Cain is an agent for authorized penetration testing, built on the Claude Agent SDK. It runs a deterministic three-stage pipeline — reconnaissance, test, report — as a state machine that is crash-resumable, with all state held as files in a workspace. The target given on the command line is written into a scope.yaml at bootstrap and checked on every tool call.
Scope and safety are enforced by configuration rather than by the model's own restraint. A PreToolUse hook blocks any tool call whose target falls outside the declared scope. The 46 built-in security tools are read-only, each carrying a per-tool blacklist that rejects write, exploit, and persistence operations such as POST, PUT, DELETE, and aws rm/mv/cp before execution. Discovery and validation run in separate agent sessions that never share context, so a finding cannot confirm itself, and verdicts are four-state structured output. A redaction hook strips credentials before anything is written to disk.
Two execution backends are available: a default claude backend, and a pi bridge that needs Node.js 20 or newer and reaches other providers through their standard API-key environment variables or an Anthropic Messages-compatible gateway. Each stage can be routed to its own backend, provider, and model, so reconnaissance can run on a cheaper model while the test stage keeps a higher-capability one, and the report stage keeps an independent channel. With no per-stage flags set, both discovery stages share one session, and whatever the mix, every execution channel mounts the same scope-guard hook.
A finished run writes three artifacts to the workspace report/ directory: report.md, a rendered report with an executive summary, a findings table with severity, confidence, and evidence-chain digests, per-finding detail, an evidence-hash index, and remediation advice; aggregated-report.json, the machine-readable aggregate over the same data; and validation-summary.json, the validation pipeline's four-state counts and failure details. Evidence plaintext is never persisted — only hashes.
Detection results from the offline vulnerable-Terraform sweep, with clean controls staying at zero hits:
| Scene | Expected | Detected | False positives | Missed |
|---|---|---|---|---|
| OSS public bucket (public-read) | 1 | 1 | 0 | 0 |
| RAM over-granted policy | 2 | 2 | 0 | 0 |
| RAM AdministratorAccess user | 5 | 5 | 0 | 0 |
Features
- Cloud storage checks: AWS S3, Azure Blob, GCP GCS, Alibaba Cloud OSS, Tencent COS, and Huawei OBS exposure
- Privilege-escalation graphs: AWS IAM, Tencent CAM, and Alibaba Cloud RAM entities, escalation actions, and high-privilege targets modelled as a directed graph, exported as DOT or JSON, with paths found by breadth-first search
- Metadata SSRF: instance-metadata probes at 169.254.169.254 across seven providers
- Cluster and image posture: Kubernetes RBAC and Docker image checks
- Web vulnerability classes: SQL injection, XSS, SSRF, CSRF, file upload, XXE, command injection, and path traversal
- Scope enforcement: a PreToolUse hook rejects every call whose target is outside scope.yaml
- Read-only toolchain: 46 security tools spanning recon, scan, verify, post, and report, each with a dangerous-flag blacklist
- Separate finder and validator: validation runs in a session that never saw the discovery context, with four-state verdicts
- Credential redaction: a hook strips secrets before anything is persisted, and evidence is stored as hashes only
- Per-stage model routing: recon, test, and report each take their own backend, provider, and model, falling back to the global setting
- Budgeted runs: a wall-clock total budget and a per-step idle timeout bound a run
- Benchmark harness: a self-built vulnerable-Terraform range scored on detection rate, false-positive rate, wall time, and token cost, with untested scenes marked untested
