Decepticon — Autonomous Red Team Agent

"Another AI hacker? Let us guess — it runs nmap and writes a report."

What the OSS agent does

• Start with approved scope: CLI creation asks for an engagement name and defaults to Red. Import reviewed scope with /scope import <file> --confirm, then approve it with /mode red approve before execution. Use /mode plan explicitly for optional planning, or /mode blue for connected local sensor investigation. The web dashboard has its own setup form and mode selector. Engagement workflow.
• Terminal controls: searchable mode/model/session pickers, multiline prompts, private draft/history persistence, queued messages, independent Blue monitoring status, incident details, conversation export and read-only decepticon doctor. CLI reference · Upgrade notes.
• Runs specialist operations: agents cover reconnaissance, vulnerability research, exploitation, Active Directory, cloud, and other domains. They execute in an isolated sandbox; BloodHound CE, Sliver C2, and other specialist workloads start when needed. Agent roster · Architecture.
• Autonomous reverse engineering: when a binary found during an engagement needs deeper analysis, the Reverser starts the optional REA workload and uses its Ghidra provider through discovered MCP tools. REA keeps the binary-bound analysis session and saves the original Evidence bundle before results reach the agent. How REA reversing works.
• Blue Cell defense: a local sensor observes requests to your web service and optional application logs. A resident defensive agent investigates suspicious events and reports incidents in the CLI alongside the Red engagement. It observes and reports; it does not automatically block traffic. Blue Cell setup and coverage.
• Makes work reviewable: the workspace and knowledge graph retain findings and attack context. The optional web dashboard streams agent activity and shows the plan, findings, and attack graph. Web dashboard · Knowledge graph.

---

Install

Prerequisites: Docker and Docker Compose v2. Supported on macOS (Apple Silicon + Intel), Linux (amd64 + arm64), and Windows (amd64 + arm64) — native via PowerShell or via WSL2 (Ubuntu / Kali).

macOS / Linux / WSL2

curl -fsSL https://decepticon.red/install | bash
decepticon onboard   # Interactive setup wizard (provider, API key, model profile)
decepticon           # Start the core stack and drop into the terminal CLI

The default start brings up the core management plane (LiteLLM, PostgreSQL, Neo4j, Skillogy, LangGraph, sandbox) and launches the terminal CLI. Specialist workloads (BloodHound CE, Sliver C2, REA/Ghidra, …) and the web dashboard come up on demand — the orchestrator spawns specialists via ops_start("ad") etc., and you bring up the dashboard from inside the CLI with /web (see Web Dashboard).

Windows (PowerShell, native)

irm https://decepticon.red/install.ps1 | iex
decepticon onboard
decepticon

→ Quick start · Full setup walkthrough

Use from Claude Code or Codex

After starting Decepticon, register its MCP server in your coding agent:

claude mcp add --scope user decepticon -- decepticon mcp serve
codex mcp add decepticon -- decepticon mcp serve