T3MP3ST is a multi-agent offensive-security framework that turns an AI coding agent into a vulnerability hunter. You point it at an authorized target and an eight-operator kill chain runs recon, exploitation, and reporting, driven either from a browser-based War Room UI or the command line.

The agent already signed in on your machine supplies the reasoning: it connects to coding agents such as Claude Code, Codex, Hermes, OpenCode, and Oh My Pi, or to a model you run offline through Ollama, LM Studio, or vLLM, so no separate API key or cloud tenant is required. Tool calling is driven over text, so the tool arsenal runs even on models without native function calling. An optional keyed mode accepts OpenRouter, Anthropic, OpenAI, xAI Grok, and Novita providers instead.

The tool covers several target domains at differing maturity: web-app and capture-the-flag (CTF) solving are stable, while cloud infrastructure-as-code, mobile, and binary reverse-engineering ship as static-detection scaffolding rather than benchmarked exploitation. It is built for authorized testing only. Every headline number in the project recomputes from committed data with a single verify-claims command.

Features

Kill-chain operators: an eight-stage pipeline of recon, exploiter, infiltrator, exfiltrator, and ghost operators, each running a tool-backed reasoning-and-action loop
Bring-your-own agent: drives Claude Code, Codex, Hermes, OpenCode, or Oh My Pi, with no new keys or second bill
Offline models: points at Ollama or any OpenAI-compatible server such as LM Studio, vLLM, or llama.cpp
Target domains: web apps, CTF, robotics and embedded OSS, source-code analysis, smart contracts, cloud IaC, mobile, and binary reverse-engineering
Benchmark harness: reports pass@1 on the XBEN suite and held-out post-cutoff CVE hunts, re-derived from committed artifacts
War Room and CLI: a browser operations console or a command-line interface, plus an HTTP API and MCP setup
Self-hosted: the API server binds to localhost and runs in Docker, keeping runs on your own machine

Claim T3MP3ST

Verify write access with GitHub