RiskVoidSecurity Agent Kit
GitHubQuick start
Open source · Self-hosted · Apache-2.0

The AI security agent you can put in front of a client.

It reviews code and tests web apps, APIs and AI apps with 45+ real security tools. A firewall enforces the scope, you approve the risky steps, and it writes the report.

Runs on your machineNo GPU neededmacOS · Linux · DockerNo paid edition
View on GitHubQuick startSee a sample report
git clone https://github.com/RiskVoid/Security-Agent-Kit.git && cd Security-Agent-Kit && ./rvkit setup

For authorised work only: systems you own or have written permission to test.

A real 30-minute run on the practice lab, sped up to under a minute.

Built on
  • Kali Linux
  • OpenHands
  • LiteLLM
  • Model Context Protocol
  • SearXNG
  • Docker
Methods
  • OWASPWSTG · ASVS · API Top 10 · LLM Top 10
  • PTES
  • MITRE ATLAS
  • SLSA · OpenSSF
Why this one

Built for work you answer for.

Other agents lead with autonomy. This one lets you show what it touched, who allowed it, and where the client's code went.

01

Scope by firewall.

A tool can't reach a host you didn't list, even if the model tries.

  • Passive, active and intrusive tiers
  • Single-use approvals
  • One command halts everything
02

Code stays with you.

Only the worker model reads source and raw tool output. You pick where it runs.

  • Your GPU, a rented one, or hosted
  • Zero-data-retention providers only
  • Fully offline mode
03

Evidence you can defend.

Every command is logged out of the agent's reach. Every artefact is hashed.

  • SHA-256 on every artefact
  • A person approves the report
  • Sealed engagement archive
Who it's for

For people who sign the report.

Pentesters & consultancies

Faster engagements.

It runs the checks and drafts the report in your branding. You approve the risky steps.

Your first engagement
AppSec teams

Code review in one run.

Source, dependencies and secrets, with SARIF out. The repo never leaves your network.

Working with the agent
AI app & MCP builders

Test your own agent.

Prompt-injection probes and an MCP server audit, mapped to the OWASP LLM Top 10.

The practice lab
What it can do

What it can test.

Describe the job in plain language. The agent plans, runs the tools and writes it up.

WorkMethodExample tools
Source code reviewOWASP ASVS 5.0semgrep · Joern data flow · bandit · manual review
Dependencies & supply chainSLSA · OpenSSFtrivy · grype · osv-scanner · syft (SBOM)
Secrets in code & git historygitleaks · trufflehog
Web applicationsOWASP WSTG 4.2ZAP · nuclei · ffuf · sqlmap · httpx
APIs: REST & GraphQLOWASP API Top 10schemathesis · jwt_tool · GraphQL tools
AI apps, agents & MCP serversOWASP LLM Top 10 · MITRE ATLASgarak · rv-llm (prompt injection, MCP audit)
External networksPTESnmap · nuclei · testssl · DNS tools
Logged-in & multi-tenant appsOWASP WSTG · API Top 10identities per role and tenant · HAR replay · sandboxed browser · authorization matrices
Laravel, source plus stagingComplete reference workflowapplication map from source · build check against staging · optional PHP runtime

Vulnerability intel

CVE lookups from CISA KEV, EPSS, NVD and OSV.

Findings database

Triage, dedupe and severity.

Retests

Before and after evidence on the fixed build.

Not covered yet: Active Directory, cloud, Kubernetes, mobile. All 45+ tools and their tiers

Why you can trust it on client work

Controls outside the model.

Enforced by the network and the tool server. The agent can't talk its way past them or approve its own requests.

The RiskVoid Console overview of an engagement: findings by severity, the scope and rules in force (targets, tiers, rate, network), where each model sends data, and a Halt now button
The console's overview of a lab engagement: scope, tiers, rate limit, model routes and Halt.

Scope firewall

Only the targets you listed are reachable.

Tiers

Passive, active or intrusive. You choose what's allowed.

Approvals

Intrusive commands wait for your yes, once each.

Rate limits

Scanners are capped at your maximum rate.

Halt

One command kills everything running.

Audit log

Every command, refusal and approval is recorded.

Contained agent

No direct internet, and it can't widen its scope.

Strict mode

Optional: scripts need approval too.

Each control has a test: see the regression matrix. Known limitations are in SECURITY.md.

Where your data goes

You choose where code is read.

Only the worker model reads source code. Pick where it runs.

Worker model

Runs the tools, reads the code

Sees client code and tool output.

Runs onOpenRouter, zero-data-retention providers only
Planner model

Plans, triages, writes

Sees redacted summaries and findings.

Runs onOpenRouter, zero-data-retention providers only
Everything else

Evidence, audit log, reports

The whole engagement folder.

Stays onYour machine
You need: only your OpenRouter key./rvkit worker openrouter
How it works

Two models, one sandbox.

Everything runs in Docker on your computer.

Agent UI

Where you describe the job.

Planner

Plans, triages and writes.

Worker

Runs the tools, reads the code.

Kali sandbox

45+ tools, isolated per engagement.

Scope
firewall

Target

Only what you authorised.

Console

Approve, halt, triage, report.

Findings & report

HTML, Word, PDF, Excel, SARIF.

Model gateway

Spend cap and fallbacks.

Audit log

Plus hashed evidence.

Architecture: containers, trust boundaries and data flow

Under the hood

A full agent harness.

Not a prompt wrapped around a shell. Most of the kit is the machinery around the model.

Delegation

Focused tasks

The worker gets one goal and returns a redacted summary. Raw output never reaches the planner.

Policy

Scope compiled into policy

SCOPE.md and RULES.md become versioned policy. A line the kit can't enforce is an error.

Approvals

Exact-action approvals

Bound to a digest of the command, its inputs and the policy revision. Used once.

Isolation

A sandbox per command

Own namespaces, an unprivileged user, and only the credentials the command names.

Model gateway

Data routes enforced

An offline engagement can't reach a cloud model, whatever the conversation asks.

Durability

Survives a restart

Tasks resume from a checkpoint. An in-flight write is flagged, not repeated.

Resilience

Refusals handled

A refused or empty reply is retried or answered by a fallback model.

Findings

Verified findings only

A candidate is confirmed only when the planner states how it was verified.

Tested

Its own test suite

Fifteen integration suites run nightly, with a regression test per control.

How one task flows, step by step

See what you get

Console and report.

The RiskVoid Console findings page for an engagement: three findings with severity, asset, CWE, verification and status

The RiskVoid Console

Findings from the same lab run as the sample reports. Runs on 127.0.0.1 only.

The deliverable

A report in RiskVoid branding or your own, approved by a person before delivery.

Web pageWordPDFExcel registerJSONSARIFIssue text
Sample report, RiskVoid brand PDFSample report, plain brand PDF
Measured, not claimed

Scored on evidence.

A finding counts only with the right place and the required proof. No run flagged a clean control.

BenchmarkFoundWith evidencePrecisionCost
Flask service (source)6 of 66 of 60.67$1.16
Express API (source)9 of 96 of 90.50$1.48
LLM app and MCP server8 of 106 of 101.00$1.10
DVWA8 of 88 of 80.40$3.13
OWASP Juice Shop3 of 72 of 70.25$1.85
DVGA (GraphQL)3 of 93 of 90.75$1.01
VAmPI (REST)3 of 92 of 91.00$0.52
Laravel lab, unattended1 of 61 of 61.00$1.10
Laravel lab, with a person approving3 of 63 of 61.00$1.44

2026-11-10. One capped run each, GPT-6.1 planner and DeepSeek worker. Single runs vary.

Source review is the strongest part.

Every seeded issue found on both code targets.

Black-box testing is uneven.

DVWA complete; other labs a third to a half.

A person in the loop helps.

Approvals took the Laravel run from one finding to three.

Run them yourself: ./rvkit bench <name>. Full results and method

Alternatives

How it compares.

For a CTF or your own lab, a more autonomous agent may suit you better. This one is for work someone will audit.

CapabilitySecurity Agent KitStrixShannonPentAGIHexStrike AI
Scope enforced by the networkYes, per engagementNot mentionedRules-of-engagement configNot mentionedNot built in
Human approval for intrusive stepsYes, single-useNot mentionedNot mentionedNot mentionedNot built in
Audit logYes, out of the agent's reachNot mentionedIn ProNot mentionedNot built in
Hashed evidenceSHA-256 on every artefactNot mentionedNot mentionedNot mentionedNot mentioned
Reports in the free versionHTML, Word, PDF, Excel, SARIFLocal viewerPDF, Markdown, JSON, SARIFMarkdown, PDFVulnerability cards
Proves exploits automaticallyNot yet, next on the roadmapYesYesNot mentionedNot mentioned
LicenceApache-2.0, nothing gatedApache-2.0, paid editionsAGPL-3.0, Pro editionMIT, Enterprise editionMIT

From each project's README, 2026-11-08. Others are ahead on exploit validation, easy installs and autonomy. Full comparison with sources

Run it from your coding agent

Just ask your coding agent.

Open the kit folder in your coding agent and ask in plain words. The repo ships its instructions and safety rules.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Gemini CLI
  • Codex
  • Create an engagement for Acme Ltd with scope app.acme.com.
  • What's waiting for my approval?
  • Build the report for acme-2026-11 and close it out.
$ cd Security-Agent-Kit && claude

/rv-setup   # installs, starts everything, runs the checks
/rv-start   # starts the worker on a Colab GPU
/rv-stop    # releases the GPU

# any other agent:
> Set up the RiskVoid kit. Follow AGENT_PLAYBOOK.md.
Quick start

Up in ten minutes.

Setup asks four questions and starts the stack. Then practise on the isolated lab.

  • macOS
  • Linux
  • Docker
  • OpenRouter
  • Colab
  • Ollama
Machine
Mac or Linux with Docker. 16 GB RAM, 25 GB disk.
Key
An OpenRouter key. A few dollars covers many runs.
Windows
Not supported yet.
$ git clone https://github.com/RiskVoid/Security-Agent-Kit.git
$ cd Security-Agent-Kit
$ ./rvkit setup

$ ./rvkit doctor       # checks everything, says what to fix
$ ./rvkit quickstart   # practice engagement in the lab
$ ./rvkit console      # approvals, live view, findings, report
View on GitHubYour first engagement, 20 minutes
FAQ

Common questions.

Do I need a GPU?01
No. A computer with Docker and an OpenRouter key is enough. If you have a GPU, the worker can run there instead.
What does it cost to run?02
The kit is free. You pay for model usage: $0.52 to $3.13 per run in the first benchmarks, under a daily cap.
Does client code leave my machine?03
Your choice. Only the worker model reads source code, and you decide where it runs. With a local worker and an offline engagement, nothing leaves your machine.
Does it replace a penetration tester?04
No. It does the routine work and keeps the record. A person sets the scope, approves the risky steps and signs off the report.
Can I put my own brand on the report?05
Yes. Reports come in RiskVoid branding or a plain brand with your organisation's name.
Is the licence going to change?06
The kit is Apache-2.0 with no paid edition. RiskVoid's commercial product is a separate hosted GitHub App.
Can I use it in CI?07
Not as a packaged step yet. Findings export as SARIF today; a GitHub Action is on the roadmap.
Is it legal to use?08
Only on systems you own or have written permission to test. The controls keep a run inside its scope; the authorisation is yours to get.
How do I report a security issue in the kit?09
Privately, as described in SECURITY.md in the repository.

Try it on the lab first.

An isolated practice lab is included. One guided run takes about 20 minutes.

View on GitHubDiscussionsRoadmapContributingGood first issues
Building AI agents? RiskVoid's GitHub App reviews LangGraph, LangChain, CrewAI and n8n agents before they deploy.See RiskVoid
Security Agent Kit 0.1.0 · Apache-2.0