decepticon is an autonomous red-team agent that executes realistic attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and command-and-control — the way a real adversary would. It addresses the gap of AI hacking tools that only run nmap and print a report instead of executing full attack chains.
Project overview
Instead of stopping at scanning and reporting, it carries out complete adversary-style attack chains and runs interactive offensive tools (msfconsole, sliver-client, evil-winrm) inside persistent tmux sessions with automatic prompt detection.
Project type
MCP · AI Agent
Use cases
Automation
Deployment
Refer to project documentation
License
Apache-2.0
Best for
Security operators who need an agent to execute full red-team attack chains against authorized targets rather than only scanning and reporting.
Key capabilities
Runs every command inside persistent tmux sessions with automatic prompt detection, so interactive tools such as msfconsole, sliver-client, and evil-winrm receive follow-up commands without workarounds.
Limitations and risks
Do not use this project on any system or network without explicit written authorization from the system owner.
Getting started
Run `curl -fsSL https://decepticon.red/install | bash`, then `decepticon onboard` (interactive onboarding wizard that also configures an LLM provider such as Anthropic, OpenAI, or local Ollama), then start the stack with `decepticon`. Setup is easy: a single install script, an onboarding wizard, and one command to start. Use via CLI or the web dashboard.
Evidence and sources
GitHub project description: Autonomous Hacking Agent for Red Team
README: **Decepticon is a professional autonomous Red Team agent.** It executes realistic attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, C2 — the wa…
README: Name an engagement, then choose a mode: CLI creation asks only for the engagement name and opens Soundwave planning. Use `/mode plan`, `/mode red`, or `/mode blue` within the sess…
README: Decepticon runs every command inside persistent tmux sessions with automatic prompt detection — so when a tool drops into an interactive prompt, the agent sends follow-up commands…
README: claude mcp add --scope user decepticon -- decepticon mcp serve codex mcp add decepticon -- decepticon mcp serve