T3MP3ST is a multi-agent offensive-security framework that turns an AI coding agent into a vulnerability hunter. You point it at an authorized target and an eight-operator kill chain runs recon, exploitation, and reporting, driven either from a browser-based War Room UI or the command line.
The agent already signed in on your machine supplies the reasoning: it connects to coding agents such as Claude Code, Codex, Hermes, OpenCode, and Oh My Pi, or to a model you run offline through Ollama, LM Studio, or vLLM, so no separate API key or cloud tenant is required. Tool calling is driven over text, so the tool arsenal runs even on models without native function calling. An optional keyed mode accepts OpenRouter, Anthropic, OpenAI, xAI Grok, and Novita providers instead.
The tool covers several target domains at differing maturity: web-app and capture-the-flag (CTF) solving are stable, while cloud infrastructure-as-code, mobile, and binary reverse-engineering ship as static-detection scaffolding rather than benchmarked exploitation. It is built for authorized testing only. Every headline number in the project recomputes from committed data with a single verify-claims command.
Features
- Kill-chain operators: an eight-stage pipeline of recon, exploiter, infiltrator, exfiltrator, and ghost operators, each running a tool-backed reasoning-and-action loop
- Bring-your-own agent: drives Claude Code, Codex, Hermes, OpenCode, or Oh My Pi, with no new keys or second bill
- Offline models: points at Ollama or any OpenAI-compatible server such as LM Studio, vLLM, or llama.cpp
- Target domains: web apps, CTF, robotics and embedded OSS, source-code analysis, smart contracts, cloud IaC, mobile, and binary reverse-engineering
- Benchmark harness: reports pass@1 on the XBEN suite and held-out post-cutoff CVE hunts, re-derived from committed artifacts
- War Room and CLI: a browser operations console or a command-line interface, plus an HTTP API and MCP setup
- Self-hosted: the API server binds to localhost and runs in Docker, keeping runs on your own machine
Runs in
Claude Code
Terminal-based agentic coding tool that reads your codebase and runs tasks through natural-language commands
Codex
Lightweight coding agent that runs in your terminal
Hermes
Self-improving AI agent with a learning loop that creates and refines skills, recalls past sessions, and runs across chat platforms
Oh My Pi
Terminal coding agent with LSP, a debugger, and code execution wired in, tuned across 40+ model providers
