- Home
- Penetration Testing Software
- RedAmon
RedAmon
What it is
RedAmon is a free, open-source framework for authorized red-team work, automating reconnaissance, exploitation, and post-exploitation operations. It maps attack surfaces from domains, IP/CIDR targets, or batches of domains, then gathers findings in a Neo4j graph that its AI agent can query for planning and exploitation. GVM/OpenVAS provides network vulnerability scanning; separate tools detect secrets and check packages for malicious or vulnerable components against a local OSV database. RedAmon supports twelve AI providers and more than 400 language models, with an MCP server that lets external agents drive the framework. The Dockerized application runs on Linux, macOS, and Windows, with on-premises deployment. Tools, scanners, and agents run in separate containers with per-job ephemeral filesystems and network namespaces. Rules of Engagement, approval gates, scope controls, and a guardrail blocking government, military, and intergovernmental targets govern operations. On macOS, SYN-based scanners cannot see the local LAN because they run in Docker Desktop's LinuxKit VM. The project warns that configured API keys and credentials are stored unencrypted in PostgreSQL, so securing the database is the user's responsibility.
For and against
For
- Free, open-source, and self-hosted.
- Runs on Linux, macOS, and Windows.
- Supports twelve AI providers.
- Includes scope controls and approval gates.
Against
- macOS SYN scanners cannot see the local LAN.
- Configured credentials are stored unencrypted in PostgreSQL.
- Database security is the user's responsibility.
The verdict
RedAmon combines automated reconnaissance and exploitation workflows with scanning, AI-provider support, and scope controls. Before use, readers should account for the macOS LAN scanning limitation and the responsibility to secure stored credentials.
Who it suits
RedAmon is intended for authorized security testing, education, and research. Its free, self-hosted format may suit users who need a framework spanning reconnaissance, network scanning, and other red-team tasks.
Plans and prices
Open-source self-hosted
MIT license · Docker stack · commercial and personal use
Read 1 Oct 2026 · redamon.org
On the record
- AI providers
- RedAmon supports twelve AI providers and more than 400 language models through one interface.redamon.org · read 1 Oct 2026
- Attack-surface graph
- Recon findings are merged into a Neo4j attack-surface graph that the AI agent queries for planning and exploitation.redamon.org · read 1 Oct 2026
- Authorized use
- The documentation says RedAmon is intended only for authorized security testing, education and research.redamon.org · read 1 Oct 2026
- Credential storage limit
- The project disclaimer states that configured API keys and credentials are stored unencrypted in PostgreSQL and securing the database is the user's responsibility.github.com · read 1 Oct 2026
- Governance
- Rules of Engagement, approval gates, non-bypassable scope controls and a guardrail blocking government, military and intergovernmental targets are provided.redamon.org · read 1 Oct 2026
- Isolation
- Tools, scanners and agents run in separate containers with per-job ephemeral filesystems and network namespaces.redamon.org · read 1 Oct 2026
- macOS limitation
- On macOS, SYN-based scanners cannot see the local LAN because they run inside Docker Desktop's LinuxKit VM.redamon.org · read 1 Oct 2026
- MCP integration
- Its MCP Server lets external agents such as Claude Code, Claude Desktop, Codex CLI, Cursor, Windsurf, Cline, Goose and Gemini CLI drive RedAmon.redamon.org · read 1 Oct 2026
- Network scanning
- GVM/OpenVAS integration provides network vulnerability scanning with more than 170,000 NVTs.redamon.org · read 1 Oct 2026
- Purpose
- RedAmon is an AI-powered agentic red-team framework that automates reconnaissance, exploitation and post-exploitation operations.redamon.org · read 1 Oct 2026
- Recon pipeline
- Its parallelized reconnaissance pipeline maps attack surfaces from domains, IP/CIDR targets or domain batches.redamon.org · read 1 Oct 2026
- Secret detection
- The Secret Multiscanner provides 1,060 detectors across 14 sources and optional live API verification.redamon.org · read 1 Oct 2026
- Supply-chain scanning
- Supply-chain scanning detects malicious and vulnerable packages offline against a local OSV database.redamon.org · read 1 Oct 2026
- Support
- The maintainers list [email protected] for questions, feedback and collaboration, plus Telegram contacts @samsamtx and @L4stPL4Y3R.redamon.org · read 1 Oct 2026
- Supported operating systems
- The Dockerized application runs on Linux, macOS and Windows.redamon.org · read 1 Oct 2026
