For vibe coding & AI-built apps

You built it with AI. Test what the AI built.

AI coding agents like Claude Code, Cursor, Lovable, Bolt, Replit, v0 and Windsurf ship working features fast. Darkmoon is the open-source autonomous pentest layer that runs after them, so the code the AI wrote gets tested the way an attacker would test it.

Your wedge

Fast to ship is not the same as safe to ship

AI ships features, not reviews

Agents generate working code in minutes, but the output goes live unreviewed for security: injection, broken authorization, hardcoded secrets, SSRF, insecure defaults, exposed endpoints and vulnerable LLM or MCP surfaces.

50 specialist agents, real attacks

Darkmoon runs 50 specialist agents across web, API, Active Directory, cloud, Kubernetes, IoT and firmware, LLM and MCP surfaces, and proves each issue with the exact request and the raw response.

Runs on a local model

It runs on a local LLM via Ollama or llama.cpp, and the Privacy Gateway tokenizes real IPs, hosts and credentials, so the model works on placeholders while the real values stay on your side.

What you get

What a run on your AI-built app produces

  • Point it at the app you just shipped

    Clone it, install it, authorize a target you own, and let the agents fingerprint the stack the AI assembled and then attack it end to end.

  • Findings graded by demonstrated impact

    Every finding is graded by the exploit that proves it, not a raw score, so you fix what actually matters first. The paid Pro tier adds a remediation agent that turns a finding into a retested pull request a human reviews, never merged automatically. That remediation step is not in the open source build.

  • The AI layer is a target too

    If your app talks to an LLM or exposes an MCP server, the llm agent tests it against the OWASP LLM Top 10: prompt injection, insecure output handling, SSRF and unauthenticated access.

Start here

The pieces that matter to you

Quick start

Run it on your AI-built app

# 1. clone the open-source engine
$ git clone github.com/ASCIT31/Dark-Moon
$ cd Dark-Moon
# 2. install (local model via Ollama or llama.cpp)
$ ./install.sh
# 3. point it at the app you just shipped
$ ./darkmoon.sh "TARGET: staging.myapp.test"
✓ recon complete · stack fingerprinted
✓ specialist agents dispatched · streaming live

Test what the AI built, before someone else does

Darkmoon is open source under GPLv3 and runs on a local model. Clone it, authorize an app you own, and read every line.

View on GitHubDocumentation