Run authorized security testing against web applications you own or have permission to test.
Solve capture the flag style security challenges with AI-driven automation.
Coordinate multiple AI agents through a recon, exploit, and report workflow.
Run offensive security testing fully offline using a locally hosted AI model.
| elder-plinius/t3mp3st | kunagent/kun | facebook/astryx | |
|---|---|---|---|
| Stars | 5,091 | 5,032 | 5,000 |
| Language | TypeScript | TypeScript | TypeScript |
| Last pushed | — | 2026-07-03 | — |
| Maintenance | — | Active | — |
| Setup difficulty | moderate | moderate | easy |
| Complexity | 5/5 | 3/5 | 2/5 |
| Audience | researcher | pm founder | developer |
Figures from each repo's GitHub metadata at analysis time.
Needs Node.js, an AI coding agent connection or local model server, and is intended for authorized targets only.
T3MP3ST is a framework that turns an AI coding agent you already use, such as Claude Code, Codex, or a locally run model, into a tool for offensive security testing. Offensive security means actively trying to find weaknesses in a computer system by attacking it in a controlled way, the same techniques a malicious hacker would use, but done with permission so the weaknesses can be fixed. The project describes itself as a multi-agent framework, meaning it coordinates several AI agents together to work through a process the README calls recon, exploit, and report, which means investigating a target, finding and demonstrating a weakness, then writing up what was found. The README is explicit and repeated in stating that T3MP3ST must only be pointed at systems you own or have explicit written permission to test, and that unauthorized use of these techniques against other people's systems is illegal in most places. It states the authors take no responsibility for misuse and provide the software with no warranty. A notable design choice is that it does not require its own paid API access. Instead it plugs into an AI coding agent you are already signed into, or it can run fully offline using a locally hosted model through tools like Ollama or LM Studio, so no new accounts or bills are needed. The README emphasizes that its performance claims can be independently re-checked by running a command that recalculates the numbers from data already committed in the project, rather than asking users to simply trust stated results. The project lists several areas it targets with different levels of completeness, including web applications and capture the flag style challenges, which it describes as stable, alongside newer and less finished areas like smart contracts, cloud infrastructure misconfigurations, mobile apps, and binary analysis, which it labels as experimental or still in progress. Getting started involves installing Node packages and running a local web based control panel called the War Room, where a target is described in plain English before a scan is launched.
A multi-agent framework that turns an AI coding agent into an authorized penetration-testing tool for finding security weaknesses.
Mainly TypeScript. The stack also includes TypeScript, Node.js, Ollama.
Source is available and you can modify it, but AGPL-3.0 requires sharing modifications, including for network-accessible services, under the same license.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
double-check against the repo, no cap.