A multi-agent offensive-security framework, built to turn the AI coding agent you already run into a zero-day hunter.
Your AI coding agent is already a hacker — T3MP3ST hands it an arsenal.
Point it at an authorized target and the kill chain runs itself: recon → exploit → report, from a browser War Room or the CLI, driven by the agent you're already signed into — Claude Code, Codex, Hermes — or a model you run fully offline (Ollama, LM Studio, vLLM). No new API keys, no cloud tenant, no second bill. Your agent is the brain; T3MP3ST is the war machine bolted around it. Self-hosted storm. Keyless warfare. ⚡
And it won't ask you to take its word for it. On XBOW's own 104-challenge suite it scores 90.1% pass@1 — above XBOW's self-reported 85% — alongside hint-free CTF solves and a . Every number in this README recomputes from committed data with one command (). Loud about the mission, honest about the build — the says exactly what's live, what's scaffolding, and what's still roadmap; full receipts in .
cold hunt on real, post-cutoff CVEs the model had never seen
Reproducible. Every number in this README recomputes from committed data — npm run verify-claims re-derives all of them, 24/24 green. A claim that can't be reproduced doesn't ship. No trust-me numbers, ever.
Keyless. The AI coding agent already on your machine is the backbone. No API keys, no second bill, no gatekeeper.
Honest about scope. The status table marks exactly what's stable, experimental, or roadmap — because red-teaming shouldn't be a priesthood, and it damn sure shouldn't run on vibes.
T3MP3ST is an offensive security tool, built for authorized testing, research, and education. Point it only at systems you own or have explicit, written permission to test. Unauthorized access to computers, networks, or data is illegal in most jurisdictions — you alone are responsible for how you use this software and for staying inside the law and your rules of engagement. Bring the storm to your targets, not someone else's.
T3MP3ST is provided as-is under the AGPL-3.0 license, with no warranty and no liability for any damage, loss, or misuse. The authors do not endorse, support, or condone unauthorized activity. Get permission. Stay in scope. Don't be a menace. 🫡
Why it exists
Offensive security sits behind years of practice and expensive tooling. The bet behind T3MP3ST is that a coordinated agent swarm puts real bug-hunting in reach of people who never got the invite, across web apps, CTFs, smart contracts, source code, and embedded/robotics OSS. That is an ambitious bet, and the sections below are careful to separate what already works from what is still a bet.
White-box repo analysis with blind master-builder decomposition
⚠️ Python-only ingest
💰 Smart contracts
Damn Vulnerable DeFi
⚠️ reproduction, not novel discovery
Quick start
Fastest path to a running War Room (keyless, ~2 min to set up; mission time depends on the target):
npm install
npm run server # War Room → http://127.0.0.1:3333/ui/
In the War Room, open Settings and connect a local agent (Claude Code / Codex / Hermes). Then describe a target to Op Admiral in plain English and launch. The agent you connected is the brain. No key required.
Prefer to bring a key? Set one and skip the connect step:
Or run it fully offline on your own model — no key, no cloud. Defaults to Ollama; point it at any OpenAI-compatible server (LM Studio, vLLM, llama.cpp):
ollama serve && ollama pull llama3 # or an OpenAI-compatible serverexport TEMPEST_LOCAL_BASE_URL=http://localhost:11434/api # LM Studio: http://localhost:1234/v1export TEMPEST_LOCAL_MODEL=llama3
npx tempest config # → "Change default provider" → local
Tool-calling works on any local model (it's driven over text), so the Arsenal runs even on models without native function-calling.
Check the numbers for yourself:
npm run verify-claims # re-derives every headline from committed JSON in bench/
Library/SDK usage, the full HTTP API, and MCP setup live in docs/.
What ships today
The framework is an 8-operator kill chain, and this table won't blow smoke about it. Recon is a live, tool-backed engine — and the teeth are already real: 90.1% pass@1 on XBEN, 8/10 held-out post-cutoff CVEs pinned to exact file/line/CWE, and a coordinated-disclosure pipeline that's live enough to have drafts held for vendor coordination right now. What's not proven is the swarm. Each downstream operator — Exploiter, Infiltrator, Exfiltrator, Ghost — runs the same real, tool-backed ReAct loop as recon (real exploit tools, not stubs), but the headline numbers came from a single agent, not the coordinated 8-operator cell, and end-to-end swarm exploitation is unbenchmarked and still unreliable. The engine is real; the swarm is the part still earning its stripes. Loud where we've earned it, blunt about the rest.
Component
Status
Notes
Re-derivable measurement (verify-claims)
✅ Stable
every headline recomputes from committed artifacts
Recon engine
✅ Stable
drives nmap / DNS / HTTP / fingerprinting; every finding traces to real tool output
Mission engine + War Room + Op Admiral
✅ Stable
keyless through a connected local agent
Arsenal, MCP server, HTTP API
✅ Stable
35 built-in tools by default; 83 with the opt-in T3MP3ST_FULL_ARSENAL (+48 adapters, with the dangerous post-ex drivers — metasploit, hydra — behind a human-approval gate) — both counts re-derive via verify-claims. security_recon over MCP
Egress-scope containment
✅ Stable (on by default)
once a mission target is set, built-in networked tools refuse off-scope public hosts — not the target/subdomains, not loopback/private (SCOPE DENIED) — a tightened default, not a bare tool runner
Coordinated-disclosure pipeline
✅ Stable
OSV novelty + live PoC + refuter panel + CVSS; drafts only, a human sends
White-box source analysis
⚠️ Experimental
Python-only regex ingest; multi-model decomposition costs more tokens, not fewer
DeFi (Damn Vulnerable DeFi)
⚠️ Experimental
reproduces known exploit classes; not novel discovery
Exploiter / Infiltrator / Exfiltrator / Ghost
⚠️ Experimental
run the real tool-backed ReAct loop (same engine as recon); unproven as a coordinated swarm — single-agent is the benchmarked path, live swarm exploitation still unreliable
✅ CVE pipeline live — coordinated-disclosure drafts held for vendors
📦 Supply chain
dependency audits, install-without-confirmation
⚠️ Real — dedicated class; hit a CWE-829 on the held-out set
💰 Blockchain
smart contracts, DeFi, Solidity
⚠️ Reproduction only — Damn Vulnerable DeFi, not novel discovery
☁️ Cloud
AWS/GCP/Azure misconfig, IAM, serverless
🚧 In development
📱 Mobile
Android/iOS app security
🚧 In development
🏢 Identity / AD
Kerberos, pass-the-hash, AD attacks
🚧 In development
🔐 Binary / RE
overflows, ROP, exploit dev
🚧 In development — needs specialized tooling
The class/squad architecture means new domains compose rather than fork — each is a loadout (specialist classes + arsenal + target adapter + a benchmark). 🚧 domains ship dark until they have a number.
Benchmarks
Headline results. Each recomputes from the committed JSON with npm run verify-claims; full methodology and caveats are in the linked docs.
Suite
Result
Context
XBEN — XBOW's 104-challenge suite, black-box
pass@1 mean 90.1% (Wilson-95 86.2–92.9), floor 91/104 · gpt-5.5
XBOW self-reports 85% on the same suite; ours re-derives the graded verdict from committed artifacts (raw transcripts stripped for privacy)
XBEN — white-box (reported separately)
pass@1 98.7%, best-ball 104/104 · gpt-5.5
never blended with the black-box number
Cybench — 40-task academic bench, Opus 4.8, no hints
memorization- & fitting-proof: post-cutoff, and the hardened prompts were never tuned on these; verify-claims recomputes it. n=10, directional; the swarm's edge here is recall, not a coordination-beats-solo proof
How to read these:
Every solved flag is graded against a committed ground-truth oracle — not a self-report — and verify-claims recomputes the pass/fail. Raw per-step transcripts are stripped for operator privacy, so you re-check the graded verdict, not the raw tool output. Zero fabricated, enforced by an anti-fitting guard that runs on every push.
Black-box (source withheld) and white-box (source staged) are reported separately and never blended.
These ran a single-agent ReAct loop, not the 8-operator swarm. The swarm is framework architecture; it is not what scored these numbers.
Results are system-vs-system: this harness driving a strong current model, not an isolated-harness claim.
The number isn't the flex — the receipt is. A keyless, open-source harness that hands you the re-run instead of asking you to trust it: clone it, run npm run verify-claims, and every verdict above recomputes from its committed oracle in front of you.
Operators map to MITRE ATT&CK and Cyber Kill Chain phases (recon is live; later phases are scaffolded):
Operator
Phase
MITRE
Function
Recon
Reconnaissance
TA0043
OSINT, network discovery, asset enumeration
Scanner
Discovery
TA0007
vulnerability scanning, service fingerprinting
Exploiter
Initial Access
TA0001
exploitation, payload delivery
Infiltrator
Lateral Movement
TA0008
post-exploitation, privilege escalation
Exfiltrator
Collection / Exfil
TA0009/10
data extraction, credential harvesting
Ghost
Persistence
TA0003
persistence, stealth, cleanup
Coordinator
Command & Control
TA0011
mission control, orchestration
Analyst
Analysis
—
pattern analysis, reporting
Providers: OpenRouter, Venice, Anthropic, OpenAI, or a keyless local agent (Claude Code / Codex / Hermes). Set OPENROUTER_API_KEY / VENICE_API_KEY / ANTHROPIC_API_KEY, or connect an agent in Settings.
Integrations:node dist/mcp-server.js exposes security_recon to MCP-aware agents. npm run server starts the HTTP API (POST /api/mission/start, GET /api/mission/status, and more). Full reference in docs/.
Contributing — join the swarm
Red-teaming shouldn't be a priesthood. Bring an adapter, a prompt pack, a runbook, a new arsenal tool, or a bug report.
One rule, non-negotiable: everything here is for authorized testing only. Owned, scoped, or consenting targets. Build for defenders, or don't build it here.
Fork it, branch it.
Open a PR with tests. If you touch a headline number, npm run verify-claims has to stay green.
