AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI.
How to install airecon?
pikpikcu/airecon
$git clone https://github.com/pikpikcu/aireconInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install airecon by running `git clone https://github.com/pikpikcu/airecon`, then use it for the current task and follow its documentation at https://github.com/pikpikcu/airecon.
README.md
| 1 | <h1 align="center"> |
| 2 | <img src="images/logo.png" alt="AIRecon" width="200"> |
| 3 | </h1> |
| 4 | <h4 align="center">AI-Powered Autonomous Penetration Testing Agent</h4> |
| 5 | <p align="center"> |
| 6 | <a href="https://github.com/pikpikcu/airecon/releases"><img src="https://img.shields.io/badge/version-v0.1.7--beta-green.svg"> |
| 7 | <a href="https://deepwiki.com/pikpikcu/airecon"><img src="https://deepwiki.com/badge.svg" alt="Ask DeepWiki"></a> |
| 8 | <a href="https://pikpikcu.github.io/airecon/"><img src="https://img.shields.io/badge/Docs-airecon-blue.svg" alt="Docs"></a> |
| 9 | <img src="https://img.shields.io/badge/language-python-green.svg"> |
| 10 | <img src="https://img.shields.io/badge/python-3.12%2B-blue.svg"> |
| 11 | <a href="https://ollama.com"><img src="https://img.shields.io/badge/LLM-Ollama%20(local)-orange.svg"> |
| 12 | <a href="https://github.com/pikpikcu/airecon/blob/master/LICENSE"> |
| 13 | <img src="https://img.shields.io/badge/LICENSE-MIT-red.svg"> |
| 14 | </a> |
| 15 | </p> |
| 16 | |
| 17 | AIRecon is an autonomous penetration testing agent that combines a self-hosted **Ollama LLM** with a **Kali Linux Docker sandbox**, native **Caido proxy integration**, a structured **RECON → ANALYSIS → EXPLOIT → REPORT pipeline**, and a real-time **Textual TUI** — completely offline, no API keys required. |
| 18 | |
| 19 |  |
| 20 | |
| 21 | --- |
| 22 | |
| 23 | ## Why AIRecon? |
| 24 | |
| 25 | Commercial API-based models (OpenAI GPT-4, Claude, Gemini) become prohibitively expensive for recursive, autonomous recon workflows that can require thousands of LLM calls per session. |
| 26 | |
| 27 | AIRecon is built 100% for local, private operation. |
| 28 | |
| 29 | | Feature | AIRecon | Cloud-based agents | |
| 30 | |---------|---------|-------------------| |
| 31 | | API keys required | **No** | Yes | |
| 32 | | Target data sent to cloud | **No** | Yes | |
| 33 | | Works offline | **Yes** | No | |
| 34 | | Caido integration | **Native** | None | |
| 35 | | Session resume | **Yes** | Varies | |
| 36 | | Local knowledge base | **~1.09M records** | None | |
| 37 | |
| 38 | - **Privacy First** — Target intelligence, tool output, and reports never leave your machine. |
| 39 | - **Caido Native** — 5 built-in tools: list, replay, automate (`§FUZZ§`), findings, scope. |
| 40 | - **Full Stack** — Kali sandbox + browser automation + custom fuzzer + Schemathesis API fuzzing + Semgrep SAST. |
| 41 | - **Skills Knowledge Base** — 57 built-in skill files, 289 keyword → skill auto-mappings. Extended by **[airecon-skills](https://github.com/pikpikcu/airecon-skills)** — a community skill library with 57 additional CLI-based playbooks for CTF, bug bounty, and pentesting. |
| 42 | - **Local Security Knowledge Base** — Optional **[airecon-dataset](https://github.com/pikpikcu/airecon-dataset)** indexes ~1.09M security records (CVEs, red team techniques, CTF writeups, nuclei templates, bug bounty payloads) into local SQLite FTS5. The LLM calls `dataset_search` autonomously before attempting unfamiliar techniques — grounding its decisions in real indexed data. |
| 43 | |
| 44 | --- |
| 45 | |
| 46 | ## Pipeline |
| 47 | |
| 48 | ``` |
| 49 | RECON → ANALYSIS → EXPLOIT → REPORT |
| 50 | ``` |
| 51 | |
| 52 | Each phase has specific objectives, recommended tools, and automatic transition criteria. Phase enforcement is **soft** — the agent is guided but never blocked. Checkpoints run every 5 (phase eval), 10 (self-eval), and 15 (context compression) iterations. |
| 53 | |
| 54 | --- |
| 55 | |
| 56 | ## Memory & Learning (What It Actually Does) |
| 57 | |
| 58 | AIRecon does **not** fine-tune the LLM. Its "learning" is local, structured telemetry that guides tool choice and avoids repeating failed paths. |
| 59 | |
| 60 | **Local persistence (all on disk, no cloud):** |
| 61 | - SQLite memory DB at `~/.airecon/memory/airecon.db` storing sessions, findings, patterns, target intel, tool usage, model performance, skill usage, and attack-chain discoveries. |
| 62 | - Adaptive learning state at `~/.airecon/learning/global_learning.json` (tool performance stats, strategy patterns, observation log, distilled insights). |
| 63 | - Per-target memory files under `~/.airecon/memory/by_target/` when persisted, containing endpoints, vulns, WAF bypasses, sensitive params, and auth endpoints. |
| 64 | - Payload memory snapshots can be saved under `workspace/<target>/payload_memory.json` when session persistence runs. |
| 65 | |
| 66 | **How |
Related
6 picksType
- mcp-scannerA tool to scan MCP servers and tools for security findingsJul 2026
- hol-guardOpen-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs.Jul 2026
- agent-scanAgent supply chain security scanner.Jul 2026
- falcon-mcpConnects AI agents with CrowdStrike Falcon for security analysis and automation.Jul 2026
- pythonPlug-and-play auth for Python MCP servers.Aug 2025
- auth0-mcp-serverAuth0 MCP Server: Manage Auth0 applications, APIs, actions, logs, and forms using natural languageJul 2026
