airecon
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is
What is airecon?
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.
Overview of airecon
What it is
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance without API keys or cloud dependency when using a local gateway. It drives any OpenAI-compatible LLM gateway (LiteLLM, vLLM, hosted endpoint) and supports fully offline operation with a local gateway proxying a local Ollama. Reasoning support is auto-detected at runtime.
Key features
- Backend-agnostic: works with any OpenAI-compatible gateway; local for privacy and zero API cost, or hosted for maximum reasoning quality.
- Native Caido proxy integration with built-in tools: list, replay, automate, findings, scope, sitemap, intercept.
- Structured pipeline: RECON → ANALYSIS → EXPLOIT → REPORT with automatic transition criteria and checkpoints.
- Real-time Textual TUI for monitoring and interaction.
- Scope guard and audit log: refuses out-of-scope targets and logs every command.
- Verified-only learning: persists only verified findings to the cross-session brain.
- Optional local knowledge base: ~1.09M security records (CVEs, red team techniques, CTF writeups, nuclei templates, bug bounty payloads) indexed in SQLite FTS5.
- 57 built-in skill files with 289 keyword-to-skill auto-mappings, plus a community skill library with 57 additional CLI-based playbooks.
- MCP integration: connects to external MCP servers and exposes their tools dynamically.
- Memory persistence on disk: SQLite memory DB, adaptive learning state, per-target memory files, payload memory snapshots.
Use cases
- Automated security assessments and penetration testing.
- Bug bounty reconnaissance and vulnerability discovery.
- CTF (Capture The Flag) challenges.
- Red team operations and security research.
- Offline/private security testing using local models.
Getting started
See the repository README for installation and quick-start instructions. Configuration examples for local and hosted gateways are provided in the README.
License and pricing
Licensed under MIT. Open source.
Based on the project's public README and repository metadata.
