ASCIT31/Dark-Moon

Darkmoon v1.0.0

First public release of Darkmoon — the open-source AI-powered autonomous penetration testing platform.

Darkmoon orchestrates complete security assessments using AI agents that reason, plan, and coordinate specialized sub-agents through a controlled MCP execution layer. You give it a target, it runs the full assessment and produces an evidence-based report.

Highlights

• Autonomous multi-agent pentesting — a primary agent plans the engagement and dispatches specialized sub-agents (Web, Active Directory, Kubernetes, Network, CMS, and more)
• Controlled execution layer — the AI never runs tools directly; every action flows through the Darkmoon MCP server (binary allowlist + sandboxed Docker toolbox)
• 50+ integrated security tools — Nuclei, NetExec, BloodHound, sqlmap, Naabu, httpx, ffuf, the impacket suite, and more
• Typed workflows — port scanning, subdomain discovery, vulnerability scanning, web crawling, Kubernetes audit, AD enumeration
• Cloud or local LLM — Anthropic, OpenAI, OpenRouter, or local models (Ollama, llama.cpp)
• Automated reporting — structured, evidence-based reports aligned with NIST SP 800-115 and MITRE ATT&CK

Quick start

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh          # configure your LLM provider + build the stack
./darkmoon.sh "TARGET: example.com"

Requires Docker + Docker Compose and an LLM API key.

Documentation

• Full documentation
• Contributing

Licensed under GPL-3.0.