· 5 min read
HexStrike AI is a clever idea: an MCP server that lets an AI assistant call 150+ security tools. It is a powerful tool-runner. The question is what orchestrates those tools into an actual assessment, and where your data goes while it happens.
Tool-runner vs orchestrated platform
- HexStrike hands tools to whatever agent you plug in; the methodology and the model are yours to supply (usually a cloud one).
- Darkmoon is a full platform: it ships the recon → exploitation → reporting methodology agents, runs on a local LLM by default, and keeps sensitive values off the model via a Privacy Gateway. It is also an MCP server, so you keep the composability.
Coverage and proof
Web, API, Active Directory and Kubernetes, with a reproducible result: 57 vulnerabilities on OWASP Juice Shop in 28 minutes (benchmark).
Full disclosure: Darkmoon is our project. github.com/ASCIT31/Dark-Moon.