AIDA
starsforks
How to install AIDA?
vasco0x4/aida
$git clone https://github.com/Vasco0x4/AIDA---
README.md
| 1 | <p align="center"> |
| 2 | <img src="./assets/banner1.png" alt="AIDA Banner" width="100%"> |
| 3 | </p> |
| 4 | |
| 5 | <h1 align="center">AI-Driven Security Assessment</h1> |
| 6 | <h3 align="center">Autonomous Pentesting Agent</h3> |
| 7 | |
| 8 | <p align="center"> |
| 9 | An agent that runs full security assessments end-to-end.<br> |
| 10 | You define the scope. You review the findings. |
| 11 | </p> |
| 12 | |
| 13 | <p align="center"> |
| 14 | <a href="#quick-start">Quick Start</a> • |
| 15 | <a href="#what-it-does">What It Does</a> • |
| 16 | <a href="Docs/INSTALLATION.md">Installation</a> • |
| 17 | <a href="Docs/USER_GUIDE.md">User Guide</a> • |
| 18 | <a href="Docs/MCP_TOOLS.md">Agent Tools</a> • |
| 19 | <a href="https://discord.gg/RVJTWtkVA2">Discord</a> |
| 20 | </p> |
| 21 | |
| 22 | <p align="center"> |
| 23 | <img src="https://img.shields.io/badge/License-AGPL_v3-blue" alt="License"> |
| 24 | <img src="https://img.shields.io/badge/Agent-Autonomous-red" alt="Autonomous"> |
| 25 | <img src="https://img.shields.io/badge/Models-Claude%20%7C%20Gemini%20%7C%20GPT%20%7C%20Any-green" alt="Models"> |
| 26 | <img src="https://img.shields.io/badge/Version-1.1.0-purple" alt="Version"> |
| 27 | <a href="https://github.com/Vasco0x4/AIDA/stargazers"><img src="https://img.shields.io/github/stars/Vasco0x4/AIDA?style=flat&label=Stars&color=gold" alt="GitHub Stars"></a> |
| 28 | <a href="https://discord.gg/RVJTWtkVA2"><img src="https://img.shields.io/badge/Discord-Join%20Community-5865F2?logo=discord&logoColor=white" alt="Discord"></a> |
| 29 | </p> |
| 30 | |
| 31 | --- |
| 32 | |
| 33 | AIDA turns any LLM into an autonomous pentester capable of assessing web |
| 34 | applications, APIs, and infrastructure. The agent reasons, understands |
| 35 | application logic, executes commands in an isolated container, |
| 36 | and documents every finding with the commands used. |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | <p align="center"> |
| 41 | <img src="./assets/view4.png" alt="AIDA Dashboard" width="800"> |
| 42 | </p> |
| 43 | |
| 44 | --- |
| 45 | |
| 46 | ## Real Results |
| 47 | |
| 48 | Claude + AIDA isn't just talk. It produces results that end up in CVE databases. |
| 49 | |
| 50 | | ID | Severity | Project | Description | |
| 51 | |----|----------|---------|-------------| |
| 52 | | [CVE-2026-49869](https://www.cve.org/CVERecord?id=CVE-2026-49869) |  | [kestra-io/kestra](https://github.com/kestra-io/kestra) | Unauthenticated RCE via auth bypass + OS command injection (CWE-78/184/287/918) | |
| 53 | | [CVE-2026-50189](https://www.cve.org/CVERecord?id=CVE-2026-50189) / [GHSA-xfvv-ggvq-pchh](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-xfvv-ggvq-pchh) |  | [appsmithorg/appsmith](https://github.com/appsmithorg/appsmith) | RCE via newline injection in env variable endpoint | |
| 54 | | [CVE-2026-32034](https://www.cve.org/CVERecord?id=CVE-2026-32034) |  | [openclaw/openclaw](https://github.com/openclaw/openclaw) | Insecure HTTP permits hijacking | |
| 55 | | [CVE-2026-49979](https://www.cve.org/CVERecord?id=CVE-2026-49979) / [GHSA-vvxf-f8q9-86gh](https://github.com/appsmithorg/appsmith/security/advisories/GHSA-vvxf-f8q9-86gh) |  | [appsmithorg/appsmith](https://github.com/appsmithorg/appsmith) | SSRF via SMTP test endpoint — internal port scanning | |
| 56 | |
| 57 | *More under responsible disclosure — awaiting publication.* |
| 58 | |
| 59 | --- |
| 60 | |
| 61 | ## What It Does |
| 62 | |
| 63 | AIDA was built to give your AI everything a pentester needs to work. |
| 64 | |
| 65 | **A fully equipped execution environment.** |
| 66 | A Docker container loaded with Linux pentesting tools — nmap, sqlmap, ffuf, |
| 67 | nuclei, and anything else it needs. If a tool is missing, the agent installs it. |
| 68 | |
| 69 | **Custom exploitation via Python.** |
| 70 | The agent generates and executes Python scripts on the fly — custom payloads, |
| 71 | encoding tricks, protocol quirks, or any logic that off-the-shelf tools can't handle. |
| 72 | |
| 73 | **Burp-level HTTP control.** |
| 74 | The agent sends and manipulates HTTP requests directly — headers, cookies, body, |
| 75 | auth tokens. Stored credentials are auto-injected via placeholders. Same power |
| 76 | as Burp Repeater, without the UI overhead. |
| 77 | |
| 78 | **A persistent notebook.** |
| 79 | The agent logs what it knows about |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
