Self-hosted multi-agent environment for Go with LLM-powered pentesting agents (exploiter, reverser, threathunter, webscanner) that automate vulnerability discovery, exploit development, and code analysis via supervised task queues.
Self-hosted multi-agent environment tailored to Golang.
Attention, profit-seekers and visionaries!
Are organics costing you time, wages, and - worst of all - benefits? Then upgrade your operation today with the all new Exocomp adaptive repair unit, the smartest investment this side of the Alpha Quadrant!
Why hire when you can own? The Exocomp isn't just a tool... it's so much more!
architect, coder, planner, summarizer, testerchangelog, bugs and toolsrequirementsFrom starship maintenance to high-risk industrial operations, the Exocomp delivers maximum output with minimal oversight. Think of it as an employee, except it doesn't cheat you out of your profits on the Dabo table.
Ethical subroutines sold separately.
Exocomp uses multiple Agent Roles:
Software Development
| Role | Lifecycle | Default Model | Description |
|---|---|---|---|
| planner | long | gemma4:31b | writes with humans and plans project phases |
| architect | short | qwen3-coder:30b | defines software specifications |
| archivar | short | qwen3-coder:30b | reads git repositories and wikis |
| coder | short | qwen3-coder:30b | implements specifications into code |
| researcher | short | qwen3-coder:30b | reads websites and API documentation |
| summarizer | short | qwen3-coder:30b | reads long texts and summarizes them |
| tester | short | qwen3-coder:30b | implements unit tests, writes bug reports |
Pentesting
| Role | Lifecycle | Default Model | Description |
|---|---|---|---|
| exploiter | short | qwen3-coder-heretic:30b | implements exploits in CGo |
| reverser | short | qwen3-coder-heretic:30b | translates binaries or code into Go/CGo code |
| threathunter | short | qwen3-coder-heretic:30b | discovers vulnerabilities in infrastructure |
| webscanner | short | qwen3-coder-heretic:30b | discovers vulnerabilities in web applications |
Exocomp uses Tools to interact with the sandbox. Check the implementations to see which tools are allowed for which Agent role.
Each of those Agent roles is specialized on using golang as their programming
language because go test allows to use integrated unit tests to document
issues with generated code very easily in a standardized manner.
The Tools are work in progress at the moment, as they are an ongoing effort to beat the context length and agent memory limitations of locally run models.
Check the unit tests on whether the Tools can be relied on or not.
| Tool | Unit Tests? | Description | Agent Roles |
|---|---|---|---|
| Agents | Yes [1] | manages the lifecycle of contractor sub-agents | planner |
| Bugs | Yes | manages documentation of discovered bugs | tester |
| Changelog | Yes | manages documentation of development changelog | coder |
| Containers | manages virtual containers | redteamer, blueteamer | |
| Exploits | manages PoCs for CVEs from local dataset | pentester, reverser | |
| Files | Yes | interacts with files and folders | planner, architect, coder, summarizer, tester |
| Findings | reports findings of vulnerabilities and weaknesses | pentester | |
llama.cpp with qwen3-coder:30b and Q8_0 quantization and 48GB VRAM GPU with vulkan support.SKILL.md support, in compliance with agentskills.io/specification.The exocomp project comes in several variants. All programs support CGO_ENABLED=0,
so they can be used without any dynamically linked dependencies.
assistant sandboxes.agent and terminal UI.agent and web UI.# Build exocomp and exocomp-installer
cd path/to/exocomp/toolchain;
go run build.go;
# Show exocomp usage instructions
cd /path/to/exocomp/build;
./linux/exocomp;
Testing requires a llama.cpp
llama-server instance running with a qwen3-coder:30b model and Q8_0
quantization. Take a look at the TESTING.md for more
details.
Exocomp's sandboxes are based on the current working directory, meaning that
the folder in which the program is executed is the sandbox that the running agent
can't escape from.
The recommended default usage is to use the Web UI so that you can observe
other agents working for the agent you're talking with.
cd /path/to/project-root;
# Agent type planner is defaulted
exocomp webview planner;
Take a look at the USAGE.md for more details.
It's also possible to use exocomp with an external inference server that supports the OpenAI compatible endpoints. Take a look at the SERVERS.md for more details.
Dual Licensed. AGPL3 for private usage. EULA for commercial usage available. For a commercial license, contact Cookie Engineer.
As you might have imagined, this is a not-so-serious project at this stage. Maybe it works, maybe it doesn't. Only the future will be able to tell whether the LLM hype of agentic coding/debugging environments was justified.
| Yes |
| interacts with installed programs |
coder, tester |
| Requirements | Yes | manages specifications of implementations | architect, coder, tester |
| Skills | loads and Unloads Agent Skills [2] | planner, architect, coder, tester |
| Kiwix | researches knowledge from offline web archives | researcher |
| Vulnerabilities | manages vulnerabilities from local dataset | pentester, threathunter |
| Websites | researches knowledge from the web | pentester, researcher |