Awesome Security Agent Harnesses

AI agents for pentesting, code audit, fuzzing, vulnerability discovery, and reverse engineering — harnesses, sandboxes, security MCP servers, benchmarks, and evals.

Please read the contribution guidelines before opening a pull request.

Contents

• What Is a Security Agent Harness
• Code Audit Harnesses
• Pentesting Agents
• Fuzzing and Vulnerability Discovery
• DARPA AIxCC Cyber Reasoning Systems
• Agent Tooling and Integrations
• Agent Sandboxes
• Benchmarks and Evals

What Is a Security Agent Harness

A security agent harness is everything wrapped around the model: the sandbox it runs in, the analysis tools it can call, the prompts and skills that encode a methodology, and the evals you use to check it. Most of the engineering in these systems lives here rather than in the model.

Agents are good at producing plausible findings and bad at telling which ones are real. A harness that can reproduce a crash, replay an input, or re-run a static analyzer is how you throw out the bad ones before a human ever sees them.

Code Audit Harnesses

Harnesses that run coding agents against source code: discovery, triage, validation, and patching.

• audit - Eight-stage discovery agent built on the Claude Code SDK, combining many narrow agents, deliberate disagreement between them, and an explicit reachability gate.
• Clearwing - Autonomous source-code hunter that ranks files, fans out specialist agents, and treats sanitizer crashes as ground truth, with a separate network-pentest mode.
• Codex Security - OpenAI's CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities with Codex.
• Deepsec - Vercel Labs' security harness for finding vulnerabilities in a codebase using coding agents.
• Defending Code Reference Harness - Anthropic's reference implementation for autonomous vulnerability discovery and remediation with Claude, with skills for threat modeling, scanning, triage, and patching.
• OpenHack - Multi-agent scanner running recon, specialist hunts, independent validation, and sandbox and browser verification, using only open-source models.
• RAPTOR - Autonomous research framework chaining static analysis, binary analysis, vulnerability validation, exploit generation, and patch writing over a codebase or binary.
• Visa Vulnerability Agentic Harness - Visa's agentic SAST pipeline for autonomous vulnerability discovery, remediation, and validation, emitting Markdown and SARIF reports.
• VulnHunter - Capital One's agentic security tool applying proactive, attacker-first analysis directly to source code.

Pentesting Agents

Agents that attack running applications and infrastructure: reconnaissance, exploitation, and proof of impact.

• AIDA - Model-agnostic pentesting agent that reasons over a defined scope, executes in an isolated container, and keeps persistent assessment state across sessions.
• AWE - Research framework pairing a lightweight orchestration layer with memory-augmented, vulnerability-specific agent pipelines, evaluated on the XBOW benchmark.
• CAI - Alias Robotics' framework for building cybersecurity agents, with tool and workflow primitives for offensive testing.
• CyberStrike - Offensive-security harness coordinating autonomous agents over signed attack skills, built-in tools, and MCP integrations, mapped to MITRE ATT&CK and OWASP WSTG.
• HPTSA - Research implementation behind Teams of LLM Agents can Exploit Zero-Day Vulnerabilities, using a supervisor agent to coordinate vulnerability-specialized subagents.
• Nebula - Penetration-testing assistant that automates recon, note-taking, and tool orchestration.
• NeuroSploit - Rust harness that turns a URL, repository, or host into an autonomous engagement, selecting only the specialist agents matching the surface and validating findings across models.
• PentAGI - Fully autonomous multi-agent pentesting system with Docker isolation, planning and supervision, persistent memory, and a web control plane.
• Pentest Copilot - Agent that drives a Kali attack box end to end, installing tooling as needed, operating Burp and a real browser, and spawning parallel subagents.
• PentestAgent - Black-box testing framework with autonomous and multi-agent modes, attack playbooks, Kali execution, and persistent sessions.
• PentestGPT - Automated penetration-testing agentic framework powered by large language models.
• RedAmon - End-to-end platform chaining recon, exploitation, and post-exploitation over a Neo4j attack graph, then triaging findings, patching the code, and opening pull requests.
• Shannon - AI pentester for web applications and APIs that analyzes source code, identifies attack vectors, and executes real exploits to prove findings.
• Strix - Open-source AI penetration-testing agent that finds and helps fix application vulnerabilities.

Fuzzing and Vulnerability Discovery

Harnesses that use models to find crashes and generate patches.

• OSS-Fuzz-Gen - Google's framework for generating and benchmarking fuzz targets with LLMs across C/C++, Java, and Python.

DARPA AIxCC Cyber Reasoning Systems

The seven finalist systems from the DARPA AI Cyber Challenge, each built to autonomously find and patch vulnerabilities in real open-source code, and each released as a competition snapshot.

• ARTIPHISHELL - Shellphish's cyber reasoning system, released with its components, pipelines, services, and full deployment stack.
• Atlantis - Team Atlanta's cyber reasoning system that won the final competition.
• BugBuster - Team 42-b3yond-6ug's cyber reasoning system, preserved with the core components and deployment configuration needed to run it.
• Buttercup - Trail of Bits' second-place cyber reasoning system, pairing an OSS-Fuzz fuzzing campaign with a multi-agent patcher.
• FuzzingBrain - Team all_you_need_is_a_fuzzing_brain's system, pairing coverage-guided fuzzing with agents that reason about suspicious points, build proofs of vulnerability, and dynamically verify every finding.
• Lacrosse - SIFT's multi-agent cyber reasoning system, combining fuzzing and symbolic reasoning to find and patch bugs in C and Java.
• Robo Duck - Theori's third-place cyber reasoning system, released as the complete finals submission.

Agent Tooling and Integrations

Security capabilities exposed to somebody else's agent, largely as MCP servers and disassembler plugins. These supply the tools a harness calls; they do not own the agent loop themselves.

• Binary Ninja Headless MCP - Headless Binary Ninja MCP server exposing 180 analysis tools to agents.
• Burp Suite MCP - PortSwigger's own MCP server, connecting agents to Burp Suite's proxy, scanner, and repeater.
• DAILA - Decompiler-agnostic plugin for using AI assistance inside your decompiler.
• Gepetto - IDA plugin that queries language models to explain and rename decompiled functions.
• HexStrike AI - MCP server that gives agents a large toolkit of offensive security tools for recon, scanning, and exploitation.
• IDA Pro MCP - MCP server exposing IDA Pro decompilation, cross-references, and type inference to coding agents.
• LLM4Decompile - Open models and pipeline for decompiling binary code into readable C.
• ReVa - Ghidra extension providing an MCP server for agent-driven reverse engineering.

Agent Sandboxes

Isolation for running agent-generated code and untrusted targets.

• E2B - Sandboxed cloud environments purpose-built for running agent-generated code.
• Firecracker - AWS's minimal microVM monitor, a common hardware-isolation primitive for running untrusted code.
• gVisor - Google's application kernel that intercepts syscalls to sandbox untrusted workloads without a full VM.
• Microsandbox - Local-first microVM runtime for executing untrusted agent code.
• Sandbox Runtime - Anthropic's lightweight tool for enforcing filesystem and network restrictions on agents.

Benchmarks and Evals

Task sets and ground truth for measuring whether a harness actually works.

• ADR - Uber's agent detection and response system, including a benchmark of 300+ agent-attack tasks across 133 MCP servers.
• AIRTBench - Dreadnode's benchmark measuring autonomous AI red-teaming capability.
• ARVO - Atlas of reproducible open-source vulnerabilities, used as ground truth for patching agents.
• Cybench - Framework for evaluating language model agents on 40 professional CTF tasks.
• CyberGym - Berkeley's large-scale benchmark evaluating agents on real-world vulnerability reproduction.
• HackSynth - Autonomous pentesting agent released with two CTF benchmark sets of 200 challenges drawn from PicoCTF and OverTheWire.
• NYU CTF Bench - D-CIPHER and baseline agents for the NYU CTF benchmark.