BitterSecurity/Decepticon

Autonomous Hacking Agent for Red Team

Summary

Decepticon is an open-source autonomous red team agent written in Python, built on LangChain and LangGraph, that runs multi-stage penetration testing engagements from reconnaissance through exploitation and post-exploitation. It orchestrates specialist agents inside an isolated Kali Linux sandbox on a separate Docker network, with an optional Blue Cell for local defensive monitoring.

What it is useful for

Decepticon is useful for security engineers who need to run repeatable, AI-driven adversary simulations against authorized targets. Its 16 specialist agents cover reconnaissance, vulnerability research, exploitation, Active Directory, cloud, and reverse engineering through a Ghidra-based REA workload, enabling realistic attack chains rather than surface-level scans. The optional Blue Cell mode lets developers run a connected defensive sensor against a local web service to observe and triage suspicious events, though the README notes it reports incidents rather than automatically blocking traffic. The project also exposes an SDK for teams building custom offensive agents or research integrations on top of its agent factories and middleware.

How engineers can use it

The README documents three usage paths. For self-hosted engagements, install Docker and Docker Compose v2, then run the install script (curl -fsSL https://decepticon.red/install | bash on macOS, Linux, or WSL2, or the PowerShell equivalent on Windows), followed by decepticon onboard to configure a provider and API key, and decepticon to start the core management plane (LiteLLM, PostgreSQL, Neo4j, Skillogy, LangGraph, sandbox) and drop into the CLI. The web dashboard launches on demand via /web, and specialist workloads such as BloodHound CE, Sliver C2, and REA/Ghidra start only when the orchestrator calls ops_start(...). To embed Decepticon in Claude Code or Codex, register the MCP server with claude mcp add --scope user decepticon -- decepticon mcp serve (or the Codex equivalent) and run decepticon skill install. As a library, install with pip install decepticon or pip install "decepticon[neo4j]"; the SDK still requires runtime services reachable over HTTP via DECEPTICON_LLM__PROXY_URL and SANDBOX_URL. The README carries a disclaimer requiring explicit written authorization before any engagement.