AI coding agents like Claude Code, Cursor, Lovable, Bolt, Replit, v0 and Windsurf ship working features fast. Darkmoon is the open-source autonomous pentest layer that runs after them, so the code the AI wrote gets tested the way an attacker would test it.
An AI agent writes code that runs. Whether it holds up under attack is a separate question, and one nobody asked yet.
Agents generate working code in minutes, but the output goes live unreviewed for security: injection, broken authorization, hardcoded secrets, SSRF, insecure defaults, exposed endpoints and vulnerable LLM or MCP surfaces.
Learn moreClone it, install it, authorize a target you own, and let the agents fingerprint the stack the AI assembled and then attack it end to end.
Every finding is graded by the exploit that proves it, not a raw score, so you fix what actually matters first. The paid Pro tier adds a remediation agent that turns a finding into a retested pull request a human reviews, never merged automatically. That remediation step is not in the open source build.
If your app talks to an LLM or exposes an MCP server, the llm agent tests it against the OWASP LLM Top 10: prompt injection, insecure output handling, SSRF and unauthenticated access.
The Pro remediation tier takes 42 of 57 OWASP Juice Shop findings to a retested fix, with the limits disclosed.
How the Pro remediation tier turns each finding into a sandbox-validated pull request a human reviews.
How the local-model, open-source approach lines up against the cloud pentest tools.
Wire a run into CI, trigger it from n8n, or keep the whole thing local.
Shipping LLM features or an MCP server? The AI-layer testing story in depth.
Open source under GPLv3. Read every line, then point it at an app you own.
Clone the engine, install it, then point it at a target you are authorized to test.
Darkmoon is open source under GPLv3 and runs on a local model. Clone it, authorize an app you own, and read every line.