Chromium stack built on Xvfb, x11vnc, and noVNC, exposed on :6080, so an operator can literally watch the agent browse in real time from the console's Screens tab. A parallel caido-director container on :6090 re-enacts the agent's caido_* actions on the pre-authenticated Caido UI — opening the Replay session, typing the HTTPQL filter, opening packets — turning what would otherwise be opaque agent behavior into a reviewable demonstration.
Caido itself is integrated as a first-class citizen rather than an afterthought. The kali-mcp server reaches it over its GraphQL API at http://caido:8080, deliberately not published to the host, and uses it for proxy capture of kali_run traffic, Replay, HTTPQL history, Automate fuzzing, and interception. The README notes it is zero-touch: headless guest login, persistent volume, pinned image. For an analyst reviewing an agent's HTTP-level reasoning afterward, having the full proxied history in one place is a meaningful audit artifact.
The vulnerator-mcp front door is the piece that lets external MCP clients — the README names Claude Code, Kiro, and BugTraceAI — trigger, observe, steer, and stop runs. It is up by default and deliberately exposes only the run lifecycle (start_pentest, get_run_status, stream_run_events, steer_run, stop_run), never raw kali_run or /v1/chat/completions. That boundary is a thoughtful chokepoint: steering an in-flight assessment from your assistant of choice without handing the assistant unrestricted shell-equivalent execution. It authenticates to Hermes' :8642 runs API with an HTTP Bearer token, and stdio mode keeps the MCP registration at zero network surface.
Model-wise, Hermes runs Mistral Large 4 as primary through OpenRouter with automatic fallback to GLM-5.3 Flash on rate limits or errors, both chosen for the same Cyber Index score of 50% but different cost/performance trade-offs. Local inference via Ollama is covered in docs/configuration.md, along with AWS credentials handling — relevant if you would rather your assessment reasoning not transit a third-party API. The fallback mechanics are documented in docs/llm-fallback.md, which is the kind of operational detail most agentic-security projects skip entirely.
Deployment is refreshingly contained. The installer, ./install.sh, checks for docker, docker compose v2, and openssl, auto-generates the two secret tokens (HERMES_API_SERVER_KEY, VULNERATOR_MCP_INBOUND_TOKEN), writes the .env from the template, and brings up the default stack; the only thing you supply is your OpenRouter API key. A --with-juice-shop flag additionally starts an OWASP Juice Shop practice lab — the correct first destination for this tool. The interactive TUI is reached via docker compose exec -it ooda-agent hermes chat. Full procedure lives in docs/RUNBOOK.md, with manual setup (cp .env.example .env, token generation via openssl rand -hex 32, docker compose up -d --build) in a details block.
Observability is where vulnerator-web earns its place. Beyond the live OODA terminal and a Copilot view of running tools, browser actions, and Caido traffic, it produces Langfuse-style traces of every tool call and — notably — PoCs accompanied by the OODA path that led to them plus a recorded terminal replay in .cast and .md formats. For a professional deliverable, that provenance chain is the difference between an LLM's claim and a reproducible finding; a sample redacted report is included at docs/example-report.md. The GUI itself is observer-only and runs at http://localhost:9100, alongside links to the Hermes Dashboard (:9119) and Webapp (:9120).
The honest caveat, which the README states in bold rather than burying, is that by default the product has no guardrails: no scope-guard, no consent mechanism, no audit gate. The authors lean into this as a design philosophy documented in docs/security.md, and the assistant-setup prompt in the README even instructs the configuring LLM to remind the user the engine must only be used against authorized targets. That transparency is better than silent scoping, but it shifts the entire burden of authorization discipline onto the operator. Point this at anything you do not have written permission to test and you are simply running an automated attack tool.
Hygiene is otherwise above average for the genre: a security.yml GitHub Actions pipeline, PR Quality Checks, CodeQL code scanning, and a documented security pipeline in .github/SECURITY-PIPELINE.md. A demo video, project site at irraz.github.io/vulnerator-ai, a DeepWiki integration, and an active Discord round out the project surface. For defenders, note that from the target's perspective the Kali container produces conventional signatures — nmap sweeps, nuclei template scans, ffuf fuzzing traffic, Chromium user-agent browsing — so standard scanning detection applies; the autonomy is on the operator's side, not in the packets.
Where this fits: vulnerator-ai is best understood as a reference implementation of agentic OODA pentesting — one brain, two MCP tool servers, an observability layer, and an explicit refusal to pretend safety comes for free. For authorized assessors and lab operators it offers a credible way to study how an LLM actually navigates a target, complete with traceable findings; for blue teams, studying its architecture is a preview of what automated offensive tooling will increasingly look like. Run it against Juice Shop, read the traces, and treat the no-guardrails warning as the operational contract it is.
irraz/vulnerator-ai.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.