Follow one campaign end to end: planned, dispatched to specialists, run behind a governed tool boundary, qualified without inflation, and, on Pro, closed with a fix whose only success criterion is that the original exploit no longer fires.
Before any prompt or tool output reaches the model, the Privacy Gateway tokenizes IPs, hostnames, domains, URLs, emails, paths, users and credentials into deterministic placeholders. Real values are re-injected only on your host, at the instant a tool runs, and again only in the local report. Even the launch prompt is tokenized over a local socket that fails closed.
You hand Darkmoon a scope. A pentest orchestrator fingerprints the technology signals it finds and builds a plan, which target classes are present, in what order to approach them, and how deep to cascade. Cloud and infrastructure branches only open on a positive artifact, never on a guess.
The orchestrator dispatches specialist sub-agents, web, cloud, Active Directory, Kubernetes, databases, IoT/firmware, CI/CD, IaC and an llm agent for exposed AI/LLM inference endpoints. Dispatch is an inline task() call inside the orchestrator's own turn, so there is no separate control plane to trust.
Agents reach 142 security tools through a single executor allow-list that is a hard boundary. A build test fails the release if any installed tool drifts outside the list, so the agents can neither silently gain an unvetted binary nor lose a capability between versions.
Specialists run their playbooks against the rehydrated real target, streaming each tool result, infrastructure node and event as it happens. The result is an attack-surface graph, not a flat list: hosts, paths and the relationships between them.
The orchestrator correlates what the specialists return (a leaked credential here, a reachable service there) into candidate attack paths, and decides where it is worth pushing exploitation further.
Each finding is forced through an adversarial rubric in the agent's own prompt: EXPLOITED (impact executed end to end), CONFIRMED (payload plus raw response and extracted data) or UNCONFIRMED (a lead only). A lead is never dressed up as a proven exploit, and exploited findings are counted separately.
This qualification is a prompt-enforced self-review, not machine verification. The status is asserted by the agent and then normalized. Darkmoon does not, at this stage, machine-prove exploitation. The one place an exploit is machine-re-run is stage 10 (Pro).
Findings carry severity, CVSS, MITRE ATT&CK, ISO 27001 and full local evidence. Everything that leaves the host, the API, HMAC-signed webhooks, the event stream, carries only safe fields: counts, booleans, ids, MITRE tags and timestamps. Evidence bodies, secrets and raw requests/responses never cross those surfaces.
A fix only counts if the original exploit no longer fires, and the pull request is always left for a person to review and merge.
For findings qualified confirmed or exploited, Pro maps the finding back to the target's own source, reproduces the exploit against a clean build, and writes the smallest correct fix as a deterministic search/replace patch.
Learn moreContinuous, evidence-backed coverage with a clear line between what was proven and what is a lead, and data sovereignty by design.
An orchestrated fleet that does the pivoting, with an adversarial rubric that refuses to inflate a finding.
A finding that comes with a root-cause fix and a before/after exploit retest, as a reviewable pull request.
A governed tool boundary and safe-field-only egress you can wire into CI, SIEM and automation without leaking evidence.
The open-source engine is on GitHub under GPLv3. Clone it, point it at a target you own, and read every stage of the pipeline yourself.