The harness is the pentester. Not the model.
NeuroSploit is an autonomous, multi-model penetration-testing harness. Point it at a URL, a repo, a running app or a host — a Rust engine runs the methodology, proves every claim on the wire, and hands you a report.
Runs on your API keys or a local subscription — 19 providers
Instead of asking one LLM to "hack this", a Rust engine runs the methodology — it picks the specialist agents that fit what it finds, runs them in parallel, re-sends every claim over the wire, and has a second model check each finding before it's reported.
The LLMs are the hands; the harness is the discipline that keeps them honest. That's why it finds more and invents less than running a model directly.
Seven disciplined stages, every run
An engagement is a fixed methodology — not a single prompt. The engine drives each stage and gates the next on proof.
Recon
Maps the surface with real tools — curl, nmap, ffuf, JS-bundle route discovery.
Select
Picks only the agents whose preconditions match the recon — never blindly runs all 486.
Exploit
Specialists work in parallel ReAct loops — each must prove its claim with a tool receipt.
Wire-check
The harness re-sends every exchange through a scope-guarded replay engine.
Vote
A different model adjudicates each candidate — cross-model voting cuts false positives.
Chain
Confirmed findings chain into deeper impact — SQLi→RCE, SSRF→cloud — each stage proven.
Report
HTML · PDF · JSON · SARIF, with an OWASP / CWE / MITRE-mapped attack graph, secrets redacted.
It won't invent findings: every claim needs a receipt — raw tool output or a file:line.
One harness, every surface
From a black-box URL to source review, running apps, infrastructure, AI systems and mobile binaries.
Black-box
Recon → select → exploit → vote → report against a live URL.
White-box
Source / SAST review tracing source→sink with file:line evidence.
Grey-box
Code review + live exploitation — code leads proven on the running app.
Host / Infra
Linux / Windows / AD + cloud (AWS/GCP/Azure) with creds.yaml.
AI / LLM
Jailbreaks, prompt injection, OWASP LLM Top 10 & MCP threats.
Mobile / Binary
RE a local APK/IPA/binary — Ghidra, MobSF, Frida, headless.
Container
OCI image scan + SBOM via trivy / grype / syft.
Mission Control
Live TUI panels + a composer you type into mid-run.
Prefer a browser? A web console drives the same CLI — no second engine.
Web console →Discipline you can audit
Four safeguards that are part of the process, not a flag you remember to set.
Wire-bound evidence
Every exchange an agent reports is re-sent by the harness itself through a scope-guarded replay engine and checked against recorded traffic. A claim the wire contradicts can't stand as confirmed.
- Deterministic validators judge real response bytes, not the model's prose.
- Per-CWE grading: SQLi that extracted nothing scores demonstrated 0, not a fake critical.
- What can't be checked stays flagged unverifiable — never silently promoted.
Attack knowledge graph
The run is a typed graph of hosts, services, findings, credentials and impact — spanning web and the internal network. It directs the next move during the run, and is written to graph/ even with no database (Neo4j optional).
- A graph checkpoint runs after recon, at validation, each chaining round and at the end.
- Every edge marked confirmed / needs-validation / hypothesis, ordered by kill-chain stage.
- Cypher + JSON export;
choke_pointsfinds the single edge that cuts the most paths.
Secrets never leak the report
Credentials the agents observe become $SECRET_n placeholders across every human-facing report — the same secret keeps the same placeholder, so an attack chain stays readable. Raw values live only in the run's vault, for re-testing.
- Redaction is always on — report.md, html, json, sarif, pdf and findings.md.
- Graph properties store salted fingerprints — never a raw secret, body or narrative.
- Nothing about your targets leaves your machine unless you send it.
# Attack chain
Logged in as admin with $SECRET_1,
which also unlocked $SECRET_1 on the API.
# raw values live only in:
.neurosploit/vault/<run-id>.json
findings.json # for re-testIt reasons about uncertainty
NeuroSploit treats the target as partially observable — a POMDP. A belief world-model carries probabilities, an anti-hallucination gate forbids claiming exploitability while the belief is diffuse, and value-of-information decides scan-more vs. exploit-now.
- Grounding gate: empirical for black-box/host/AI, symbolic file:line for white-box.
- Evidence-graded CVSS from the FIRST v3.1 equation — the vector travels with the number.
- Hash-chained audit trail, signed anchors, and a P1–P5 assurance manifest.
may_assert(sqli) = false
// belief diffuse → observe more first
[grounding] receipt required
[cvss] demonstrated 0.0 / potential 9.8
[vote] gpt + gemini → confirmed ✓
[chain] SQLi → RCE → LPE486 agents you can read, edit and extend
Each agent is a self-contained markdown playbook — a methodology plus strict anti-false-positive rules. Drop a .md into the matching folder and it's picked up automatically.
Up and running in two commands
The installer sets up Rust if missing, builds the release binary, and links neurosploit onto your PATH.
# Linux / macOS (x64 & arm64)
curl -fsSL https://raw.githubusercontent.com/\
JoasASantos/NeuroSploit/main/setup.sh | bash
# Windows (PowerShell)
irm .../install.ps1 | iex# just run it — the REPL asks everything
neurosploit
# black-box, subscription login (no API key)
neurosploit run http://testphp.vulnweb.com/ \
--subscription --model anthropic:claude-opus-4-8 -vGive the harness a target.
Read the full tutorial — auth, modes, scope, the REPL, the attack graph, the web console and the complete command reference.
curl -fsSL .../setup.sh | bash