{
  "markdown": "<p align=\"center\">\n  <img src=\"web/assets/logo.svg\" width=\"180\" alt=\"aiscan logo\">\n  <h1 align=\"center\">aiscan</h1>\n  <p align=\"center\">AI-driven single-binary pentest agent with a built-in multi-engine arsenal, ready to go</p>\n</p>\n\n<p align=\"center\">\n  <a href=\"https://github.com/chainreactors/aiscan/releases\"><img src=\"https://img.shields.io/github/v/release/chainreactors/aiscan?style=flat-square&color=00E59B\" alt=\"Release\"></a>\n  <a href=\"https://github.com/chainreactors/aiscan/actions/workflows/ci.yml\"><img src=\"https://img.shields.io/github/actions/workflow/status/chainreactors/aiscan/ci.yml?branch=master&style=flat-square&label=CI\" alt=\"CI\"></a>\n  <a href=\"https://github.com/chainreactors/aiscan/releases\"><img src=\"https://img.shields.io/github/downloads/chainreactors/aiscan/total?style=flat-square&color=00B4D8\" alt=\"Downloads\"></a>\n  <a href=\"https://github.com/chainreactors/aiscan/blob/master/LICENSE\"><img src=\"https://img.shields.io/badge/license-AGPL--3.0-blue?style=flat-square\" alt=\"AGPL-3.0\"></a>\n  <a href=\"https://github.com/chainreactors/aiscan/stargazers\"><img src=\"https://img.shields.io/github/stars/chainreactors/aiscan?style=flat-square&color=yellow\" alt=\"Stars\"></a>\n</p>\n\n<p align=\"center\">\n  <a href=\"README_CN.md\">中文文档</a>\n</p>\n\n---\n\n**aiscan** combines LLM agents with traditional security scanning engines. Three modes: **Scan** (deterministic pipeline, optional AI assist), **Agent** (natural-language autonomous assessment), **IOA** (multi-agent distributed collaboration).\n\n> **Use only on explicitly authorized targets. Unauthorized use is illegal.**\n\n## Quick Start\n\n```bash\n# No LLM needed — one-line scan\naiscan scan -i 192.168.1.0/24\n\n# With LLM — one-line agent\naiscan agent --base-url \"https://api.deepseek.com\" --api-key \"sk-...\" --model deepseek-chat \\\n  -p \"scan targets and check for high-risk vulnerabilities\" -i 192.168.1.0/24\n```\n\n## Install\n\n### Download Binary\n\nFrom [GitHub Releases](https://github.com/chainreactors/aiscan/releases/latest):\n\n| Edition | Description |\n| --- | --- |\n| **aiscan** | Standard — scan/agent/gogo/spray/zombie/neutron/proton/arsenal |\n| **aiscan-full** | Full — adds Web, playwright, passive recon, and katana |\n\n| OS | Arch | Standard | Full |\n| --- | --- | --- | --- |\n| Linux | amd64 / arm64 | `aiscan_linux_<arch>.zip` | `aiscan-full_linux_<arch>.zip` |\n| macOS | Intel / Apple Silicon | `aiscan_darwin_<arch>.zip` | `aiscan-full_darwin_<arch>.zip` |\n| Windows | amd64 / arm64 | `aiscan_windows_<arch>.zip` | `aiscan-full_windows_amd64.zip` |\n\n```bash\n# Linux\ncurl -LO https://github.com/chainreactors/aiscan/releases/latest/download/aiscan_linux_amd64.zip\nunzip aiscan_linux_amd64.zip\nchmod +x aiscan && sudo mv aiscan /usr/local/bin/\n\n# macOS Apple Silicon\ncurl -LO https://github.com/chainreactors/aiscan/releases/latest/download/aiscan_darwin_arm64.zip\nunzip aiscan_darwin_arm64.zip\nchmod +x aiscan && sudo mv aiscan /usr/local/bin/\n\n# Windows (PowerShell)\nInvoke-WebRequest \"https://github.com/chainreactors/aiscan/releases/latest/download/aiscan_windows_amd64.zip\" -OutFile aiscan.zip\nExpand-Archive .\\aiscan.zip -DestinationPath .\n.\\aiscan.exe --version\n```\n\n### Web Console (Full Edition)\n\nThe Web console is included in `aiscan-full`. It starts the browser UI and an\nembedded local agent by default. Open `http://127.0.0.1:8080` and enter the\naccess key printed at startup:\n\n```bash\naiscan-full web\n```\n\nTo listen on the network with a fixed access key:\n\n```bash\naiscan-full web --addr 0.0.0.0:8080 --token change-me\n```\n\nRun the Web console as a hub without an embedded agent, then connect agents\nfrom this or other hosts:\n\n```bash\n# Hub\naiscan-full web --addr 0.0.0.0:8080 --token change-me --no-agent\n\n# Remote node\naiscan agent --server-url http://change-me@server.example:8080 --node-name worker-01\n```\n\nThe Web console stores sessions, scans, assets, findings, and configuration in\n`aiscan-web.db` by default. Use `--db <path>` to select another SQLite file.\n\n### Build from Source\n\n```bash\ngit clone https://github.com/chainreactors/aiscan.git && cd aiscan\n\nmake                                                       # standard edition\nmake runner                                                # tag-free remote tool runner\nmake full                                                  # frontend + full edition\n```\n\nThe standalone agent executable is no longer a maintained build or release\ntarget. Reference wiring remains in `examples/agent` and can be run manually\nwith `go run ./examples/agent --help`. `make full` requires Node.js/npm and a\nworking CGO toolchain; it builds the frontend first so the latest `web/static`\nassets are embedded into the binary. The native `record` tool is not included\nin the default full build; SDK and tool developers can build it explicitly with\n`make record`, as described in [docs/record.md](docs/record.md).\n\n```bash\nmake web WEB_ADDR=127.0.0.1:18081 WEB_TOKEN=local-dev    # full build + Web UI\n```\n\nOn Windows amd64, `make` and `make full` use the bundled static RE2 backend\nand statically link the MinGW runtime, producing a single executable without\nRE2, Abseil, libstdc++, libgcc, or winpthread DLLs.\n\n---\n\n## Features\n\n### Design\n\n- **Single-file distribution** — bundled engines need no separate runtime install; OS graphics and system libraries still apply\n- **Minimal agent core** — composable ~160-line loop; tools, retries, evaluation are plugged in, not hardcoded\n- **Plugin architecture** — adding a new tool is one file; heavy dependencies (playwright, katana) are compile-time optional\n- **Embedded skills** — each tool carries its own usage docs and tactical guidance, loaded by the agent on demand\n- **Scan + Agent unified** — the same engines drive both the deterministic pipeline and the autonomous agent\n\n### Scan — Deterministic Pipeline\n\n- Multi-stage auto-chaining: port discovery → web probing → weak credentials → POC detection — no LLM required\n- Optional AI-driven result verification, public CVE correlation, and dynamic testing\n- Quick mode for fast exposure mapping, full mode for deep crawl and extended coverage\n\n### Agent — Autonomous Security Assessment\n\n- Natural language tasks — the agent plans, scans, analyzes, and reports autonomously\n- Goal evaluation — an independent evaluator judges task completion and drives automatic retry\n- Interactive REPL with direct command execution\n- Multiple provider profiles with explicit manual switching\n\n### [IOA](https://github.com/chainreactors/ioa) — Multi-Agent Collaboration\n\n- Shared message spaces for distributed agent coordination\n- Worker mode for persistent task listening\n- Built-in IOA server with token authentication\n- See: [Design](https://github.com/chainreactors/ioa/blob/main/docs/design.md) | [CLI](https://github.com/chainreactors/ioa/blob/main/docs/cli.md) | [Extension](https://github.com/chainreactors/ioa/blob/main/docs/extension.md)\n\n### Built-in Toolset\n\n**Scanners**\n- [gogo](https://github.com/chainreactors/gogo) — port, service, and banner discovery\n- [spray](https://github.com/chainreactors/spray) — web probing, fingerprinting, path fuzzing\n- [zombie](https://github.com/chainreactors/zombie) — credential testing\n- [neutron](https://github.com/chainreactors/neutron) — template-based POC execution\n- [proton](https://github.com/chainreactors/proton) — sensitive information scanning (API keys, tokens, credentials, secrets)\n- [cyberhub](https://github.com/chainreactors/fingers) — fingerprint and POC association query\n\n**Browser & Recon** (full edition)\n- playwright — headless Chromium sessions, screenshots, network capture\n- katana — web crawler with standard/headless/hybrid engines\n- passive — cyberspace search (FOFA, Hunter, Shodan)\n\n**Optional SDK tools**\n- record — native desktop/window screenshots and H.264/MP4 recording (Windows and Linux X11)\n\n**Utilities**\n- tmux — background task sessions with incremental output delivery\n- arsenal — security tool package manager ([crtm](https://github.com/chainreactors/crtm)), one-command install\n- proxy — multi-protocol proxy chain (trojan/vless/anytls/hy2/ss)\n- web_search / fetch — CVE search and URL fetching\n\n---\n\n## Usage\n\n### Scan Mode\n\n```bash\naiscan scan -i 192.168.1.0/24                                    # quick scan\naiscan scan -i 192.168.1.0/24 --mode full                        # full scan\naiscan scan -i http://target.example --verify=high --sniper       # AI-enhanced\naiscan scan -i http://target.example --mode full --deep --report  # full + deep + report\n```\n\n### Agent Mode\n\n```bash\n# One-shot task\naiscan agent -p \"scan and find web vulnerabilities\" -i 192.168.1.0/24\n\n# With goal evaluation\naiscan agent -p \"full scan\" -i http://target.example -e \"find all open ports with service fingerprints\"\n\n# Interactive REPL\naiscan agent\n```\n\n### IOA Mode\n\n```bash\n# Start IOA server\naiscan ioa serve --ioa-url http://0.0.0.0:8765\n\n# Start IOA worker\naiscan agent --ioa-url http://127.0.0.1:8765 --space pentest-project \\\n  -p \"scan assigned targets and report findings\"\n```\n\n### LLM Configuration\n\n```bash\n# Environment variable\nexport OPENAI_API_KEY=\"sk-...\"\n\n# CLI arguments\naiscan agent --provider openai --base-url https://api.deepseek.com/v1 --api-key sk-... --model deepseek-chat\n```\n\nConfig file `aiscan.yaml`:\n\n```yaml\nllm:\n  provider: openai\n  api_key: sk-...\n  model: gpt-4o\n  context_window: 128000   # Set explicitly for custom model IDs\n  max_tokens: 16384        # Maximum output per response\n```\n\n`context_window` is a literal token count: use `128000`, not `128K`. Values below 8192 are accepted, but the Web UI warns that they may be too small. The request output limit is dynamically clamped to the remaining context: `min(max_tokens, context_window - current_context - 4096)`. If no output space remains, AIScan returns a clear error instead of sending a one-token request. Automatic compaction starts as the context approaches the configured window.\n\n---\n\n## Documentation\n\n| Doc | Description |\n| --- | --- |\n| [Scan Mode](docs/scan.md) | Pipeline, AI enhancements, output formats |\n| [Agent Mode](docs/agent.md) | Toolset, Goal Evaluation, REPL |\n| [IOA](docs/ioa.md) | Multi-agent architecture, Space/Node/Message model |\n| [Record Tool](docs/record.md) | Desktop/window capture, platform support, native builds |\n| [Reference](docs/reference.md) | Configuration, providers, flags, scanner usage, FAQ |\n| [v1.0.0 Guide](docs/v1.0.0.md) | Stable API baseline, removed pre-v1 interfaces, release profiles |\n| [Changelog](docs/changelog.md) | Version history |\n\n## Contributing\n\n1. Fork this repository\n2. Create a feature branch (`git checkout -b feature/xxx`)\n3. Commit your changes (`git commit -m 'feat: add xxx'`)\n4. Push to the branch (`git push origin feature/xxx`)\n5. Create a Pull Request\n\n## Disclaimer\n\n1. This tool is intended for **authorized security testing and research purposes only**. If you need to test its capabilities, please set up your own lab environment.\n2. Before using this tool for any scanning, you must ensure compliance with local laws and regulations and obtain **sufficient authorization. Do not scan unauthorized targets.**\n3. If you engage in any illegal activity while using this tool, you shall bear all consequences yourself. We assume no legal or joint liability.\n4. Before installing and using this tool, please **carefully read and fully understand all terms**. Limitation and disclaimer clauses may be highlighted for your attention.\n5. Unless you have fully read, understood, and accepted all terms of this agreement, please do not install or use this tool. Your use or any other express or implied acceptance constitutes your agreement to be bound by these terms.\n\n## License\n\nThis project is licensed under the [GNU Affero General Public License v3.0 (AGPL-3.0)](LICENSE).\n\n## Links\n\n- [chainreactors](https://github.com/chainreactors) — Organization\n- [IOA](https://github.com/chainreactors/ioa) — Internet of Agents\n- [gogo](https://github.com/chainreactors/gogo) — Port & service discovery\n- [spray](https://github.com/chainreactors/spray) — Web probing & fingerprinting\n- [zombie](https://github.com/chainreactors/zombie) — Credential testing\n- [neutron](https://github.com/chainreactors/neutron) — Template-based POC engine\n- [fingers](https://github.com/chainreactors/fingers) — Fingerprint rule engine\n- [sdk](https://github.com/chainreactors/sdk) — Scanner SDK (gogo/spray/zombie core)\n- [proxyclient](https://github.com/chainreactors/proxyclient) — Multi-protocol proxy client\n- [crtm](https://github.com/chainreactors/crtm) — Security tool package registry\n- [utils](https://github.com/chainreactors/utils) — Shared utilities & PTY manager\n- [parsers](https://github.com/chainreactors/parsers) — Protocol & data parsers\n\n---\n\n<p align=\"center\">\n  <a href=\"https://star-history.com/#chainreactors/aiscan&Date\">\n    <img src=\"https://api.star-history.com/svg?repos=chainreactors/aiscan&type=Date\" alt=\"Star History\" width=\"600\">\n  </a>\n</p>\n",
  "bytes": 12945,
  "sha": "a44306c1d0c20f85c2c811ae0c2f60f54f78620527f4198127200895879ad09c",
  "repo_slug": "chainreactors/cyber-harness",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/okf_chainreactors_cyber_harness_skills_aisca_804d7055/readme"
}