HN Showcase
Back to browse
GitHub Repository

Agentic pentest tooling. Currently achieving 81% (KIMI K2.5) on XBOW's benchmark in full black-box. Completely Self-hosted. Every model available on LiteLLM (Ollama, anthropic, openai...)

249 starsPython

Deadend CLI – Open-source self-hosted agentic pentesting tool

by gemini-15·Feb 15, 2026·1 point·0 comments
Visit ProjectView on HN

AI Analysis

●●●BangerWizardryBig BrainNiche Gem

Autonomous pentesting agent scoring 78% XBOW with fully local, sandboxed execution and real exploits.

Strengths
  • •Feedback-driven iteration architecture (confidence thresholds: fail <20%, refine 20-80%, validate >80%) is a non-obvious approach to agent decision-making.
  • •Blind SQL injection wins where other agents scored 0% shows genuine capability beyond prompt engineering; custom payload generation + environment adaptation matter.
  • •Completely local execution (Docker+WASM sandbox) with LiteLLM agnosticism means no data leakage and deployment flexibility—real for pentesting.
Weaknesses
  • •78% XBOW is good but unverified against mainstream tools (Burp, Nuclei, custom exploit frameworks) in real engagements; benchmark may not reflect production pentesting value.
  • •Early product (warning label in README); CLI interface, Docker-only Linux/ARM64, unclear production readiness for actual red team workflows.
Category
Security
Target Audience

Security researchers, penetration testers, red teamers, teams building secure web applications

Similar To

Burp Suite · Nuclei · Custom agent-based fuzzers

Post Description

Hi HN,

Deadend is an agentic pentest CLI that automates vulnerability research in webapps.

the problem we are trying to solve : removing the time consumed in repetitive assessments, report generation and extracting relevant information to let them focus on vulnerability research but powerful enough to find issues or leads by itself when we’re in a deadend.

highlights : As of today, we scored 78% on XBOW’s benchmarks with claude-sonnet-4.5 in blackbox (we are currently iterating over the architecture of the agent and running the newest to get better results overall).

The agent runs entirely locally with optional self-hosted models. Shell tooling is isolated in Docker, and the python interpreter with WASM.

Some cool ideas are on the roadmap : CI/CD integrations, code review, bash completion, OWASP Top 10 plugins…

Docker is needed and it currently works only on MacOS Arm64 and Linux 64bits installable in one bash command.

Github Repo : https://github.com/xoxruns/deadend-cli Discord server : https://discord.gg/zwUVa3E7KT

Love to hear your thoughts and feedbacks!

Similar Projects