Autonomous AI-driven penetration testing, vulnerability assessment, and cyber threat intelligence. Self-hosted. Multi-modality.
From network and web vulnerability scanning to agentic deep pentest, mobile instrumentation, bug-bounty workflows, and CTF solving: one platform, one data plane, on infrastructure you own.
How it works
A self-hosted control plane holds the data, the console, and the methodology. A fleet of engines does the testing. The two talk over a one-way pull link, engine outbound only.
Three lightweight services (app, worker, PostgreSQL) run end-to-end in TypeScript, with no Redis and no Celery. You get multi-project workspaces, server-side RBAC, an encrypted API-key vault, audit logging, and a typed REST API.
Run the recon pipeline, map the passive attack surface with a 23-rule exposure detector, look up breach and stealer leaks, and track a unified threat-intelligence risk score that is identical across the dashboard, the TI page, and the reports.
Enroll an engine with a single-use token, pick a vertical (web, infra, mobile and iOS, desktop, source white-box, CTF, or web3), and let an agent swarm, a deterministic prober, and a QA-verifier pass test the scope at full depth.
Every finding is gated by a class-specific oracle and ships with verbatim Caido evidence, screenshots, and a re-executed proof. Deliver a bilingual PDF, SARIF and XLSX exports, a re-importable Caido project, and draft bug-bounty submissions.
What we do
VACTI is not a single scanner. It joins vulnerability assessment, agentic penetration testing, threat intelligence, bug-bounty workflows, and CTF solving under one console and one data plane.
An agentic harness pairs a Claude Code swarm with a deterministic prober and a QA-verifier pass. It tests web, API, mobile, desktop, source, and CVE targets end to end, gates each finding behind a class-specific oracle, captures verbatim evidence through a Caido proxy, and supports one-click retest and continue.
A straight recon pipeline (subfinder, httpx, naabu, nuclei), passive OSINT surface mapping with a 23-rule exposure detector, breach and stealer leak intelligence, and authoritative CVE and threat-feed consumption, all rolling up into one risk score shared across dashboards and reports.
Draft and manage HackerOne and Bugcrowd submissions with human-in-the-loop approval and advisory dedup to prevent duplicates. Solve CTF challenges through a flag-graded engagement kind that mixes web and infrastructure classes with dedicated CTF methodology.
Android and iOS engagements drive the real app on a paired device and reuse the backend authorization and IDOR probers, with SSL-pinning and anti-instrumentation handling. Desktop covers thick-client and native-app assessment plus the services the client calls.
Coverage
The deterministic prober is a family of oracle-gated floors: a finding is emitted only when a class-specific oracle proves exploitation. The agent swarm then exploits, scopes impact, and chains it. Coverage is organised by domain, not by individual test.
SQL injection, cross-site scripting (reflected, stored, and DOM), SSRF, IDOR and BOLA/BFLA, authentication bypass, LFI, upload-to-execution, SSTI, XXE, prototype pollution, GraphQL, CORS, deserialization, NoSQLi, open redirect, mass assignment, host-header injection, and business-logic abuse across payment, OAuth, and race-condition flows.
Host, port, and service discovery with an nmap NSE consistency floor, rootDSE-confirmed Active Directory testing, security headers, cleartext-auth and weak-crypto hygiene, subdomain takeover, request smuggling, and cloud-storage exposure. Every infrastructure finding carries a rendered exploit-flow diagram.
Android and iOS through a managed app agent that drives the app on a paired device, with SSL-pinning and anti-instrumentation handling, plus desktop thick-client and native-app assessment. Both reuse the web authorization and IDOR probers against the backend API the client calls.
Tech-stack CVE enumeration with an OSV novelty check on recon fingerprints, a non-destructive proof-of-concept safety rubric, and crypto and protocol-hygiene classes: weak crypto and cleartext credential transport.
A recon pipeline over all-Go scanners, passive attack-surface mapping with a 23-rule exposure detector (cloud keys, tokens, private keys, database URLs, and stealer or combo credentials), breach and stealer leak lookup, and a unified threat-intelligence risk score drawing on OTX, LeakCheck, and sector security news.
Caido is the sole proxy and evidence source: verbatim request and response bytes are re-fetched, never typed by the model. Findings carry OWASP, CWE, and CVSS tags and ship as a bilingual PDF plus SARIF and XLSX, with a captcha solver for Turnstile, reCAPTCHA, and hCaptcha at login.
Why VACTI
The control plane and the engine fleet run on infrastructure you control. The knowledge corpus and skill library, the methodology IP, live on the control plane, are fetched per engagement into memory, and are wiped after the run. The shipped engine package holds the runtime, never the IP.
Every high-impact finding is gated by a class-specific confirmation oracle with a re-executed proof. A finding that cannot be proven is marked inconclusive and flagged for review rather than silently dropped, so model guesses do not reach your report as findings. Quality over coverage.
VA scans, pentest findings, bug-bounty submissions, CTF challenges, leak intelligence, and threat feeds live in one PostgreSQL schema, with a cross-engagement asset catalog and a unified vulnerability-assessment and threat-intelligence risk score shared across the dashboard and reports.
Verbatim Caido request and response exhibits, screenshots, re-executed proofs, and exploit-flow diagrams, tagged with OWASP, CWE, and CVSS, delivered as a bilingual PDF with SARIF and XLSX exports in a formal, bank-grade report layout.
Engines enroll with a one-time token and self-update from a private apt repo on an idle-gated timer, so a fleet stays current without a manual redeploy. The engine ships for both amd64 and arm64, with a Docker image for non-Kali hosts.
Run the engine on Debian 13 trixie or Kali, in Docker, or from a prebuilt appliance: cloud qcow2, installable ISO, and VMware or VirtualBox OVA, all built from one golden image with no baked secret.
Architecture
The control plane orchestrates and stores. The engine fleet tests. The link is one-way: each engine reaches out to pull authorized engagements and write back results. There is no inbound port on an engine.
Engines enroll once with a single-use token that is exchanged for scoped producer, verifier, and gatekeeper tokens. From then on they poll for authorized jobs and write findings and evidence back over the outbound link, routing all test traffic through Caido, its sole proxy and evidence source. The methodology and knowledge corpus stay on the control plane.
Repositories
VACTI is a self-hosted platform spread across a small set of repositories, cleanly separated by concern.
Control plane. An Nx TypeScript monorepo: the console, a typed REST API, the data plane, reports, engine distribution, and the knowledge corpus.
TypeScript / Next.js / Hono
Offensive runtime. An agent swarm plus an MCP tool arsenal and oracle-gated probers, shipped as a minified Debian package.
TypeScript / Node 22 / .deb
Debian 13 build sources for the VACTI appliance: cloud image, installable ISO, and VM appliances, with the engine pre-provisioned.
Debian 13 / live-build
This profile site. A static, zero-build page describing how VACTI works and why it is built the way it is.
HTML / CSS / static