OpenHunterAI GitHub
OpenHunterAI's hooded robotic hunter with luminous cyan eyes.

Independent security assessment

OpenHunterAI.

Authorized pentesting.
Evidence first.

Explore the surface. Question the assumption.
Keep the evidence behind every conclusion.

Explore the workflow View on GitHub

Self-hosted · Under active development

Public introduction. Assessments run in your local workspace.

↓

01 / The assessment workflow

A clear path
from scope to evidence.

One engine for the dashboard and CLI. A declared public target, a bounded plan and a report that makes its limits visible.

  1. 01

    Declare the scope

    Choose the exact public HTTPS host and paths you may test. Confirm authority and select Quick, Standard or Deep.

    Authorization before execution
  2. 02

    Review the plan

    Check worker readiness and resource limits. Missing tools become explicit coverage gaps that require review.

    No silent profile downgrade
  3. 03

    Inspect the evidence

    Follow scoped observations and review candidates separately from validated findings. Sensitive actions require approval.

    A signal starts a question
  4. 04

    Keep a useful record

    Export the sanitized assessment, verification criteria and limitations. Prepare a manual handoff to OpenShieldAI.

    One immutable report snapshot

Web applications · APIs · AI / LLM applications

Read the product scope

02 / AI with a defined job

Reason about risk.
Stay grounded in facts.

Models help decide which questions deserve attention. The engine keeps authority, execution and evidence under explicit controls.

Explore reasoning routes
OBSERVE

Tools collect signals.

Browser inspection, passive surface checks, ZAP and curated Nuclei adapters provide observations. Their availability is checked for each run.

REASON

AI connects the context.

Summarize and deduplicate observations, rank surfaces, propose bounded hypotheses and validation plans, then explain verified facts.

CONTROL

Policy sets the boundary.

Scope, approvals, tool access and resource budgets constrain execution. Models cannot grant permission or manufacture evidence.

VERIFY

Proof earns the verdict.

Independent replay and matched controls remain release gates. A worker claim or model agreement alone cannot establish a vulnerability.

03 / A focused role in the security loop

Assessment meets
response.

Two distinct responsibilities, connected by a reviewable evidence record. Each product keeps its own authority and action controls.

OpenHunterAI / Assessment

Find. Explain. Verify.

Attack-method research, authorized testing, sanitized evidence, finding validation and finding-scoped manual retest.

Produces the assessment record

OpenShieldAI / Response

Investigate. Act. Recover.

Situation investigation, incident context, human-controlled containment, remediation coordination and recovery.

Explore OpenShieldAI

Development handoff: a manually transferred JSON file. The snapshot includes scope, finding and validation context, sanitized evidence references, coverage and verification criteria. A digest protects snapshot integrity; downstream asset mapping and authorization remain independent. The OpenShield importer is not implemented.

Review the development handoff

04 / Methods under study

Follow the changing
attack surface.

The development catalog contains nine source-linked research methods, organized around evidence, negative controls and a precise role for AI. Executor acceptance is pending.

Development preview · Research links open the work in PR #26.

01

Identity & authorization

Object and property boundaries, OAuth / OIDC lifecycle, delegated MCP identity.

 02

AI applications & agents

Indirect input at tool boundaries and retrieval isolation between tenants.

 03

APIs & protocol boundaries

ORM / filter disclosure, cache behavior, workflow concurrency and parser discrepancies. Cache, race and desync methods remain lab-only research.

 04

Global security frameworks

An offline development harness for mapping evidence and evaluating coverage across jurisdictions. Certification remains outside its scope.

Start on your machine

Your target.
Your authorized scope.

Node.js 22+, Docker with Compose v2 and Git. The operational workspace runs locally; this public page never starts an assessment.

Get the source Installation guide

LOCAL QUICK START

git clone https://github.com/LumosLab-Innovation/OpenHunterAI.git
cd OpenHunterAI
node ops/local.mjs start

Open the local workspace at http://localhost:3001.

Existing installation? Review the backup and migration instructions before upgrading a database.

Read setup requirements