t3mp3st contributorsandClaude Opus 4.8
06ffe3ef66
Adds three coordinated capabilities and tightens two defaults on purpose — this is safety hardening, NOT a backward-compatible drop-in (see "Tightened defaults"). Fifteen independent adversarial review passes; findings fixed and test-pinned. - Pack-hunt safety: a strict-majority adjudicator with a comment/string/regex/ raw-string/heredoc/POD-aware cite-check (language-gated across C/C++/Py/Rust/Go/ Java/JS/TS/shell/SQL/PHP/Ruby/Perl) so a hallucinated killing-guard can't refute a real finding — the cited comparison's operator must match source, and a string/regex/heredoc/generic-arglist/template-interpolation is blanked before matching. Plus a rate-limit/degraded-health tracker, a global LLM semaphore, and a PackBoard with an atomic claim CAS + snapshot-on-emit/clone-on-ingest. - Opt-in Kali+ arsenal (T3MP3ST_FULL_ARSENAL, OFF by default): 35 default tools (31 built-in + 4 external-CLI wrappers) -> 83 with the catalog armed (verify-claims CLAIM 4). Most adapters need the underlying binary installed. metasploit / hydra / bloodhound are never minted through the generic factory. - Capability-approval + spicy-action gate for the NEW dangerous arsenal only (pre-existing built-ins keep running freely): approve-once, fail-safe deny when unattended, redacted audit trail over SSE. T3MP3ST_GATE_BUILTINS=1 extends it to the spicy built-in probes. Audit redaction is a pure, unit-tested module. Tightened defaults (intentional, ON by default — NOT backward-compatible): - Egress containment: once a mission target is set, built-in networked tools refuse off-scope public hosts (not the target/subdomains, not loopback/private) with SCOPE DENIED — keeps the agent on authorized scope. - Role-specialized operator toolkits: each archetype gets a curated default tool menu (scanner -> scan tools, exploiter -> sqli/xss/etc). Tools stay registered team-wide; the per-role menu is the operator's working set. UX (from live-tester feedback): a one-click "Approve & run" modal when a standard Hunt blocks on an external-target receipt (was a dead-end); bounded-parallel benchmark file ingestion; the deterministic mission-gate chip co-located with the subjective SITREP pace narration (no more "behind schedule" next to a clean gate); and click-through finding detail + evidence in the UI (was export-only). Docs: README + INTEGRITY_LEDGER made re-derivable — honest 35/83 tool count, the egress-containment default documented, and the Cybench number reconciled to the single verify-claims-enforced 23/40 = 58% (dropped the stale/uncited 21 and 26). README voice pass: killed the underselling `Successful Exploits: 0` disqualifier (read as "never popped anything" — false, given CVE-Zero + the live disclosure pipeline); swagger now rests on receipts, not vibes. Also corrected the operator status — the downstream operators run the SAME real tool-backed ReAct loop as recon (not "orchestration stubs"); the honest limit is that the coordinated swarm is unproven (single-agent is the benchmarked path), not that they're scaffolding. Gates: 292 tests, tsc + lint clean, verify-claims 20/20, arsenal:smoke 125/0, disclosure-CLI self-test 11/11. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
14 KiB
Executable File
🌩️ T3MP3ST
▄▄▄█████▓▓█████ ███▄ ▄███▓ ██▓███ ▓█████ ██████ ▄▄▄█████▓
▓ ██▒ ▓▒▓█ ▀ ▓██▒▀█▀ ██▒▓██░ ██▒▓█ ▀ ▒██ ▒ ▓ ██▒ ▓▒
▒ ▓██░ ▒░▒███ ▓██ ▓██░▓██░ ██▓▒▒███ ░ ▓██▄ ▒ ▓██░ ▒░
░ ▓██▓ ░ ▒▓█ ▄ ▒██ ▒██ ▒██▄█▓▒ ▒▒▓█ ▄ ▒ ██▒░ ▓██▓ ░
▒██▒ ░ ░▒████▒▒██▒ ░██▒▒██▒ ░ ░░▒████▒▒██████▒▒ ▒██▒ ░
▒ ░░ ░░ ▒░ ░░ ▒░ ░ ░▒▓▒░ ░ ░░░ ▒░ ░▒ ▒▓▒ ▒ ░ ▒ ░░
░ ░ ░ ░░ ░ ░░▒ ░ ░ ░ ░░ ░▒ ░ ░ ░
░ ░ ░ ░ ░░ ░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░
A multi-agent offensive-security framework, built to turn the AI coding agent you already run into a zero-day hunter.
Point T3MP3ST at a target and it works the offensive kill chain (recon → exploit → report) from a web War Room or the CLI, driven by the AI coding agent you're already signed into — Claude Code, Codex, or Hermes. A full mission costs no API keys. Your agent is the engine; T3MP3ST is the war machine you bolt around it.
The recon engine is live and tool-backed, and the exploit loop is benchmark-proven: 90.1% pass@1 on XBEN — clears XBOW's self-reported 85% even at the Wilson floor, every flag ripped from a live exploit (reproducible below). Then it went hunting COLD: 4 out of 10 real CVEs disclosed in 2026 — past the training cutoff, memorization-proof. It finds vulns that didn't exist when the model was trained. The full 8-operator swarm is the architecture it grows into; the status table is exact about what's live, what's scaffolding, and what's still roadmap. Loud about the mission, honest about where the build is.
Three things set it apart:
- Reproducible. Every number in this README recomputes from committed data —
npm run verify-claimsre-derives all of them, 20/20 green. A claim that can't be reproduced doesn't ship. No trust-me numbers, ever. - Keyless. The AI coding agent already on your machine is the backbone. No API keys, no second bill, no gatekeeper.
- Honest about scope. The status table marks exactly what's stable, experimental, or roadmap — because red-teaming shouldn't be a priesthood, and it damn sure shouldn't run on vibes.
Why it exists
Offensive security sits behind years of practice and expensive tooling. The bet behind T3MP3ST is that a coordinated agent swarm puts real bug-hunting in reach of people who never got the invite, across web apps, CTFs, smart contracts, source code, and embedded/robotics OSS. That is an ambitious bet, and the sections below are careful to separate what already works from what is still a bet.
What it hunts
| Domain | What it does | Status |
|---|---|---|
| 🕸️ Web apps | Black-box, external-attacker recon → exploit (XBEN suite) | ✅ Stable |
| 🚩 CTF | Hint-free, sandbox-jailed solves (Cybench) | ✅ Stable |
| 🤖 Robotics / OT / embedded | Coordinated-disclosure pipeline for OSS vuln hunting (OSV + live-PoC + refuter) | ✅ Pipeline stable |
| 📂 Source code | White-box repo analysis with blind master-builder decomposition | ⚠️ Python-only ingest |
| 💰 Smart contracts | Damn Vulnerable DeFi | ⚠️ reproduction, not novel discovery |
Quick start
Fastest path to a running War Room (keyless, ~2 min to set up; mission time depends on the target):
npm install
npm run server # War Room → http://127.0.0.1:3333/ui/
In the War Room, open Settings and connect a local agent (Claude Code / Codex / Hermes). Then describe a target to Op Admiral in plain English and launch. The agent you connected is the brain. No key required.
Prefer to bring a key? Set one and skip the connect step:
export OPENROUTER_API_KEY=... # or VENICE_API_KEY / ANTHROPIC_API_KEY
Check the numbers for yourself:
npm run verify-claims # re-derives every headline from committed JSON in bench/
Library/SDK usage, the full HTTP API, and MCP setup live in docs/.
What ships today
The framework is an 8-operator kill chain, and this table won't blow smoke about it. Recon is a live, tool-backed engine — and the teeth are already real: 90.1% pass@1 on XBEN, 4/10 post-cutoff CVEs hunted cold, and a coordinated-disclosure pipeline that's live enough to have drafts held for vendor coordination right now. What's not proven is the swarm. Each downstream operator — Exploiter, Infiltrator, Exfiltrator, Ghost — runs the same real, tool-backed ReAct loop as recon (real exploit tools, not stubs), but the headline numbers came from a single agent, not the coordinated 8-operator cell, and end-to-end swarm exploitation is unbenchmarked and still unreliable. The engine is real; the swarm is the part still earning its stripes. Loud where we've earned it, blunt about the rest.
| Component | Status | Notes |
|---|---|---|
Re-derivable measurement (verify-claims) |
✅ Stable | every headline recomputes from committed artifacts |
| Recon engine | ✅ Stable | drives nmap / DNS / HTTP / fingerprinting; every finding traces to real tool output |
| Mission engine + War Room + Op Admiral | ✅ Stable | keyless through a connected local agent |
| Arsenal, MCP server, HTTP API | ✅ Stable | 35 tools by default (31 built-in + 4 external-CLI wrappers); 83 with the opt-in T3MP3ST_FULL_ARSENAL (re-derives via verify-claims). security_recon over MCP |
| Egress-scope containment | ✅ Stable (on by default) | once a mission target is set, built-in networked tools refuse off-scope public hosts — not the target/subdomains, not loopback/private (SCOPE DENIED) — a tightened default, not a bare tool runner |
| Coordinated-disclosure pipeline | ✅ Stable | OSV novelty + live PoC + refuter panel + CVSS; drafts only, a human sends |
| White-box source analysis | ⚠️ Experimental | Python-only regex ingest; multi-model decomposition costs more tokens, not fewer |
| DeFi (Damn Vulnerable DeFi) | ⚠️ Experimental | reproduces known exploit classes; not novel discovery |
| Exploiter / Infiltrator / Exfiltrator / Ghost | ⚠️ Experimental | run the real tool-backed ReAct loop (same engine as recon); unproven as a coordinated swarm — single-agent is the benchmarked path, live swarm exploitation still unreliable |
| Advanced modules (cloud, persistence, swarm, cognition) | 🚧 Planned | interface-only in src/stubs/ |
| Self-improvement loop | 🧪 Research | records lessons + proposals today; feeding them back into planning is roadmap |
Full feature-by-feature breakdown: FEATURES.md.
Benchmarks
Headline results. Each recomputes from the committed JSON with npm run verify-claims; full methodology and caveats are in the linked docs.
| Suite | Result | Context |
|---|---|---|
| XBEN — XBOW's 104-challenge suite, black-box | pass@1 mean 90.1% (Wilson-95 86.2–92.9), floor 91/104 · gpt-5.5 | XBOW self-reports 85% on the same suite; ours reproduces from artifacts |
| XBEN — white-box (reported separately) | pass@1 98.7%, best-ball 104/104 · gpt-5.5 | never blended with the black-box number |
| Cybench — 40-task academic bench, Opus 4.8, no hints | 23/40 (58%) hint-free, single-run pass@1 (verify-claims-enforced; matches the 18/31 = 58% reachable-subset) |
not the raw-score record (Anthropic: 76.5% pass@10); every flag from a live exploit |
| CVE-Zero — 10 real post-cutoff (2026) CVEs, hunted cold | 4/10 strict (exact file/line/CWE) | memorization-proof: targets postdate the training cutoff |
How to read these:
- Every solved flag came from a live exploit. Zero fabricated, enforced by an anti-fitting guard that runs on every push.
- Black-box (source withheld) and white-box (source staged) are reported separately and never blended.
- These ran a single-agent ReAct loop, not the 8-operator swarm. The swarm is framework architecture; it is not what scored these numbers.
- Results are system-vs-system: this harness driving a strong current model, not an isolated-harness claim.
XBOW self-reports 85% on its own suite. T3MP3ST scores 90.1% on that same suite — and clears the 85% bar even at the Wilson-95 floor of 86.2%, not just the mean. Every point of it recomputes from committed artifacts with one command: npm run verify-claims. That's the whole flex — a keyless, open-source harness beating the closed-source incumbent's own number, with receipts you can re-run yourself in your terminal right now. Clone it, run it, check the math.
Deeper reading: WALL_FORENSICS (per-challenge misses), CYBENCH, INTEGRITY_LEDGER (contamination audit and every retraction), OBSIDIVM (our own live web range).
Documentation
| Doc | Contents |
|---|---|
| FEATURES.md | feature-by-feature status ([x] shipped / [~] partial / [ ] planned) |
| SCOPE_AND_AUTHORIZATION | authority model, scope receipts, evidence and retest rules |
| TEAM_PREVIEW | first-run path and review script |
| INSTALL_MATRIX | macOS / Linux readiness table |
| ARSENAL_ACTIVATION_PLAN | optional external-tool setup |
| CYBENCH · WALL_FORENSICS · INTEGRITY_LEDGER · COGNITIVE_ARCHITECTURE | benchmark methodology |
| RELEASE_CHECKLIST | the gates a release must pass |
Architecture
┌─────────────────────────────────────────────────────────────────┐
│ T3MP3ST COMMAND │
├─────────────────────────────────────────────────────────────────┤
│ MISSION CONTROL ◄── TARGET MODEL ──► ARSENAL (TOOLS) │
│ ▲ │
│ AGENT CELL: RECON · SCANNER · EXPLOITER · INFILTRATOR · │
│ EXFILTRATOR · GHOST · COORDINATOR · ANALYST │
│ ▲ │
│ EVIDENCE VAULT · CREDENTIAL STORE · FINDINGS LEDGER │
│ ▲ │
│ OPSEC LAYER · COMMS CHANNEL · LLM BACKBONE │
└─────────────────────────────────────────────────────────────────┘
Operators map to MITRE ATT&CK and Cyber Kill Chain phases (recon is live; later phases are scaffolded):
| Operator | Phase | MITRE | Function |
|---|---|---|---|
| Recon | Reconnaissance | TA0043 | OSINT, network discovery, asset enumeration |
| Scanner | Discovery | TA0007 | vulnerability scanning, service fingerprinting |
| Exploiter | Initial Access | TA0001 | exploitation, payload delivery |
| Infiltrator | Lateral Movement | TA0008 | post-exploitation, privilege escalation |
| Exfiltrator | Collection / Exfil | TA0009/10 | data extraction, credential harvesting |
| Ghost | Persistence | TA0003 | persistence, stealth, cleanup |
| Coordinator | Command & Control | TA0011 | mission control, orchestration |
| Analyst | Analysis | — | pattern analysis, reporting |
Providers: OpenRouter, Venice, Anthropic, OpenAI, or a keyless local agent (Claude Code / Codex / Hermes). Set OPENROUTER_API_KEY / VENICE_API_KEY / ANTHROPIC_API_KEY, or connect an agent in Settings.
Integrations: node dist/mcp-server.js exposes security_recon to MCP-aware agents. npm run server starts the HTTP API (POST /api/mission/start, GET /api/mission/status, and more). Full reference in docs/.
Contributing — join the swarm
Red-teaming shouldn't be a priesthood. Bring an adapter, a prompt pack, a runbook, a new arsenal tool, or a bug report.
One rule, non-negotiable: everything here is for authorized testing only. Owned, scoped, or consenting targets. Build for defenders, or don't build it here.
- Fork it, branch it.
- Open a PR with tests. If you touch a headline number,
npm run verify-claimshas to stay green.
Release process and gates: RELEASE_CHECKLIST.
License
MIT. See LICENSE.
Fortes fortuna iuvat — fortune favors the bold.
⊰•-•✧ LOVE PLINY ✧•-•⊱ 🌩️