Decepticon automates realistic red team hacking engagements by executing professional attack chains governed by structured rules of engagement and sandbox isolation. It requires external runtime services, including LLM provider APIs, to operate.
Project overview
It executes real attack chains across the kill chain rather than running checkbox scans, governed by structured rules of engagement and MITRE ATT&CK mapping.
Project type
AI Agent
Use cases
Automation
Deployment
Refer to project documentation
License
Apache-2.0
Best for
Operations teams automating structured, rule-governed red team engagements using LLM-driven agents.
Key capabilities
Executes realistic attack chains including reconnaissance, exploitation, privilege escalation, lateral movement, and C2.
Generates Rules of Engagement, ConOps, Deconfliction Plan, and OPPLAN with MITRE ATT&CK mapping.
Coordinates agents organized by kill chain phase with fresh context windows.
Ships agent factories, middleware, tools, and skills via pip.
Limitations and risks
Running agents requires external runtime services for LLM and Sandbox via HTTP, including LLM provider APIs such as Anthropic, OpenAI, and Gemini.
Unauthorized access to computer systems is illegal; users are solely responsible for their actions.
Getting started
Setup is rated medium difficulty, requiring Docker and Docker Compose. The documented first success path is running an install script via curl, executing decepticon onboard, launching decepticon, and running the /web command from the CLI for dashboard access.
Evidence and sources
GitHub project description: Autonomous Hacking Agent for Red Team
README: The default start brings up the core management plane (LiteLLM, PostgreSQL, Neo4j, Skillogy, LangGraph, sandbox)
README: Skip the Docker setup — run autonomous red-team engagements right from your browser.
README: Running agents still needs those services — use the Docker stack above, or point the URLs at your own equivalents.
README: Decepticon is a professional autonomous Red Team agent.** It executes realistic attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, C2