encod3d-sec/claudebrain — explained in plain English
Analysis updated 2026-05-18
Look up hacking techniques for a specific vulnerability class during an authorized engagement.
Automate which security testing skill Claude Code loads based on the current prompt.
Track scope, findings, and progress for a client pentest or bug bounty program.
Check tracked files for accidental leaks of private client data before pushing.
| encod3d-sec/claudebrain | wubing2023/paperspine | konbakuyomu/smartsearch | |
|---|---|---|---|
| Stars | 218 | 220 | 221 |
| Language | Python | Python | Python |
| Setup difficulty | moderate | moderate | moderate |
| Complexity | 4/5 | 3/5 | 2/5 |
| Audience | developer | researcher | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires Linux or WSL, Python 3.10+, the Claude Code CLI, Node.js 18+, and bun, plus a bootstrap script that modifies local Claude Code configuration.
ClaudeBrain is a knowledge base and automation toolkit built for security professionals who do authorized penetration testing and bug bounty hunting using the Claude Code AI assistant. It turns a personal notes app called Obsidian into a structured library of over 500 pages covering hacking techniques, paired with automation that tells Claude Code which technique to check before it tries anything against a target. The README is explicit that it is meant only for legal, authorized work such as a signed penetration test, an in scope bug bounty program, or a personal lab or CTF challenge. The core idea is that instead of the AI figuring things out from scratch every time, it always consults this shared, growing wiki first, similar in spirit to well known references like HackTricks. The wiki is organized into folders covering things like Active Directory, cloud services, web applications, networking, and specific tools, plus payload examples for different vulnerability types. On top of the wiki sit "hunt skills," one for each major vulnerability category such as cross site scripting, SQL injection, or server side request forgery, each of which is expected to search the wiki before acting and to report findings in a consistent format. Automation is handled through small Python scripts that hook into different moments in a Claude Code session: one matches what the user typed against a list of triggers to load the right skill, another fingerprints technology it discovers and routes it to relevant tests, another sets up a new engagement's file structure, and one warns if a command seems to target something outside the agreed scope. Each engagement, such as work for one client, is tracked in its own folder that is deliberately excluded from version control, so private client details never get pushed to a public repository, and a script exists specifically to check for accidental leaks before pushing. To use it, someone needs Linux or WSL, Python 3.10 or newer, the Claude Code CLI, Node.js 18 or newer, and a tool called bun. A setup script installs everything and wires the automation into the local Claude Code configuration, after which the user can start a new pentest, bug bounty, or CTF engagement with a single command. It is released under the MIT license.
An Obsidian based knowledge base and Claude Code automation toolkit for authorized penetration testing and bug bounty engagements.
Mainly Python. The stack also includes Python, Claude Code, Obsidian.
Use freely for any purpose, including commercial use, as long as you keep the copyright notice.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.