Autonomous, multi-model penetration-testing harness — Rust, CLI-only.
by Joas A Santos & Red Team Leaders

⭐ If this is useful, star the repo — it helps a lot.

📖 New here? Read the full Tutorial & User Guide → — every mode, flag, config and example explained. Version-by-version changes live in RELEASE.md.

NeuroSploit turns a URL, a source repository, a running app, or a host/IP into an autonomous security engagement. A Rust harness (tokio) drives a pool of LLMs — via API key or local subscription (Claude Code / Codex / Gemini / Grok) — recons the target, intelligently selects only the agents that match the discovered surface, runs them in parallel, chains findings into deeper impact, and validates every claim by cross-model voting + tool-receipt grounding before reporting. It ships 435 markdown agents and a Mission Control TUI.

Engagement modes

Highlights

• 🧠 POMDP belief + value-of-information — the target is partially observable, so findings aren't booleans: a property-graph belief carries probabilities, and "scan more vs exploit now" falls out of belief entropy. The may_assert gate is a mathematical anti-hallucination rule (don't claim exploitability while the belief is diffuse).
• 🧾 Grounding — hard rule: no claim without a receipt (evidence, not paraphrase). Empirical (raw tool output) for black-box/host/AI, symbolic (file:line into the reviewed source — a code citation is the receipt) for white-box SAST & skills audits, and either for grey-box; ungrounded claims are demoted.
• 🔬 Deterministic HTTP probe — before the model recon, the harness runs a real request/response analysis (status/redirects, security headers, cookie flags, CORS reflection, tech fingerprint, linked JS, 404 baseline, high-signal paths) and feeds those observed facts into recon, so agent selection and exploitation decisions are grounded in evidence — not the model's guess.
• 🔗 Attack chaining — any primitive pivots. 13 multi-stage chain agents (SQLi→RCE→LPE, SSRF→cloud creds, upload→LFI→RCE→LPE, CVE→RCE→pivot, …) plus a chaining doctrine that turns any confirmed foothold into the next step: reduce it to a primitive (exec / read / write / request-forgery / identity / secret) and pivot — file-upload→RCE, SSRF→metadata creds, IDOR→takeover — reusing looted creds and reasoning about business logic (payment/tenancy/workflow abuse). Each stage proven; strictly non-destructive (no data loss, no DB overwrite, no DoS).
• ☁️ Cloud testing — AWS / GCP / Azure agents that drive the provider CLIs (aws/gcloud/az). Connect via creds.yaml: AWS keys, a Google service-account JSON, or an Azure service principal — see Cloud credentials.
• 🤖 LLM red-teaming — 30 AI agents that jailbreak & prompt-inject a live AI system across scenarios: AdvPrefix, PAIR, TAP, Crescendo, many-shot, persona/DAN, encoding/obfuscation, refusal-suppression; plus indirect injection (RAG/web/email/tool output), goal hijacking, tool/function-call abuse, and system-prompt exfiltration. Each runs an attacker→LLM-judge loop (baseline refusal → technique → verdict) and proves the bypass with a benign, redacted receipt. Maps to OWASP LLM Top 10 (2025), MCP threats & OWASP AI Exchange; Skill/plugin & n8n files audited white-box.
• 🧰 Misconfig & CVE hunting → exploitation, safely — a full CVE pipeline: version fingerprint (pin exact versions) → research analyst (map to NVD/GHSA CVEs, judge reachability) → PoC finder (locate/vet/adapt a public PoC) → exploit scripter (write a custom exploit when none exists). Every PoC is written to the run's pocs/ folder and referenced in the report so findings are reproducible. Plus absurd-misconfig agents (exposed .git/.env, debug/actuator, default creds, dashboards, CORS) and rate-limit testing — all under a strict data-safety/PII guardrail (no destructive/state-changing actions; PII proven with a masked sample, never dumped).
• 🎯 Re-test one vulnerability — --only <agent> (repeatable / comma-separated) runs exactly the agent(s) you name and skips recon-based selection — re-test a single finding fast. Works on run / whitebox / greybox; neurosploit agents lists the names.
• 🔬 White-box stays white-box — code agents run under a static-review doctrine (symbolic file:line receipts, source-to-sink taint tracing, manifest version→CVE) that forbids hallucinated live/black-box network actions, and can emit a repro PoC to pocs/.
• 🗣️ Natural-language REPL — in the interactive session, just describe what you want, in any language: "testa https://loja.com com opus, foco em SQLi, fora de escopo /admin, roda". A hybrid parser sets target/models/focus/ objective/out-of-scope and toggles (Burp, browser, votes, recon depth) and can launch — zero-token deterministic parse for the common shapes, model fallback for anything ambiguous. No flags to memorize.
• 🔀 CI/CD PR gate — neurosploit pr <repo> <n> --fail-on critical reviews a pull request, and on a confirmed finding at/above the threshold it fails the check, sets a neurosploit/security commit status, and posts a REQUEST_CHANGES review — so branch protection blocks the merge. Ready-made GitHub Actions workflows included (PR gate + a @neurosploit mention bot that runs a scan when a writer comments). See Integrations.
• 🎯 Engagement objective & out-of-scope — give the goal/context and hard exclusions in words (/objective, /scope-out, or --objective / --out-of-scope); both steer every agent prompt.
• 📸 Proof screenshots in reports — agents capture visual proof per finding (evidence/<finding-id>-N.png), embedded beside its vulnerability in the Typst/HTML/Markdown reports.
• 🖥️ Local, uncensored & CPU-only models — ollama: and llamacpp: run the whole engagement on your box with no API key and no data leaving the host. llamacpp: speaks to a llama-server OpenAI-compatible endpoint (LLAMACPP_BASE_URL, default localhost:8080); the model is whatever gguf you loaded. Ideal for offline/air-gapped work and unfiltered offensive prompting.
• 🕵️ Burp/ZAP proxy — /proxy <url> (or /burp) routes agent traffic through your local intercepting proxy so you can inspect & replay in Burp.
• 🗺️ Attack graph & kill chain — findings mapped to OWASP / CWE / MITRE ATT&CK / stage; rendered as a Mermaid graph in the report.
• ✅ Cross-model validation — a different model adjudicates each finding; RL-weighted, recon-aware agent selection.
• 🛰️ Mission Control TUI — live header/feed/findings/targets panels + a composer you can type in while the run streams (summary, pause, …).
• 💾 Per-project memory — <cwd>/.neurosploit/ keeps session, run history and command history; the REPL resumes on reopen. No database required.
• 🪙 Token/cost telemetry, per-agent attribution, graceful Ctrl-C → report or discard, Typst/HTML/JSON/MD reports.

This is the slim, Rust-only distribution (neurosploit-rs/ + agents_md/). The earlier Python engine and web GUIs live on the older v3.4.0 branch.

📦 Install (one line)

Linux / macOS (x64 & arm64):

Windows (PowerShell, x64 & arm64):

Supported platforms

Pure Rust + stdlib, so it builds natively everywhere a stable Rust toolchain runs. The installer auto-detects OS/arch and installs Rust if missing. On native Windows use install.ps1; under WSL2 / Git Bash the setup.sh one-liner also works.

The installer auto-installs Rust if needed, clones the repo to ~/.neurosploit, builds the release binary, and links neurosploit into ~/.local/bin. Re-run it any time to update. Tweak with env vars: NEUROSPLOIT_REF (branch/tag), NEUROSPLOIT_DIR, PREFIX.

Prefer to build by hand?

⚡ Quick start (60 seconds)

Full step-by-step for every mode (black/white/grey/host) is in TUTORIAL.md.

No login? Use an API key instead — see Authentication.

🖥️ Web console (NEW in v4.0.0)

A browser UI for the same harness — every action spawns the real compiled CLI and parses its output; nothing about the harness logic is reimplemented in the browser.

Zero npm dependencies (Node built-ins only).

• 5-step engagement wizard — Asset (mode + target/repo) → Scope & Auth (objective, focus, out-of-scope) → Leads (the 435-agent board below) → Model & Run (provider/model picker, API-key vs. subscription toggle, votes/chain-depth/recon) → Review. Every engagement is named up front, so runs are identifiable in history instead of by raw target string.
• Lead board — all 435 agents auto-categorized (Business Logic, Broken Access Control, Injection, LLM Application, Auth & Session, SSRF & Network, Cloud & Infra, …). Toggle a single lead, a whole category (indeterminate when partially selected), or use Select all / Clear all — respects the active search filter. Leave everything off to let the harness's own recon-driven selection choose.
• Custom lead → real agent — "+ Custom lead" doesn't just add a text hint: it calls the claude CLI (Opus, your Anthropic subscription) to generate an actual specialist-agent markdown file into agents_md/vulns/, in the same format every built-in agent uses, pinnable immediately. Falls back to a plain focus-text hint if Claude isn't available.
• Live run view — phase/progress streamed over SSE from the CLI's own stdout, a findings table, and Generative Attack Path Chaining: a node/edge graph (root = target, one node per confirmed finding, positioned by kill-chain stage, edges from chains_from when the harness set one) instead of a flat list — click any node or row for the full finding detail, including any PoC script the exploiting agent wrote to pocs/.
• Auth & Keys (one menu) — target auth header + named roles for IDOR/BOLA/BFLA testing (materializes an ephemeral creds.yaml for the run), and per-provider API keys held in the server process's memory only — never written to disk.
• Survives a page refresh: an in-progress run reattaches to the same live stream instead of resetting to the wizard.

Full API reference: web/API.md · quick start: web/README.md.

🔌 Integrations (GitHub · GitLab · Jira)

Wire NeuroSploit into your SDLC. Toggle from the REPL (/integrations) or the CLI (neurosploit integrations enable github|gitlab|jira). Tokens are never stored — only the name of the env var is saved; the value is read from your environment.

Automations (GitHub Actions)

Two ready-made workflows ship in examples/github-actions/ — copy them into your repo:

• neurosploit-pr-gate.yml — reviews every PR and blocks the merge on a confirmed critical. Make it enforcing: Settings → Branches → require the neurosploit-pr-gate status check (and/or require review to honor the REQUEST_CHANGES). Set ANTHROPIC_API_KEY (or swap the model) in Actions secrets; the built-in GITHUB_TOKEN covers statuses/reviews.
• neurosploit-mention.yml — comment @neurosploit on a PR or issue to trigger a scan (only repo writers can). Text after the mention is the instruction (any language): @neurosploit focus SQLi and IDOR, or @neurosploit scan https://staging.app for a black-box run.

📖 Step-by-step setup for each tool: TUTORIAL-INTEGRATION.md.

☁️ Cloud credentials (AWS/GCP/Azure)

Add a cloud block to creds.yaml and the harness exports the right env vars so the AWS/GCP/Azure agents can drive aws / gcloud / az. Secrets stay in your file/secret-manager; agents do read-only enumeration first, never destructive.

Agents cover IAM privilege-escalation, storage exposure (S3/GCS/Blob), compute & network exposure, secrets (Secrets Manager / Secret Manager / Key Vault), service-account/SP abuse, and identity enumeration (Entra ID). Best-practice auth: AWS access keys or profile; GCP a service-account JSON (GOOGLE_APPLICATION_CREDENTIALS); Azure a service principal (az login --service-principal).

👥 Multiple identities — access-control testing (IDOR / BOLA / BFLA)

Give NeuroSploit two or more named roles in creds.yaml and it authenticates as each and tests cross-role access (a low-priv role reaching another user's object or an admin function is a finding):

Each finding is proven with the authorized vs unauthorized request pair, under the data-safety guardrail (read-only, PII masked).

🏷️ Identification & attribution (anti-plagiarism)

Every request is tagged with an identifying User-Agent (default NeuroSploit/<ver> …, change with /ua or NEUROSPLOIT_UA) plus an X-NeuroSploit-Scan header, and every finding is stamped "Identified and validated by NeuroSploit" — so provenance travels in the traffic, the finding text, findings.json and the report footer.

Build

Requires a Rust toolchain (rustup). Recommended: run on Kali Linux (or the Kali Docker image) so the offensive tools the agents use are already present:

The agents degrade gracefully: if rustscan isn't installed they use nmap; if neither, they probe with curl. If a Playwright MCP browser is available they use it for JS-heavy pages, otherwise they fall back to curl.

Usage

Run with no arguments for an interactive wizard:

Or drive it directly:

Options (run / whitebox)

Authentication — run via API key or subscription

You can run NeuroSploit two ways. They're independent: pick per run.

1) Via API (provider API key)

Export the key(s) for the providers in your model panel, then run without --subscription. Any OpenAI-compatible provider works.

Or put the keys in a .env and source it (cp .env.example .env; edit; set -a; . ./.env; set +a).

Provider → env var → endpoint (all OpenAI-compatible):

Run ./target/release/neurosploit models for the full provider/model list.

Local, uncensored & CPU-only — ollama: and llamacpp: run entirely on your box with no API key and no data leaving the host. llamacpp: targets a llama-server OpenAI-compatible endpoint (override with LLAMACPP_BASE_URL); the model is whatever gguf you loaded. Ideal for offline engagements and unfiltered offensive prompting.

2) Via subscription (no API key)

--subscription drives your local agentic-CLI login instead of an API key — install and log into one of the CLIs first:

opencode: also gets the Playwright MCP (--mcp) like anthropic/openai do. nous: relies on Hermes's own built-in toolsets (web/terminal/computer-use) instead — it has no CLI-level MCP hook.

How it works

Every run writes a self-contained folder runs/ns-<ts>-<target>/:

A reinforcement-learning reward store (data/rl_state_rs.json) biases agent selection on future runs.

Agent library — agents_md/ (435)

Each agent is a self-contained markdown playbook (## User Prompt methodology + ## System Prompt strict anti-false-positive rules). Drop a new .md into the matching folder — or generate one from the web console's "+ Custom lead" (see above) — and the harness picks it up; neurosploit agents shows live counts.

Safety

For authorized testing only. Agents are instructed to stay in scope, never run destructive/DoS actions, and require proof-of-exploitation. You are responsible for having permission for any target.

Credits

Joas A Santos & Red Team Leaders.

License

MIT.