Zen AI Pentest

Профессиональный фреймворк для пентестинга на базе ИИ
Автономная оценка безопасности с использованием передовых языковых моделей

Возможности • Быстрый старт • Архитектура • Конвейеры • Безопасность • Документация

🔥 Обзор

Zen-AI-Pentest — это автономный фреймворк для пентестинга на базе ИИ, который сочетает передовые большие языковые модели с более чем 72 профессиональными инструментами для обеспечения безопасности. Создан для специалистов по безопасности, охотников за багами и корпоративных красных команд.

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#58a6ff', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#58a6ff', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#58a6ff', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#58a6ff', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
    subgraph "🌐 Client Interface"
WebUI["React Dashboard<br/>Cloudflare Pages"]
        CLI["Python CLI"]
        API["REST API + WebSocket"]
    end

    subgraph "⚡ API Gateway"
        FastAPI["FastAPI Server"]
        Auth["JWT / RBAC Auth"]
        WsMgr["WebSocket Manager"]
    end

    subgraph "🧠 AI Orchestrator"
        AgentMgr["Agent Manager"]
Guardrails["🛡️ Guardrails<br/>IP/Domain Filter"]
        TaskQ["📊 Task Queue"]
        Risk["⚠️ Risk Levels 0-3"]
State["📈 State Machine<br/>ReAct Pattern"]
    end

    subgraph "🤖 Agent Pool"
A1["Agent #1<br/>Recon"]
A2["Agent #2<br/>Exploit"]
A3["Agent #3<br/>Report"]
AN["Agent #N<br/>Custom"]
    end

    subgraph "🔧 Security Toolkit"
        Nmap["nmap · masscan"]
        Web["nuclei · sqlmap · zap · ffuf"]
        Exploit["Metasploit · SearchSploit"]
        Recon["amass · subfinder · httpx"]
        AD["BloodHound · NetExec"]
        OSINT["sherlock · theHarvester"]
    end

    subgraph "📊 Analysis & Reporting"
Evidence["📋 Evidence Collection<br/>Cryptographic Signatures"]
Attack["🗺️ Attack Path Analysis<br/>Cytoscape.js Graphs"]
Report["📄 Report Generator<br/>PDF · HTML · DOCX · JSON"]
Compliance["📋 Compliance Mapping<br/>ISO 27001 · PCI DSS · NIST"]
RiskScoring["🎯 Risk Scoring<br/>CVSS · EPSS · Bayesian Filter"]
    end

    subgraph "💾 Data Layer"
PG[("🐘 PostgreSQL<br/>Persistent State")]
Redis[("⚡ Redis<br/>Cache & Queue")]
FS[("📁 File Storage<br/>Reports & Evidence")]
    end

    WebUI --> FastAPI
    CLI --> FastAPI
    API --> FastAPI
    FastAPI --> Auth
    Auth --> AgentMgr
    AgentMgr --> Guardrails
    Guardrails --> TaskQ
    TaskQ --> Risk
    Risk --> State
    State --> A1 & A2 & A3 & AN
    A1 --> Nmap & Recon
    A2 --> Web & Exploit
    A3 --> AD & OSINT
    AN --> Nmap & Web
    Nmap --> Evidence
    Web --> Attack
    Exploit --> Evidence
    Attack --> Report
    State --> Report
    Report --> Compliance
    Report --> RiskScoring
    Evidence --> PG
    Attack --> PG
    Compliance --> PG
    RiskScoring --> Redis
    Report --> FS

✨ Возможности

🔧 Более 72 интегрированных инструментов безопасности

🧩 Инфраструктура MCP-серверов

8 MCP-серверов для интеграции ИИ и инструментов, зарегистрированных в opencode.jsonc:

🤖 WhatsApp-бот

• Сквозное шифрование через @whiskeysockets/baileys (сопряжение по QR-коду)
• /ask <запрос> — ИИ-ответы на вопросы по безопасности через OmniRoute
• /voice <текст> — TTS-ответ через edge-tts + ffmpeg
• QR-код отображается в веб-интерфейсе по адресу http://localhost:8080/qr.html

🛡️ VPN Killswitch

Автоматическое обнаружение потери соединения и ротация VPN: - Обнаруживает: 429 (ограничение по количеству запросов), 5xx (ошибка сервера), тайм-ауты, отказ в соединении - Поддерживает: WireGuard и SOCKS5-прокси - Автоматически меняет конечную точку VPN при сбое - Настраиваемый интервал проверки (по умолчанию: 15 с)

🚀 Быстрый старт

git clone https://github.com/SHAdd0WTAka/zen-ai-pentest.git
cd zen-ai-pentest
cp .env.example .env
# Edit .env: set OPENCODE_API_KEY=oc_xxx
docker compose up -d

pip install -r requirements.txt
python database/models.py
python api/main.py
# Subdomain scanner
python scan_target_subdomains.py example.com
# Advanced CLI
python tools/subdomain_enum.py example.com --advanced

# 11 specialized agent personas
deep-recon --target example.com
deep-exploit --target example.com --force
deep-audit --target example.com --phases recon,scan,exploit,report
deep-report --scan-id wf-abc123 --format pdf

# QR pairing in browser
open http://localhost:8080/qr.html
# Commands:
/ask Scan example.com and find vulnerabilities
/voice Describe the OWASP Top 10

💻 Использование

Python API

from agents.react_agent import ReActAgent, ReActAgentConfig

config = ReActAgentConfig(max_iterations=10, use_vm=True)
agent = ReActAgent(config)
result = agent.run(target="example.com", objective="Comprehensive security assessment")
print(agent.generate_report(result))

REST API

# Auth
curl -X POST http://localhost:8000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin"}'

# Create scan
curl -X POST http://localhost:8000/scans \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Network Scan","target":"192.168.1.0/24","scan_type":"network"}'

# Execute tool
curl -X POST http://localhost:8000/tools/execute \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"tool_name":"nmap_scan","target":"scanme.nmap.org","parameters":{"ports":"22,80,443"}}'

# Generate report
curl -X POST http://localhost:8000/reports \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"scan_id":1,"format":"pdf","template":"default"}'

WebSocket (в реальном времени)

const ws = new WebSocket("ws://localhost:8000/ws/scans/1");
ws.onmessage = (event) => {
  const data = JSON.parse(event.data);
  console.log("Scan update:", data);
};

🏗️ Архитектура

Архитектура системы

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#58a6ff', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#58a6ff', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#58a6ff', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#58a6ff', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph LR
    subgraph "Client"
WEB["🌐 Web UI<br/>React · Cloudflare"]
        CLI["💻 CLI · Python"]
        API_CLIENT["🔌 REST Client"]
    end

    subgraph "API Gateway"
        FASTAPI["FastAPI + WebSocket"]
        AUTH["🔐 JWT/RBAC"]
        WS["📡 WebSocket"]
    end

    subgraph "Orchestrator"
        G["🛡️ Guardrails"]
        TQ["📊 Task Queue"]
        RL["⚠️ Risk 0-3"]
        SM["📈 State Machine"]
    end

    subgraph "Agents"
A1["🤖 Agent Pool<br/>Docker Sandbox"]
    end

    subgraph "Tools"
TOOLS["🔧 72+ Tools<br/>nmap · nuclei · sqlmap<br/>metasploit · burp · hydra"]
    end

    subgraph "Analysis"
        EV["📋 Evidence"]
        AP["🗺️ Attack Path"]
        CC["🔗 Chain of Custody"]
        COMP["📊 Compliance"]
        REP["📄 Reports"]
        RS["🎯 Risk Scoring"]
    end

    subgraph "Data"
        PG[("🐘 PostgreSQL")]
        RD[("⚡ Redis")]
        FS[("📁 File Store")]
    end

    WEB --> FASTAPI
    CLI --> FASTAPI
    API_CLIENT --> FASTAPI
    FASTAPI --> AUTH
    AUTH --> WS
    WS --> G
    G --> TQ --> RL --> SM
    SM --> A1
    A1 --> TOOLS
    TOOLS --> EV & AP
    SM --> REP
    EV --> CC
    AP --> COMP
    CC --> RS
    EV --> PG
    AP --> PG
    COMP --> PG
    RS --> RD
    REP --> FS

🤖 Архитектура оркестрации ИИ

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#58a6ff', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#58a6ff', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#58a6ff', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#58a6ff', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
    subgraph "🌐 User Interface"
        WEB["Web Terminal :8080"]
        CLI["CLI deep-*"]
        WA["WhatsApp Bot"]
        API["REST API :8000"]
    end

    subgraph "🧠 AI Inference"
        OR["OmniRoute Proxy :20128"]
        FREE["oc/deepseek-v4-flash-free"]
        PAID["oc/gpt-4o · claude-3 · llama-3"]
HA["Hermes Agent v0.15.2<br/>95 skills · agency-agents"]
    end

    subgraph "🔌 MCP Servers"
OA["omni-ai<br/>chat+vision+tools"]
QT["qterminal<br/>shell+docker"]
ZA["zen-agents<br/>11 agents"]
MS["metasploit<br/>MSF RPC"]
VK["vpn-killswitch<br/>failover"]
OB["obscura<br/>vault"]
IT["ip-tracker<br/>geo+visitors"]
    end

    subgraph "🤖 Agent Pool (ReAct Loop)"
coord["AgentCoordinator<br/>IDLE→PLANNING→EXECUTING→<br/>OBSERVING→REFLECTING→COMPLETED"]
guard["Guardrails<br/>IP blocking · Risk 0-3 · Timeout"]
        A1["Recon"]
        A2["Exploit"]
        A3["Analysis"]
        A4["RedTeam"]
A5["Social · Network · Cloud<br/>ICS · Mobile · Crypto · Report"]
    end

    subgraph "🔧 Security Toolkit"
TOOLS["72+ Tools<br/>nmap · masscan · nuclei · sqlmap · metasploit<br/>ffuf · gobuster · hydra · bloodhound<br/>responder · amass · subfinder · trivy<br/>semgrep · trufflehog · zap · nikto · burpsuite"]
    end

    WEB & CLI & WA & API --> OR
    OR --> FREE & PAID
    FREE & PAID --> HA
    HA --> OA & QT & ZA & MS & VK & OB & IT
    OA & QT & ZA & MS & VK & OB & IT --> coord
    coord --> guard
    guard --> A1 & A2 & A3 & A4 & A5
    A1 & A2 & A3 & A4 & A5 --> TOOLS

🔄 CI/CD-конвейеры

Все диаграммы конвейеров используют Mermaid — автоматически рендерятся GitHub.

1. 🧪 Конвейер тестирования

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#3fb950', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#3fb950', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#3fb950', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#3fb950', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph LR
    TRIG1["push main/develop"] --> TEST
    TRIG2["pull_request main/develop"] --> TEST
    TRIG3["workflow_dispatch"] --> TEST
TEST["🧪 test (matrix 3.11, 3.12)<br/>pytest · 43k+ tests"] --> RESULT["✅ Test Summary"]
    style TEST fill:#3fb950,stroke:#1a7f37,color:#fffffffff

2. 📊 Конвейер покрытия Codecov

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#3fb950', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#3fb950', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#3fb950', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#3fb950', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph LR
    TRIG1["pull_request"] --> COV
    TRIG2["workflow_dispatch"] --> COV
COV["📊 coverage<br/>pytest --cov=core,agents,api,tools<br/>autonomous,risk_engine,modules,web_ui"] --> UPLOAD["📤 Upload to Codecov"]
    COV --> ARTIFACT["📦 Upload artifact"]
    COV --> PR["💬 Comment PR"]
    style COV fill:#3fb950,stroke:#1a7f37,color:#fffffffff

3. 🔒 Конвейер проверки безопасности

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#f85149', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#f85149', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#f85149', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#f85149', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
    TRIG1["pull_request main/develop"] --> SEC
    TRIG2["schedule daily 6am"] --> SEC
    TRIG3["workflow_dispatch"] --> SEC

    subgraph SEC["🔒 Security Scan"]
DEP["📦 Dependency Scan<br/>Safety · pip-audit"]
SECRET["🔑 Secret Detection<br/>TruffleHog · GitLeaks · GitGuardian"]
SAST["🔍 SAST Analysis<br/>Bandit · Semgrep"]
IAC["🏗️ IaC Scan<br/>Checkov · Trivy Config"]
        SCORE["📈 OSSF Scorecard"]
    end

    DEP --> SUMMARY["📋 Security Summary"]
    SECRET --> SUMMARY
    SAST --> SUMMARY
    IAC --> SUMMARY
    SCORE --> SUMMARY
    SAST --> SARIF1["📎 Upload Semgrep SARIF"]
    IAC --> SARIF2["📎 Upload Checkov SARIF"]
    IAC --> SARIF3["📎 Upload Trivy SARIF"]
    SCORE --> SARIF4["📎 Upload Scorecard SARIF"]
    DEP --> ART1["📦 Upload Reports"]

4. ✅ Анализ CodeQL

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#58a6ff', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#58a6ff', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#58a6ff', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#58a6ff', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph LR
    TRIG["schedule weekly Sunday"] --> CQL
    subgraph CQL["CodeQL Advanced"]
        CHECKOUT["📥 Checkout"]
INIT["⚙️ Initialize CodeQL<br/>security-extended + security-and-quality"]
        BUILD["🔨 Autobuild"]
        ANALYZE["🔬 Perform Analysis"]
    end
    CQL --> RES["✅ SARIF Results"]

5. 🚀 Конвейер деплоя

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#d29922', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#d29922', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#d29922', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#d29922', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
    TRIG1["release published"] --> DEPLOY
    TRIG2["workflow_dispatch staging/prod"] --> DEPLOY

    subgraph DEPLOY["Deploy Pipeline"]
CHECK["✅ pre-deploy-check<br/>pytest + bandit"]
STAGE["🧪 deploy-staging<br/>staging.pentest.example.com"]
PROD["🚀 deploy-production<br/>pentest.example.com"]
    end

    CHECK --> STAGE
    STAGE --> PROD
    PROD --> SLACK["📬 Notify Slack"]
    CHECK --> SUM["📋 deploy-summary"]
    STAGE --> SUM
    PROD --> SUM

6. 📦 Конвейер релизов

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#bc8cff', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#bc8cff', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#bc8cff', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#bc8cff', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
TRIG["workflow_dispatch<br/>version + prerelease"] --> PRE

PRE["📋 pre-release-checks<br/>version · changelog"] --> BUILD
    PRE --> CHLOG["📝 changelog"]
    PRE --> REL["🏷️ github-release"]

BUILD["📦 build<br/>python -m build · twine"] --> REL
REL --> PYPI["⬆️ pypi-publish<br/>twine upload"]
REL --> DOCKER["🐳 docker build & push<br/>ghcr.io · amd64 + arm64"]
REL --> DOCS["📚 docs<br/>mkdocs · mkdocs-material"]

PYPI --> POST["📬 post-release<br/>discussion · milestone"]
DOCKER --> NOTIFY["🔔 notify<br/>Slack + Discord"]
    DOCKER --> SUMMARY["📋 release-summary"]
    PYPI --> NOTIFY
    PYPI --> SUMMARY

7. ⚙️ CI-конвейер (устаревший)

%%{init: {'theme': 'base', 'themeVariables': { 'background': '#0d1117', 'primaryColor': '#8b949e', 'secondaryColor': '#161b22', 'tertiaryColor': '#0d1117', 'primaryBorderColor': '#8b949e', 'secondaryBorderColor': '#30363d', 'tertiaryBorderColor': '#30363d', 'lineColor': '#8b949e', 'fontSize': '14px', 'fontFamily': '-apple-system,BlinkMacSystemFont,Segoe UI,Noto Sans,Helvetica,Arial,sans-serif', 'textColor': '#ffffff', 'primaryTextColor': '#ffffff', 'secondaryTextColor': '#ffffff', 'tertiaryTextColor': '#ffffff', 'mainBkg': '#0d1117', 'nodeBorder': '#8b949e', 'clusterBorder': '#30363d', 'clusterBkg': '#161b22', 'titleColor': '#ffffff' }}}%%
graph TB
    TRIG["workflow_dispatch"] --> CI
    subgraph CI["CI Pipeline (Legacy)"]
T["🧪 test<br/>matrix 3.10 · 3.11 · 3.12"]
L["✨ lint<br/>black · isort · flake8 · ruff"]
S["🔒 security-scan<br/>bandit · safety"]
    end
T --> CG["📊 coverage-gate<br/>check >= 80%"]
    T --> SUM["📋 ci-summary"]
    L --> SUM
    S --> SUM
    CG --> SUM

🧪 Набор тестов

# All tests
pytest tests/ -v

# With coverage
pytest tests/ --cov=. --cov-report=html --cov-report=term

# Unit tests
pytest tests/unit/ -v

# Integration
pytest tests/integration/ -v

# Security
pytest tests/security/ -v

# Exclude slow
pytest tests/ -m "not slow" -v

🛡️ Безопасность

Встроенные средства защиты

• ✅ Блокировка частных IP: Запрещает сканирование 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• ✅ Защита loopback: Блокирует 127.x.x.x и ::1
• ✅ Фильтр локальных доменов: Запрещает .local, .internal, localhost
• ✅ Контроль уровня риска: Ограничивает инструменты по уровню безопасности (0–3)
• ✅ Ограничение частоты запросов: Предотвращает злоупотребление

Уровни риска

🔧 Конфигурация

Вариант 1: Хранилище Obsidian (рекомендуется)

bash mcp/obsidian/setup.sh
code ~/Documents/Obsidian\ Vault/Secrets/secrets.yaml

Вариант 2: Переменные окружения

cp .env.example .env
nano .env
source .env

📁 Структура проекта

zen-ai-pentest/
├── api/                   # FastAPI Backend
├── agents/                # AI Agent Implementations
│   ├── react_agent.py    # Core ReAct pattern agent (Reason→Act→Observe→Reflect)
│   ├── agent_coordinator_v3.py # Multi-agent workflow engine (11 personas)
│   ├── guardrails.py     # IP/Domain/risk-level safety filters
│   └── cli/              # CLI tools: deep-recon, deep-exploit, deep-report, deep-audit
├── core/                  # Framework Core
├── tools/                 # 72+ Security Tool Integrations
├── risk_engine/           # Risk Analysis (CVSS, EPSS, false positive detection)
├── modules/               # High-Level Modules (exploit, osint, scanners, reporting)
│   ├── tool_orchestrator.py  # Integration Bridge for containerized tools
│   ├── exploit_modules/   # Auth bypass, command injection, deserialization, SSRF, XSS, XXE, SQLi
│   └── osint_modules/    # Cert transparency, DNS enum, email harvester, whois
├── mcp/                   # MCP Servers (8 total)
│   ├── omni-ai/          # AI chat via OmniRoute proxy
│   ├── qterminal/        # Shell + Docker orchestration
│   ├── zen-agents/       # 11-agent orchestration
│   ├── metasploit/       # Metasploit RPC connector
│   ├── vpn-killswitch/   # Connection-loss VPN rotation
│   ├── obscura/          # Encrypted secret vault
│   └── ip-tracker/       # Visitor IP tracking
├── skills/                # 95 Hermes-compatible skills (tool-specific SKILL.md)
│   ├── tool-*/           # 39 tool skills (nmap, sqlmap, nuclei, etc.)
│   ├── module-*/         # 42 module skills (xss, sqli, osint, etc.)
│   └── zen-*/            # 5 framework skills (architecture, agents, workflow)
├── web_ui/                # Frontend
│   ├── terminal/         # WebShell (FastAPI + PTY over WebSocket + Cloudflare tunnel)
│   │   ├── server.py     # Terminal server with 2FA auth
│   │   ├── static/       # login.html, qr.html (WhatsApp pairing)
│   │   └── Dockerfile
│   ├── whatsapp-bot/     # E2E WhatsApp bot (Baileys + /ask AI + /voice TTS)
│   └── dashboard/        # React · Vite · TypeScript
├── docker/                # Dockerfiles
│   ├── hermes/            # Hermes Agent container
│   ├── omniroute/         # OmniRoute API proxy
│   └── vpn-proxy/         # VPN proxy container
├── database/              # PostgreSQL Models
├── reports/               # PDF · HTML · DOCX Generator
├── docker-compose.yml     # 6 services (terminal, whatsapp, omniroute, hermes, vpn, wg)
├── opencode.jsonc         # OpenCode config with all 8 MCP servers
├── .opencode/agents/      # 267 agent prompt files
├── tests/                 # 43,000+ Tests
└── docs/                  # Documentation

📚 Документация

🌐 Сообщество

_{📱 Сканируйте QR-коды для мгновенного доступа с мобильных устройств}

🤝 Участие в разработке

1. Сделайте форк репозитория
2. Создайте ветку для новой функции (git checkout -b feature/потрясающая-функция)
3. Зафиксируйте изменения (git commit -m 'Добавлена потрясающая функция')
4. Отправьте изменения в ветку (git push origin feature/потрясающая-функция)
5. Создайте Pull Request

Смотрите CONTRIBUTING.md и CODE_OF_CONDUCT.md.

👥 Авторы

@SHAdd0WTAka Основатель · Ведущий разработчик

Kimi AI Партнёр по разработке ИИ

📄 Лицензия

Лицензия MIT — смотрите LICENSE.

⚠️ ВАЖНО: Только для авторизованного тестирования безопасности. Всегда получайте надлежащее разрешение перед тестированием любой системы, которая вам не принадлежит.