Darkmoon
Darkmoon · Coding
Darkmoon is an open-source AI penetration testing platform that plans and runs end-to-end offensive security campaigns with little manual pivoting. Instead of leaving you with a raw list of alerts, this open-source pentest tool chains 50 specialized AI agents and 80+ integrated security tools, maps your infrastructure on a live dashboard, and escalates each proven finding into a reviewed pull request with before-and-after evidence. It's built for security teams who want proof a vulnerability is fixed, not just flagged. That distinction is the whole product.
About Darkmoon
What Is Darkmoon
Darkmoon is an autonomous AI pentest platform that behaves more like a conductor than a scanner. A single orchestrator coordinates dozens of specialist agents, each handling a phase of an offensive campaign, from reconnaissance and infrastructure mapping to exploitation and cleanup. The result lands on a live command center dashboard that shows what's running, what it found, and where each finding stands.
The product's core pitch is that finding a bug is only half the job. Darkmoon takes a proven vulnerability, traces it back to its root cause in your own source code with a SAST pass, reproduces the exploit against a fresh build, applies a minimal patch, and re-runs the exploit plus its variants to confirm the fix holds while normal behavior and tests still pass. That patch becomes a pull request on GitHub, GitLab, Gitea, Bitbucket, or Azure DevOps, always as a proposal for a human to review and merge.
The biggest limitation is scope and trust. The agentic remediation layer (SAST plus autonomous fixes) is a Pro feature, so the free Community edition covers the autonomous testing engine but not the fix-shipping workflow. You also need to accept that Darkmoon never auto-merges; it hands you a reviewed proposal, which means a person still owns the final call. It's an offensive tool. Run it only where you're authorized to test.
Getting Started
- Grab the Community edition from GitHub and self-host it, or pick the Pro licence if you want the managed command center.
- Point Darkmoon at the targets you own or are authorized to test, and let it map the infrastructure before running a campaign.
- Configure the tool execution policy and connect your source repo through MCP-gatekept execution and the credential reference system.
- Launch a campaign and watch the live dashboard as agents pivot, prove findings, and stack evidence.
- Review the pull requests and validated fixes, then merge what passes your checks.
Product Information
A quick look at Darkmoon's pricing, supported platforms, and performance.
Best for
The users, tasks, and scenarios where this tool fits best.
Users
- Security engineers who want an autonomous pentest to run campaigns in the background instead of pivoting tools by hand for days.
- Smaller security teams that can't staff a full offensive crew but still need continuous, evidence-backed testing.
- Developers who prefer a pull request with a validated fix over a ticket that only describes the bug.
Tasks
- Running autonomous penetration testing campaigns that chain reconnaissance, exploitation, and cleanup without babysitting.
- Mapping infrastructure and keeping a live picture of exposed hosts, open ports, and running services.
- Turning proven findings into root-cause SAST audits and minimal, tested patches.
- Producing publication-ready, evidence-backed security reports for clients and audit teams.
Scenarios
- A release-week security check where you need coverage across a shifting codebase fast.
- Pitching a fix to engineering when a plain vulnerability report keeps getting deprioritized.
- Onboarding a new web app or API into continuous offensive testing.
- Demonstrating remediation progress to a client or auditor with before-and-after proof.
Key features
Autonomous Orchestration
One orchestrator directs a fleet of specialist agents. A campaign moves from recon to exploitation without you manually chaining tools. The agent picks the next move itself. You define the target and the scope, and Darkmoon runs the sequence, pivoting as it learns. That's where the "conductor, not a scanner" claim comes from.
Agent Fleet and Tool Integration
The platform ships with 50 AI agents and 80+ integrated security tools, all coordinated under a single run. Tool execution is MCP-gatekept, which means the agent can't just reach for anything; calls pass through a controlled policy layer. A pentester used to juggling a dozen utilities saves hours of glue work here. Offensive security automation stops being a manual relay race.
Live Command Center
A dashboard shows the campaign as it happens: which agents are active, what they've mapped, and where each finding stands. Findings get a PR column that links straight to the pull request addressing them, with forge URL, state, linked findings, diff stats, and the before-and-after validation. It turns a black-box run into something you can follow. No blind spots.
Source-Level Remediation
A three-phase security audit traces each proven finding back to its root cause in your own code, filtering out style noise and keeping only real security issues. From there the fix is validated in a sandbox: the exploit is reproduced, the patch applied, then the exploit and its variants are re-run to prove they now fail while the app's normal behavior and tests still pass.
Pull Request Workflow
Every validated fix opens as a pull request on GitHub, GitLab, Gitea, Bitbucket, or Azure DevOps, carrying its before-and-after proof. Darkmoon never auto-merges, and anything it couldn't fully validate opens as a clearly marked draft. The point is a proposal a human can trust, not a silent change to production. Big difference.
Data Sovereignty
Sensitive values are tokenized before they ever reach the model. Host IPs and credentials are swapped for deterministic placeholders, Fernet-encrypted in memory and never logged, then rehydrated locally on a whitelisted basis. Outbound exfiltration attempts get blocked. Nervous about feeding real infrastructure data to an LLM? This is the answer to that.
Open-Source Core
The Community edition is GPLv3 and yours to self-host forever, so you can audit and modify the full autonomous engine. That matters for teams who can't run closed-source tooling on their own infrastructure. You can inspect exactly what the agent does.
Pros and cons
Pros
- Open-source core under GPLv3 lets you self-host, audit, and modify the engine.
- Fix-shipping workflow ends in a validated pull request, so engineers get a patch instead of a bug ticket.
- Data never leaves your environment in raw form, since credentials and IPs are tokenized before the model sees them.
- 50 agents and 80+ integrated tools cut the manual pivoting that eats most pentest time.
Cons
- The SAST remediation layer and managed command center require the Pro licence, so the free edition only covers autonomous testing.
- It never auto-merges, so a human still has to review and approve every fix.
- Running it at scale needs meaningful setup, and it's the kind of offensive tool you'll want on infrastructure you're authorized to test.
Frequently asked questions
Darkmoon runs autonomous penetration testing campaigns. It orchestrates AI agents to reconnoiter, exploit, and prove vulnerabilities, then turns validated findings into pull requests with fixes.
Related content
Explore related tools, skills, and articles for Darkmoon.
Darkmoon Alternatives
Forefront
Forefront · CodingForefront is a web platform for building with open-source AI. It lets you fine-tune leading open-source language models on your own data, evaluate how they perform, and run them through an API or export them to host yourself. Developers who want the convenience of a closed-source platform but insist on owning their models and data are the target audience here.
Startkit
StartKit.AI · CodingStartkit is a boilerplate for building AI SaaS and AI wrapper products. Think of it as an AI startup boilerplate with the boring parts already wired up: authentication, Stripe and Lemon Squeezy payments, usage limits, transactional email, and an AI API starter that talks to OpenAI, Anthropic, Groq, or Llama. You clone the repo, set your price, and start on the part of your product that people actually pay for. It's Next.js under React and Tailwind, so most of the boilerplate code already feels familiar.
Testim
Tricentis · CodingTestim is an AI-powered test automation platform for building and running end-to-end tests across web, mobile, and Salesforce applications. It leans on machine learning to keep tests stable when an interface changes, so teams spend less time fixing broken selectors. Not bad for an automated testing tool you can start using today. You create tests by recording actions in a browser, then optionally add JavaScript when you need more control. It's a solid pick for busy QA teams.