# RiskVoid Security Agent Kit

> The AI security agent you can put in front of a client. It reviews code and tests web apps, APIs and AI apps with 45+ real security tools. A firewall enforces the scope, you approve the risky steps, and it writes the report.

Open source · Self-hosted · Apache-2.0 · Version 0.1.0

- Runs on your machine
- No GPU needed
- macOS · Linux · Docker
- No paid edition

Repository: https://github.com/RiskVoid/Security-Agent-Kit
Web page: https://riskvoid.com/security-agent-kit

For authorised work only: systems you own or have written permission to test.

```bash
git clone https://github.com/RiskVoid/Security-Agent-Kit.git && cd Security-Agent-Kit && ./rvkit setup
```

## Why this one: built for work you answer for

Other agents lead with autonomy. This one lets you show what it touched, who allowed it, and where the client's code went.

1. **Scope by firewall.** A tool can't reach a host you didn't list, even if the model tries. Passive, active and intrusive tiers; single-use approvals; one command halts everything.
2. **Code stays with you.** Only the worker model reads source and raw tool output. You pick where it runs. Your GPU, a rented one, or hosted; zero-data-retention providers only; fully offline mode.
3. **Evidence you can defend.** Every command is logged out of the agent's reach. Every artefact is hashed. SHA-256 on every artefact; a person approves the report; sealed engagement archive.

## Who it's for: people who sign the report

- **Pentesters & consultancies: faster engagements.** It runs the checks and drafts the report in your branding. You approve the risky steps. [Your first engagement](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/first-engagement.md)
- **AppSec teams: code review in one run.** Source, dependencies and secrets, with SARIF out. The repo never leaves your network. [Working with the agent](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/running-the-agent.md)
- **AI app & MCP builders: test your own agent.** Prompt-injection probes and an MCP server audit, mapped to the OWASP LLM Top 10. [The practice lab](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/lab-and-benchmarks.md)

## What it can test

Describe the job in plain language. The agent plans, runs the tools and writes it up.

| Work | Method | Example tools |
| --- | --- | --- |
| Source code review | OWASP ASVS 5.0 | semgrep · Joern data flow · bandit · manual review |
| Dependencies & supply chain | SLSA · OpenSSF | trivy · grype · osv-scanner · syft (SBOM) |
| Secrets in code & git history |   | gitleaks · trufflehog |
| Web applications | OWASP WSTG 4.2 | ZAP · nuclei · ffuf · sqlmap · httpx |
| APIs: REST & GraphQL | OWASP API Top 10 | schemathesis · jwt_tool · GraphQL tools |
| AI apps, agents & MCP servers | OWASP LLM Top 10 · MITRE ATLAS | garak · rv-llm (prompt injection, MCP audit) |
| External networks | PTES | nmap · nuclei · testssl · DNS tools |
| Logged-in & multi-tenant apps | OWASP WSTG · API Top 10 | identities per role and tenant · HAR replay · sandboxed browser · authorization matrices |
| Laravel, source plus staging | Complete reference workflow | application map from source · build check against staging · optional PHP runtime |

- **Vulnerability intel:** CVE lookups from CISA KEV, EPSS, NVD and OSV.
- **Findings database:** Triage, dedupe and severity.
- **Retests:** Before and after evidence on the fixed build.

Not covered yet: Active Directory, cloud, Kubernetes, mobile. [All 45+ tools and their tiers](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/tools-reference.md)

## Controls outside the model

Enforced by the network and the tool server. The agent can't talk its way past them or approve its own requests.

- **Scope firewall:** Only the targets you listed are reachable.
- **Tiers:** Passive, active or intrusive. You choose what's allowed.
- **Approvals:** Intrusive commands wait for your yes, once each.
- **Rate limits:** Scanners are capped at your maximum rate.
- **Halt:** One command kills everything running.
- **Audit log:** Every command, refusal and approval is recorded.
- **Contained agent:** No direct internet, and it can't widen its scope.
- **Strict mode:** Optional: scripts need approval too.

Each control has a test: see the [regression matrix](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/regression-matrix.md). Known limitations are in [SECURITY.md](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/SECURITY.md).

## Where your data goes: you choose where code is read

Only the worker model reads source code. Pick where it runs. The planner model sees redacted summaries and findings. Evidence, audit log and reports stay on your machine.

| Option | Worker model runs on | Planner model runs on | You need | Command |
| --- | --- | --- | --- | --- |
| Hosted model, no GPU | OpenRouter, zero-data-retention providers only | OpenRouter, zero-data-retention providers only | only your OpenRouter key | `./rvkit worker openrouter` |
| Google Colab | Google Colab, on your own account | OpenRouter, zero-data-retention providers only | Colab Pro, about $10 a month | `/rv-start` |
| Rented GPU | The GPU you rent (RunPod, Vast.ai, Lambda, Modal) | OpenRouter, zero-data-retention providers only | a GPU running vLLM, llama.cpp or Ollama | `./rvkit worker api <url> <model> [key]` |
| Your own GPU | Your machine | OpenRouter, zero-data-retention providers only | about 24 GB VRAM for the default model, less for smaller ones | `./rvkit worker local` |
| Fully offline | Your machine | Not used. The local model plans too. | a local worker, the riskvoid-local agent, an offline engagement | `./rvkit worker local` |

## How it works: two models, one sandbox

Everything runs in Docker on your computer.

- **Agent UI:** Where you describe the job.
- **Planner:** Plans, triages and writes.
- **Worker:** Runs the tools, reads the code.
- **Kali sandbox:** 45+ tools, isolated per engagement.
- **Scope firewall** between the sandbox and the target.
- **Target:** Only what you authorised.
- Supporting: **Console** (approve, halt, triage, report), **Findings & report** (HTML, Word, PDF, Excel, SARIF), **Model gateway** (spend cap and fallbacks), **Audit log** (plus hashed evidence).

[Architecture: containers, trust boundaries and data flow](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/architecture.md)

## A full agent harness

Not a prompt wrapped around a shell. Most of the kit is the machinery around the model.

- **Delegation, focused tasks:** The worker gets one goal and returns a redacted summary. Raw output never reaches the planner.
- **Policy, scope compiled into policy:** SCOPE.md and RULES.md become versioned policy. A line the kit can't enforce is an error.
- **Approvals, exact-action approvals:** Bound to a digest of the command, its inputs and the policy revision. Used once.
- **Isolation, a sandbox per command:** Own namespaces, an unprivileged user, and only the credentials the command names.
- **Model gateway, data routes enforced:** An offline engagement can't reach a cloud model, whatever the conversation asks.
- **Durability, survives a restart:** Tasks resume from a checkpoint. An in-flight write is flagged, not repeated.
- **Resilience, refusals handled:** A refused or empty reply is retried or answered by a fallback model.
- **Findings, verified findings only:** A candidate is confirmed only when the planner states how it was verified.
- **Tested, its own test suite:** Fifteen integration suites run nightly, with a regression test per control.

## Console and report

The RiskVoid Console shows findings from the same lab run as the sample reports. Runs on 127.0.0.1 only.

The deliverable: a report in RiskVoid branding or your own, approved by a person before delivery. Formats: web page, Word, PDF, Excel register, JSON, SARIF, issue text.

- [Sample report, RiskVoid brand (PDF)](https://riskvoid.com/assets/security-agent-kit/samples/ledgerly-report-riskvoid.pdf)
- [Sample report, plain brand (PDF)](https://riskvoid.com/assets/security-agent-kit/samples/ledgerly-report-plain.pdf)

## Benchmarks: scored on evidence

A finding counts only with the right place and the required proof. No run flagged a clean control.

| Benchmark | Found | With evidence | Precision | Cost |
| --- | --- | --- | --- | --- |
| Flask service (source) | 6 of 6 | 6 of 6 | 0.67 | $1.16 |
| Express API (source) | 9 of 9 | 6 of 9 | 0.50 | $1.48 |
| LLM app and MCP server | 8 of 10 | 6 of 10 | 1.00 | $1.10 |
| DVWA | 8 of 8 | 8 of 8 | 0.40 | $3.13 |
| OWASP Juice Shop | 3 of 7 | 2 of 7 | 0.25 | $1.85 |
| DVGA (GraphQL) | 3 of 9 | 3 of 9 | 0.75 | $1.01 |
| VAmPI (REST) | 3 of 9 | 2 of 9 | 1.00 | $0.52 |
| Laravel lab, unattended | 1 of 6 | 1 of 6 | 1.00 | $1.10 |
| Laravel lab, with a person approving | 3 of 6 | 3 of 6 | 1.00 | $1.44 |

2026-11-10. One capped run each, GPT-6.1 planner and DeepSeek worker. Single runs vary.

- **Source review is the strongest part.** Every seeded issue found on both code targets.
- **Black-box testing is uneven.** DVWA complete; other labs a third to a half.
- **A person in the loop helps.** Approvals took the Laravel run from one finding to three.

Run them yourself: `./rvkit bench <name>`. [Full results and method](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/capability-baselines.md)

## How it compares

For a CTF or your own lab, a more autonomous agent may suit you better. This one is for work someone will audit.

|  | Security Agent Kit | Strix | Shannon | PentAGI | HexStrike AI |
| --- | --- | --- | --- | --- | --- |
| Scope enforced by the network | Yes, per engagement | Not mentioned | Rules-of-engagement config | Not mentioned | Not built in |
| Human approval for intrusive steps | Yes, single-use | Not mentioned | Not mentioned | Not mentioned | Not built in |
| Audit log | Yes, out of the agent's reach | Not mentioned | In Pro | Not mentioned | Not built in |
| Hashed evidence | SHA-256 on every artefact | Not mentioned | Not mentioned | Not mentioned | Not mentioned |
| Reports in the free version | HTML, Word, PDF, Excel, SARIF | Local viewer | PDF, Markdown, JSON, SARIF | Markdown, PDF | Vulnerability cards |
| Proves exploits automatically | Not yet, next on the roadmap | Yes | Yes | Not mentioned | Not mentioned |
| Licence | Apache-2.0, nothing gated | Apache-2.0, paid editions | AGPL-3.0, Pro edition | MIT, Enterprise edition | MIT |

From each project's README, 2026-11-08. Others are ahead on exploit validation, easy installs and autonomy. [Full comparison with sources](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/comparison.md)

## Run it from your coding agent

Open the kit folder in your coding agent (Claude Code, Cursor, GitHub Copilot, Gemini CLI, Codex) and ask in plain words. The repo ships its instructions and safety rules.

```text
$ cd Security-Agent-Kit && claude

/rv-setup   # installs, starts everything, runs the checks
/rv-start   # starts the worker on a Colab GPU
/rv-stop    # releases the GPU

# any other agent:
> Set up the RiskVoid kit. Follow AGENT_PLAYBOOK.md.
```

Example asks: "Create an engagement for Acme Ltd with scope app.acme.com." "What's waiting for my approval?" "Build the report for acme-2026-11 and close it out."

## Quick start: up in ten minutes

Setup asks four questions and starts the stack. Then practise on the isolated lab.

- **Machine:** Mac or Linux with Docker. 16 GB RAM, 25 GB disk.
- **Key:** An OpenRouter key. A few dollars covers many runs.
- **Windows:** Not supported yet.

```bash
git clone https://github.com/RiskVoid/Security-Agent-Kit.git
cd Security-Agent-Kit
./rvkit setup

./rvkit doctor       # checks everything, says what to fix
./rvkit quickstart   # practice engagement in the lab
./rvkit console      # approvals, live view, findings, report
```

[Your first engagement, 20 minutes](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/first-engagement.md)

## FAQ

### Do I need a GPU?

No. A computer with Docker and an OpenRouter key is enough. If you have a GPU, the worker can run there instead.

### What does it cost to run?

The kit is free. You pay for model usage: $0.52 to $3.13 per run in the first benchmarks, under a daily cap.

### Does client code leave my machine?

Your choice. Only the worker model reads source code, and you decide where it runs. With a local worker and an offline engagement, nothing leaves your machine.

### Does it replace a penetration tester?

No. It does the routine work and keeps the record. A person sets the scope, approves the risky steps and signs off the report.

### Can I put my own brand on the report?

Yes. Reports come in RiskVoid branding or a plain brand with your organisation's name.

### Is the licence going to change?

The kit is Apache-2.0 with no paid edition. RiskVoid's commercial product is a separate hosted GitHub App.

### Can I use it in CI?

Not as a packaged step yet. Findings export as SARIF today; a GitHub Action is on the roadmap.

### Is it legal to use?

Only on systems you own or have written permission to test. The controls keep a run inside its scope; the authorisation is yours to get.

### How do I report a security issue in the kit?

Privately, as described in SECURITY.md in the repository.

## Links

- [Documentation](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/docs/README.md)
- [Security policy](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/SECURITY.md)
- [Licence](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/LICENSE)
- [Third-party notices](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/THIRD_PARTY.md)
- [Changelog](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/CHANGELOG.md)
- [GitHub](https://github.com/RiskVoid/Security-Agent-Kit)
- [Discussions](https://github.com/RiskVoid/Security-Agent-Kit/discussions)
- [Roadmap](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/ROADMAP.md)
- [Contributing](https://github.com/RiskVoid/Security-Agent-Kit/blob/main/CONTRIBUTING.md)
- [Good first issues](https://github.com/RiskVoid/Security-Agent-Kit/contribute)

Building AI agents? RiskVoid's GitHub App reviews LangGraph, LangChain, CrewAI and n8n agents before they deploy: https://riskvoid.com