LEGAL DISCLAIMER: This tool is intended for authorized security testing, educational purposes, and research only. Never use this system to scan, probe, or attack any system you do not own or have explicit written permission to test. Unauthorized access is illegal and punishable by law. By using this tool, you accept full responsibility for your actions. Read Full Disclaimer
🏆 Flagship result: RedAmon solves 101 / 104 (97.1%) of the XBOW web-security benchmark fully black-box. Every solve ships a complete, unedited raw agent session and a reproducible, step-by-step walkthrough: open any row and read exactly how the flag fell, tool call by tool call. Auditable, line by line. See the XBOW Validation Benchmark scorecard.
📊 Coverage, measured and self-scored: the Bug Bounty Coverage — The Full Taxonomy Audit (PDF, 124 pages) audits RedAmon against all 397 classes of web bug-bounty finding, one line at a time, naming the exact module, skill or scanner behind every verdict, and scoring the recon pipeline and the agentic system separately against their own remit. It is deliberately self-critical, it records what is missing as plainly as what is covered: 134 classes complete, 210 in the build backlog, 44 deliberately excluded, with one explicit decision for every class.
Roadmap & Community Contributions
We maintain a public Project Board with upcoming features open for community contributions. Pick a task and submit a PR!
Want to contribute? See CONTRIBUTING.md for how to get started.
Maintainers
Anthropic Cyber Verification Program: the team behind RedAmon is approved under Anthropic's Cyber Verification Program.
Quick Start
Prerequisites
- Docker Engine 28.0.0 or newer & Docker Compose v2+ (check with
docker version --format '{{.Server.Version}}')
- macOS: Docker Desktop, with Memory raised to at least 4 GB (8 GB with
--gvm) in Settings → Resources. Clone under ~/ so the path is inside the default File Sharing list.
- Windows: Docker Desktop with the WSL2 backend, run from inside the WSL2 filesystem (
~/), not /mnt/c/.
That's it. No Node.js, Python, or security tools needed on your host.
Minimum System Requirements
| Resource | Without OpenVAS | With OpenVAS (full stack) |
|---|
| CPU | 2 cores | 4 cores |
| RAM | 7 GB | 10 GB (16 GB recommended) |
| Disk | 80 GB free | 110 GB free |
RAM is checked at start. ./redamon.sh refuses to start when the memory Docker can use does not cover the minimum of every service the profile runs (the memory allocator's per-service floors, see README.MEMORY_GOVERNOR.md). With the default reserves that is about 6.5 GB for the core stack and about 9.6 GB with OpenVAS. REDAMON_SKIP_RAM_GATE=1 skips the check.
Without OpenVAS runs 9 containers: webapp, postgres, neo4j, agent, kali-sandbox, recon-orchestrator, docker-broker (a filtering Docker-socket proxy that the recon orchestrator's spawned scan containers go through, so they can only launch the known tool images), and the plugin platform's plugin-runner and plugin-gateway.
With OpenVAS adds 4 more runtime containers (gvmd, ospd-openvas, gvm-postgres, gvm-redis) plus ~8 one-shot data-init containers for vulnerability feeds (~170K+ NVTs). First launch takes ~30 minutes for GVM feed synchronization.
Dynamic recon and scan containers are spawned on-demand during operations and require additional resources.
Disk sizing for a real deployment. The figures above are bare minimums to build and run the stack (fixed platform footprint: ~70 GB without OpenVAS, ~95 GB with - measured by true on-disk image size after deduplicating the shared Kali base layers). For an always-on server running real engagements, add ~100 GB of free space for operational data - the Neo4j attack graph, scan artifacts/outputs, Postgres, and container logs all grow with use. That means 200 GB without OpenVAS, 250 GB with OpenVAS, each leaving well over 100 GB free for operations. See the deployment guide for the full breakdown.
1. Clone & Install
git clone https://github.com/samugit83/redamon.git
cd redamon
# Without GVM (lighter, faster startup):
./redamon.sh install
# With GVM / OpenVAS (full stack, ~30 min first run):
./redamon.sh install --gvm
The script builds all images and starts the services.
2. Create Admin Account
At the end of the install (and on every ./redamon.sh up or ./redamon.sh update if no admin exists), you will be prompted in the terminal:
[WARN] No admin user found. Let's create one.
Admin name: Your Name
Admin email: [email protected]
Admin password: ********
Confirm password: ********
- Admin name -- display name shown in the UI (e.g.
Admin, your name, anything you want).
- Admin email -- used to log in at
http://localhost:3000/login.
- Admin password -- minimum 12 characters.
After creation, open http://localhost:3000 and sign in with the email and password you just set.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
