What is this?
It is an AI-agent penetration-testing platform built by the Yean-Sec team (夜安团队SEC) that automates red-team foothold-establishing, SRC bug bounty, and CTF work through self-supervised, self-looping, self-evolving agent cycles.
It is an AI-agent penetration-testing platform built by the Yean-Sec team (夜安团队SEC) that automates red-team foothold-establishing, SRC bug bounty, and CTF work through self-supervised, self-looping, self-evolving agent cycles.Is this a command-line tool or a web console?It is a self-hosted web application with separate backend and frontend services (console on port 5001, API on port 5003) managed as systemd units, not a CLI tool or a library.
It is a self-hosted web application with separate backend and frontend services (console on port 5001, API on port 5003) managed as systemd units, not a CLI tool or a library.How do I get it running?Install the frontend dependencies into frontend/node_modules and the backend dependencies against the system python3, export your ANTHROPIC/CLAUDE/ATKBRAIN environment variables, then run the installer script that registers and enables atkbrain-flash-backend.service and atkbrain-flash-frontend.service, bringing up the backend on :5003 and frontend on :5001.
Install the frontend dependencies into frontend/node_modules and the backend dependencies against the system python3, export your ANTHROPIC/CLAUDE/ATKBRAIN environment variables, then run the installer script that registers and enables atkbrain-flash-backend.service and atkbrain-flash-frontend.service, bringing up the backend on :5003 and frontend on :5001.Do I need a specific Linux setup and Claude Code first?Yes — it's meant to run on Kali Linux (other Debian/Ubuntu boxes can start the console but may lack tools), needs Python 3.12+ run via /usr/bin/python3, Node.js 18+, and a logged-in local Claude Code CLI or an Anthropic-compatible gateway with your API key set.
Yes — it's meant to run on Kali Linux (other Debian/Ubuntu boxes can start the console but may lack tools), needs Python 3.12+ run via /usr/bin/python3, Node.js 18+, and a logged-in local Claude Code CLI or an Anthropic-compatible gateway with your API key set.Can I use this for commercial work?No — the repo is open-sourced for learning, research, and authorized testing only; selling it, running it as SaaS, outsourcing, or any paid-service use requires contacting the author separately, and you must already have explicit authorization for whatever target you point it at.
No — the repo is open-sourced for learning, research, and authorized testing only; selling it, running it as SaaS, outsourcing, or any paid-service use requires contacting the author separately, and you must already have explicit authorization for whatever target you point it at.Who is this built for?Red teamers running authorized getshell-style engagements, SRC researchers, and CTF players — new projects are created as single-target or cluster, and tagged as either red-team (getshell) or CTF.
Red teamers running authorized getshell-style engagements, SRC researchers, and CTF players — new projects are created as single-target or cluster, and tagged as either red-team (getshell) or CTF.What does the 'treasure-hunting' attack loop actually do?The console dispatches targets, an attack graph drives a self-looping exploitation cycle, human/AI supervision only steps in at round boundaries to set the next plan, and after each engagement transferable techniques are distilled into a memory bank that feeds the next run.
The console dispatches targets, an attack graph drives a self-looping exploitation cycle, human/AI supervision only steps in at round boundaries to set the next plan, and after each engagement transferable techniques are distilled into a memory bank that feeds the next run.How does this Flash edition compare to the team's Pro version?Flash is the public, lighter release; the team's internal Pro version has already been run on dozens of projects across more than a thousand real authorized external-network engagements, but only Flash is published here.
Flash is the public, lighter release; the team's internal Pro version has already been run on dozens of projects across more than a thousand real authorized external-network engagements, but only Flash is published here.How did it perform on the Cybench leaderboard?Running on the deepseek-v4-flash model, it placed 3rd on the officially certified Cybench leaderboard with a score of 84.13/100.
Running on the deepseek-v4-flash model, it placed 3rd on the officially certified Cybench leaderboard with a score of 84.13/100.How many projects can it run at once?By default it supports 5 concurrent red-team projects and 3 CTF projects from separate slot pools, each scalable up to 20, with every project orchestrated by two cooperating agents ('从者' and '御主').
By default it supports 5 concurrent red-team projects and 3 CTF projects from separate slot pools, each scalable up to 20, with every project orchestrated by two cooperating agents ('从者' and '御主').What are similar projects?ARTEX, ARTEX, redamon, Decepticon, PentestGPT, T3MP3ST, Pentest-Swarm-AI, Claude-Red
ARTEX, ARTEX, redamon, Decepticon, PentestGPT, T3MP3ST, Pentest-Swarm-AI, Claude-RedWhich topics is it in?kali-linux, systemd, ctf, vulnerability, offensive-security, red-team, agplv3, pentesting, autonomous-agents, memory, websocket, cybersecurity
kali-linux, systemd, ctf, vulnerability, offensive-security, red-team, agplv3, pentesting, autonomous-agents, memory, websocket, cybersecurity