BitterSecurity/Decepticon

"Another AI hacker? Let us guess — it runs nmap and writes a report."

• Choose Plan, Red, or Blue: Red can start directly with one confirmed target and authorization reference. Optional Plan mode uses Soundwave to prepare and review eight planning documents before Red; Blue investigates local sensor events. The CLI /mode command and web mode selector switch between them. Engagement workflow.
• Runs specialist operations: agents cover reconnaissance, vulnerability research, exploitation, Active Directory, cloud, and other domains. They execute in an isolated sandbox; BloodHound CE, Sliver C2, and other specialist workloads start when needed. Agent roster · Architecture.
• Autonomous reverse engineering: when a binary found during an engagement needs deeper analysis, the Reverser starts the optional REA workload and uses its Ghidra provider through discovered MCP tools. REA keeps the binary-bound analysis session and saves the original Evidence bundle before results reach the agent. How REA reversing works.
• Blue Cell defense: a local sensor observes requests to your web service and optional application logs. A resident defensive agent investigates suspicious events and reports incidents in the CLI alongside the Red engagement. It observes and reports; it does not automatically block traffic. Blue Cell setup and coverage.
• Makes work reviewable: the workspace and knowledge graph retain findings and attack context. The optional web dashboard streams agent activity and shows the plan, findings, and attack graph. Web dashboard · Knowledge graph.

☁️ Don't want to self-host? Decepticon is live in the cloud.

Skip the Docker setup — run autonomous red-team engagements right from your browser.

Prerequisites: Docker and Docker Compose v2. Supported on macOS (Apple Silicon + Intel), Linux (amd64 + arm64), and Windows (amd64 + arm64) — native via PowerShell or via WSL2 (Ubuntu / Kali).

macOS / Linux / WSL2

curl -fsSL https://decepticon.red/install | bash
decepticon onboard   # Interactive setup wizard (provider, API key, model profile)
decepticon           # Start the core stack and drop into the terminal CLI

The default start brings up the core management plane (LiteLLM, PostgreSQL, Neo4j, Skillogy, LangGraph, sandbox) and launches the terminal CLI. Specialist workloads (BloodHound CE, Sliver C2, REA/Ghidra, …) and the web dashboard come up on demand — the orchestrator spawns specialists via ops_start("ad") etc., and you bring up the dashboard from inside the CLI with /web (see Web Dashboard).

Windows (PowerShell, native)

irm https://decepticon.red/install.ps1 | iex
decepticon onboard
decepticon

→ Quick start · Full setup walkthrough

After starting Decepticon, register its MCP server in your coding agent:

claude mcp add --scope user decepticon -- decepticon mcp serve
codex mcp add decepticon -- decepticon mcp serve

Use the command for the coding agent you have installed, then run decepticon skill install to add the operator guide to both agents. See the external agent guide for the Agent Skill, tool workflow, and source installation path.

Building on top of the agents — a product, a research integration, or a custom orchestrator? Install the SDK from PyPI:

pip install decepticon              # core SDK
pip install "decepticon[neo4j]"     # + the knowledge-graph attack-chain tools

decepticon is a client SDK: it ships the agent factories, middleware, tools, and skills, and routes LLM calls and sandbox execution to runtime services over HTTP (DECEPTICON_LLM__PROXY_URL, SANDBOX_URL). Running agents still needs those services — use the Docker stack above, or point the URLs at your own equivalents. See Decepticon as a library for the factory override surface, declarative PluginBundle plugins, and the safety gate.

We're building Decepticon toward an Offensive Vaccine for the AI-driven threat landscape. If you believe in autonomous red teaming as a path to stronger defense, consider supporting the project.

• Full per-challenge index, attack-class matrix, and LangSmith traces
• Comparison vs other AI pentest agents (Strix, PentestGPT, MAPTA, Cyber-AutoAgent, XBOW commercial, …)

The "AI + hacking" space is full of demos that run nmap and print a report. That's not what this is.

Decepticon is a professional autonomous Red Team agent. It executes realistic attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, C2 — the way a real adversary would, not the way a scanner does.

Every Red engagement starts with an approved target and machine-enforced RoE. Optional Plan mode adds Soundwave's interview and the full RoE, ConOps, Deconfliction Plan, and OPPLAN package with MITRE ATT&CK mapping before Red execution.

→ Engagement workflow deep dive

Real kill chains, not checkbox scans. Decepticon reads an OPPLAN and pursues objectives through whatever path opens up — pivoting, adapting, chaining techniques.

Interactive shells, actually. Real offensive tools are interactive (msfconsole, sliver-client, evil-winrm). Decepticon runs every command inside persistent tmux sessions with automatic prompt detection — so when a tool drops into an interactive prompt, the agent sends follow-up commands without workarounds.

Hardened sandbox isolation. All commands run inside a Kali Linux sandbox on a dedicated operational network (sandbox-net), separate from the management plane (decepticon-net). LangGraph drives the sandbox via the Docker socket. → Architecture

Offense serves defense. The planned Offensive Vaccine loop will turn findings into defense improvements through an attack → defend → verify cycle.

Two-network design. The always-on management plane (LiteLLM, PostgreSQL, Skillogy, LangGraph) and the always-on sandbox plane stay up across the whole engagement; everything else is dynamic-spawn — the Web dashboard comes up on /web from the CLI, and specialist workloads (BloodHound CE, Sliver C2, REA/Ghidra, …) come up only when the orchestrator calls ops_start(...) (see ADR-0006). Networks: management on decepticon-net; sandbox + C2 server + targets on sandbox-net. Neo4j is dual-homed so the agent (on management) can persist findings written from inside the sandbox.

→ Architecture deep dive · Knowledge graph

16 specialist agents organized by kill chain phase, with a fresh context window per objective — no accumulated noise.

Orchestration · Reconnaissance · Exploitation · Post-Exploitation · Vulnerability Research · Domain Specialists (AD, Cloud, Smart Contracts, Reversing, Analyst).

→ Full agent roster and middleware stack

Tier-based, credentials-aware fallback chain. You declare which credentials you have in priority order; Decepticon builds the primary→fallback chain at every tier from there.

Tier-mapped providers: Anthropic, OpenAI, Google Gemini, MiniMax, DeepSeek, xAI, Mistral, OpenRouter, Nvidia NIM, Ollama (local). Subscription OAuth: Claude Max/Pro/Team, ChatGPT Pro/Plus/Team, Gemini Advanced, Copilot Pro, SuperGrok, Perplexity Pro.

Configure via decepticon onboard. → Full model reference & fallback examples

git clone https://github.com/BitterSecurity/Decepticon.git
cd Decepticon
make dogfood  # Full OSS UX (launcher → onboard → CLI) on local code
make dev      # Backend hot-reload (compose watch) — daily dev loop

→ Contributing guide

Join the Discord — ask questions, share engagement logs, discuss techniques.

Do not use this project on any system or network without explicit written authorization from the system owner. Unauthorized access to computer systems is illegal. You are solely responsible for your actions. The authors and contributors assume no liability for misuse.

Apache-2.0