Skip to content

Back to the catalog

OpenHunterAI
github.comrepo

OpenHunterAI

OpenHunterAI is a self-hosted, alpha-stage AI red-teaming workspace that applies attacker-style reasoning to web, API, and LLM application security testing against verified, in-scope public targets. It runs locally via Docker/Node.js, orchestrates bounded testing (scope lock → surface mapping → baseline → hypothesis testing → evidence gating → report/retest) through Go workers over NATS, and ships adapters for browser inspection, OWASP ZAP, and Nuclei, with separate OpenHack and Strix runtime integrations and an agent skill for Claude Code/Codex/Gemini CLI/Grok.

TL;DR A local, AI-driven attacker-reasoning workspace for scoped web/API/LLM app pentesting, built on ZAP, Nuclei, and Go workers.
Open original ↗
Document

What it is

OpenHunterAI's README, with the concrete setup commands, version requirements, and one blocker the catalog summary omits: the packaged Nuclei adapter is not usable out of the box.

Preconditions / Affected

Requires Git, Node.js 22+, and Docker with Compose v2. Workspace serves on localhost:3001. Source-available under PolyForm Noncommercial 1.0.0 (commercial use needs separate licensing). Alpha stage — coverage depends on which runtimes you configure, and OpenHack and Strix runtimes must be brought separately (not bundled).

What to do

Stand up the workspace:

git clone https://github.com/LumosLab-Innovation/OpenHunterAI.git
cd OpenHunterAI
node ops/local.mjs start

First start builds images, runs migrations, and writes .env.local with generated secrets. Then set provider keys/model IDs in .env.local and:

node ops/local.mjs restart

For interactive target-login capture, start with node ops/local.mjs start --with-browser.

To install the agent skill into a repo you want assessed:

npx --yes skills add LumosLab-Innovation/OpenHunterAI --skill openhunter --agent codex claude-code gemini-cli grok --yes

Installing the skill does not start a scan; it ships a read-only API helper.

Caveats

  • Nuclei blocker: the adapter is packaged, but no reviewed template bundle ships with it. You must resolve the "template-policy blocker" before Nuclei scanning works — this is a prerequisite the summary's "ships adapters for … Nuclei" phrasing hides.
  • "Local" ≠ scan localhost. It means the workspace runs on your machine; it is not permission to scan localhost or private networks. Keep ports on loopback. Scanning is constrained to verified public targets you own or are authorized to test.
  • An empty report does not prove a target is secure.
  • Included adapters are only browser inspection, ZAP, recon, and Nuclei; anything else (OpenHack, Strix) is separate.

Technologies named here

Techniques named here

  • Attacker-style external assessment methodology

Related in Offensive Security