$darkmoon run --scope identity
→AS-REP roast · 3 accounts
→Kerberoast · svc_sql cracked
→NTLM relay → DCSync
✓Domain Admin, proven
No proprietary hardware
Nothing to buy from us but the software. Bring your own machine.
S.01Deployment mode · Appliance
Darkmoon Appliance
Your hardware. Your infrastructure. Darkmoon. Transform compatible infrastructure into a dedicated Darkmoon security appliance, without proprietary hardware.
5
Reference sizing profiles
3
AI modes: Connected, Private, Local
4
Clouds, deployed in one command
11
Darkmoon Doctor checks
It is not a box
A software-defined appliance, not proprietary hardware
“Do you have a box?” Yes, Darkmoon can run as a dedicated appliance. But you do not buy proprietary hardware from us. The appliance is software that turns a machine you already trust into an autonomous security node.
S.04No lock-inNothing to buy, nothing that locks you in
The appliance is the software on top of a machine you choose, on your bench, in your hypervisor or in your own cloud tenancy.
darkmoon-licence.dmeDocker
LicencePro · annual
Machine code7F3A-…-C21E
Seats1 node
Statussealed ✓
No mandatory box
No OVA, no ISO, no sealed unit shipped to your dock.
Attack surfaceexposure
No hardware lock-in
Move, resize or replace the machine on your own terms.
FindingsCVSS
SQL injection9.8
SSRF to metadata9.1
Broken access control8.7
JWT signature bypass7.5
Path traversal6.9
No marketplace
No listing to subscribe to, no revenue share, no per-cloud lock-in.
Same images everywhere
The exact packaged Docker images run on every cloud and on your own bare metal.
Your tenancy, your keys
The node lives in your account, under your governance; license and LLM keys stay yours.
S.05SizingFind your Darkmoon configuration
Five reference profiles for the machine you provide. Each one starts with what it is recommended for, match the workload first, then read the specs. These are recommended values carrying an engineering margin, not hard floors.
Typical workload
Minimum
Single low-parallelism campaign, a few assets.CPU · 2 vCPURAM · 8 GBStorage · 40 GB SSDNetwork · Outbound HTTPS to LLM + target reachabilityArchitecture · amd64AI mode · Connected / PrivateGPU · None
Popular · Typical workload
Standard
One campaign, normal agent parallelism.CPU · 4 vCPURAM · 16 GBStorage · 80 GB SSDNetwork · Sustained scan traffic during campaignsArchitecture · amd64AI mode · Connected / PrivateGPU · None
Typical workload
Performance
High concurrency / larger multi-asset campaigns.CPU · 8 vCPURAM · 32 GBStorage · 160 GB NVMeNetwork · Higher concurrent scan + LLMArchitecture · amd64AI mode · Connected / PrivateGPU · None
Typical workload
Industrial
Sustained on-site / edge node, long retention.CPU · 8–16 vCPURAM · 32–64 GBStorage · 250 GB+ NVMeNetwork · On-site targets, egress per AI modeArchitecture · amd64 (arm64 experimental)AI mode · AnyGPU · None
Typical workload
Local AI
Sovereign, on-node inference.CPU · 8+ vCPURAM · 16–32 GB + model floor (7B +8 GB, 13B +16 GB, 33B +32 GB)Storage · 160 GB+ NVMe (+ model weights)Network · LLM stays on nodeArchitecture · amd64AI mode · LocalGPU · Optional (local inference only, never for the engine or VR)
Not sure which to pick?
The documentation walks through parallelism, retention and AI mode so you can size the machine precisely.
Full sizing methodology →
S.06OperationsOperate it through its lifecycle, not by hand
You run Darkmoon through its lifecycle tooling, not by hand-administering every container. One command brings the node up, one keeps it healthy, one moves it forward. The control of self-hosting. The simplicity of SaaS.
install.sh
01
Install
Pulls the packaged images and brings the node up.
darkmoon run
02
Darkmoon
Launch a campaign against a target you own.
darkmoon doctor
03
Doctor
Diagnose the host, runtime and containers.
darkmoon repair
04
Repair
Apply the safe automatic fix Doctor identified.
darkmoon update
05
Update
Move to the next version, the same way every time.
DiagnosticsDarkmoon Doctor keeps the node honest
One command inspects the whole node and tells you plainly what is wrong. Every check below is a real check the tool runs.
# darkmoon@node
$ darkmoon doctor
Running diagnostics…
✓ Runtime Docker Engine present and healthy
✓ Compose Compose v2 available
✓ Containers All services up and responsive
✓ Images Pinned versions match the release
✓ License Valid and in date
✓ AI provider Reasoning endpoint reachable
✓ Privacy Gateway Tokenization active
✓ Ports Required ports bound, no conflicts
✓ Disk Free space above threshold
✓ Memory Headroom for the sized profile
✓ GPU Detected for local inference (GPU profile only)
✓ Node healthy · 0 issues
S.08DiagnosticsWhen something drifts, the loop is short and legible
Problem
A container stops, a config drifts, a prerequisite is missing.
Doctor
darkmoon doctor inspects host, runtime and containers.
Diagnosis
It names the fault in plain language, no runbook required.
Action
A safe automatic fix, or a documented action you confirm.
S.09ReasoningChoose your AI
The reasoning layer is yours to place. The engine is the same, only the model's location changes.
Remote LLM + Privacy Gateway
Connected
Reason with a remote model while the Privacy Gateway tokenizes sensitive values on the node before anything leaves. Data-minimization by design, not an offline mode.
Your own endpoint
Private
Point the node at a model endpoint you already operate, your VPC, your gateway, your contract. Darkmoon reasons through it, nothing routes elsewhere.
On-node inference
Local
Run the model on the node itself for a self-contained, sovereign deployment. A GPU is optional and used only for local inference.
Note
The Privacy Gateway is data-minimization, not an offline mode: it tokenizes sensitive values before they reach a remote model. A GPU is relevant only for Local inference, never for the engine, and never for the immersive view, which renders client-side.
S.10ResponsibilityYour infrastructure. Our software.
A clean line between what you run and what we ship. There is no proprietary box to replace, if a machine breaks, you swap the machine and bring the node back up.
You control
Hardware
Physical hardwareVM / hypervisor (if applicable)Power & physical maintenanceHardware replacementHardware warranty
You control
Host & network
Host operating systemHost security & hardeningNetwork & firewall
Darkmoon provides
Software & tooling
Darkmoon softwarePackaged deploymentDocker imagesInstallation toolingDarkmoon Doctor
Darkmoon provides
Lifecycle & support
Application lifecycle & updatesCompatibility documentationReference sizingSoftware support
S.11DeploymentDeploy where you need it
The same node fits a rack, a hypervisor, a plant floor or your own cloud tenancy. Any of these substrates works, and no hardware brand is mandatory, you choose the machine, the appliance is the software on top.
Dedicated server
A bare-metal machine you own, racked or on a bench.
Linux VM
A guest on your existing hypervisor, sized to a profile.
Industrial PC
A fanless or ruggedized unit on the plant floor.
Edge server
A node close to the assets it tests, on-site.
Private cloud
Your own tenancy, under your governance and controls.
Cloud“Do you sell a box?” No, deploy to any cloud in one command
There is no proprietary hardware to buy and nothing to order from a cloud marketplace. If you already run on AWS, Google Cloud, Azure or OVHcloud, one command stands up a dedicated Darkmoon Pro node in your own tenancy, the machine, the firewall port and the install, done for you.
# cloud shell
curl -fsSL https://portal.dark-moon.org/deploy | bash -s -- \
aws --license <KEY> --api-key <LLM_KEY>AWS (EC2 instance)Google Cloud (Compute Engine)Azure (Virtual Machine)OVHcloud (Public Cloud)
S.13EcosystemOne engine, a horizontal ecosystem
The appliance is the execution point. The same engine integrates across the tools you already use, the ecosystem stays horizontal, wherever the node runs.
Darkmoon Pro
Web console, reporting and remediation on top of the engine.
MCP
The Model Context Protocol server, exposing Darkmoon to agents.
CI/CD
Security campaigns wired into your pipelines.
IDE
Reach the same engine from where you write code.
Automation
Trigger and orchestrate campaigns programmatically.
Monitoring & security
Feed findings into the tooling you already run.
Spatial
From node to attack graph
The appliance produces the graph data. Darkmoon Pro turns it into attack paths you can walk, on the desktop or in an immersive view. The immersive rendering happens client-side, so it never needs a GPU on the node.
S.14NextRead the Appliance documentation
Packaged Docker images, install tooling and Darkmoon Doctor. See how to install, size, operate and diagnose a dedicated node on your own hardware.