agent-smith

The pentest framework built for the tester who wants to think, not babysit. You bring the expertise. agent-smith brings 50+ tools, the methodology, and the execution — and the two of you close findings that neither could reach alone.

⚠️ Authorized testing only. Use against systems you own or have explicit written permission to test. Unauthorized access is illegal.

Why agent-smith

• 🧠 The LLM is the brain, not a payload library. Skills teach methodology; the LLM invents the actual attacks. No two scans look 100% alike.
• 🔗 Skills chain themselves. /pentester finds an injection point and pivots into /web-exploit; /codebase finds an LLM call site and pivots into /ai-redteam. The agent decides what runs next based on what it just found.
• 🛠 Bring your own LLM. Claude Code, OpenAI Codex, OpenCode (any provider — OpenAI, Gemini, Ollama, OpenRouter, local models), or any MCP-capable client. Smith auto-scales its context budget to small / local models, so it even runs fully local on your own GPU — no API bills, nothing leaving your network. (setup →)
• 📦 End-to-end deliverables. Findings, PoCs (Burp-ready .http files), threat models, code patches, GitHub issues, and CVE submission packages — all generated for you.
• 🐳 Sandboxed by default. Every scanner runs inside an ephemeral Docker container. Hard cost / time / call-count limits enforced server-side.
• 🔍 Depth enforcement. A background QA daemon watches Smith and pushes it to go deeper — catching stalls, premature completion, and shortcut behaviour, escalating to you when it's genuinely stuck. (details →)
• 🧪 Evidence, not guesses. Every finding is artifact-backed and passes a senior-review adjudication gate. Blind vulns are confirmed out-of-band via a callback server; multi-step attacks are recorded as proven exploit chains; white-box findings carry a source trace whose file:line is resolved against the repo — a hallucinated location is rejected at the door.
• 📊 A dashboard built for collaboration. Watch findings, topology, coverage, and the threat model populate in real time at localhost:7777 — and steer Smith mid-scan, respond to intervention pauses, and fulfill its resource wishlist. (API →)

The new way: skills as pattern teachings

Most pentest automation ships a giant payload library and runs it linearly. agent-smith does the opposite. Skills are not scripts — they are prompts that teach the LLM a way of thinking. A skill describes the vulnerability class, the surface area, the verification logic, and the chaining rules, then leaves the actual attacks to the model.

The skills are inspiration. The LLM is the operator.

See it in action

/pentester — full autonomous engagement Recon → fingerprint → exploit → loot → report. The agent decides every step.	/codebase — white-box ASVS review Source → routes → sinks → ASVS chapters → enriched context for every downstream skill.
/ai-redteam — OWASP LLM Top 10 + AITG Prompt injection, jailbreaks, model extraction, MCP runtime attacks, and post-access infra checks.	/remediate — auto-generated patches For every confirmed finding the agent writes a code or config patch and verifies it doesn't break the build.

What you can do

Drop any of these the moment you start your client. /pentester orchestrates everything; the single-purpose skills give you laser focus.

💡 35+ skills total — full catalog and chaining map in docs/skills.md.

Two ways to work with Smith

The industry is racing toward full automation. We think that's the wrong finish line.

The best pentests have always been about the interplay between a skilled tester and their tooling — the tester brings context, intuition, and judgment; the tools provide speed, coverage, and consistency. agent-smith is built around that conviction. Autonomous mode exists and it's genuinely powerful, but Augmented mode is where the framework does its best work: Smith handles 50+ parallel tool runs, tracks coverage, and writes the deliverables, while you stay in the loop to redirect scope, respond to intervention pauses, and make the calls that no AI should make alone.

The dashboard isn't a progress bar — it's the collaboration interface.

claude          # interactive — you steer, Smith executes

claude -p "/pentester scan https://staging.example.com depth=thorough"

Quick start

git clone --recursive <repo>
cd agent-smith
./installers/install.sh          # Claude Code  (or install_codex.sh / install_opencode.sh)

⚠️ After install, fully restart your client — the MCP server connects at startup.

Full setup — other clients (Codex, OpenCode, custom MCP), self-hosted local models (vLLM / DGX Spark), Windows / PowerShell, and the optional Kali & Metasploit images → docs/installation.md.

🛡️ Running a real engagement? Smith ingests attacker-controlled data and can run commands, so prompt injection is a design reality — run it in an isolated, disposable VM. See docs/production-isolation.md.

How it works

You (/pentester scan target.com)
  └── Your LLM (Claude / GPT / Gemini / local …)
        └── MCP server (python -m mcp_server)
              ├── Lightweight scanners — docker run --rm (nmap, nuclei, httpx, …)
              ├── Kali container       — persistent kali-mcp (nikto, sqlmap, ffuf, …)
              ├── Metasploit container — exploit validation
              └── FastAPI dashboard    — live findings at localhost:7777

The LLM decides what to run; each tool's output is aggregated and returned to the model, which chooses the next action. Hard cost / time / call-count limits are enforced server-side. Full component diagram, repository layout, and scan deliverables → docs/architecture.md.

Every scan builds training data

Every pentest Smith runs is also a structured, redacted dataset of the engagement — each decision → action → result → finding is captured as a schema-versioned event stream and retained per engagement (with the raw artifacts the model actually saw). It's a byproduct: the capture is passive, read-only, leak-scanned, and never influences the scan (opt out with SMITH_EVENTS_DISABLED=1).

The value compounds: the more pentests you run, the more data you accumulate — and the better the model you can distill from it. Pool the streams into a behaviour-cloning dataset and fine-tune a small open-weight base with QLoRA into a LoRA adapter that runs as Smith locally. Diversity of targets beats raw volume.

→ docs/training-data.md — what's captured, the safety model, and the exporter + DGX Spark QLoRA harness.

Documentation

Getting started

• installation.md — every client, self-hosted local models, Windows, optional images

Concepts

• architecture.md — component diagram, project layout, what a scan produces
• skills.md — full skill catalog, chaining map, per-skill reference
• training-data.md — every scan builds a redacted dataset you can distill into a local LoRA adapter

Operating Smith

• operating.md — scan modes, Human Intervention (HIR), lifecycle, QA depth enforcement
• production-isolation.md — running Smith sandboxed in production
• dashboard-api.md — FastAPI endpoints and response shapes

Reference

• tools.md — all MCP tools: parameters, purpose, examples
• kali-toolchain.md — full kali command reference

Contributing

• extending.md — adding new tools and skills
• testing.md — running the test suite, coverage, adding tests

Adding a new skill? Skills live in a separate repo (github.com/0x0pointer/skills) pulled in as a git submodule. After adding a skill there, update the submodule pointer (git add skills && git commit) and re-run the installer to deploy it.

License

GNU Affero General Public License v3.0 — see LICENSE.

Built for offensive-security professionals. Use it to make the internet safer.