openhackai/OpenHack

What it is

openhack — a Python CLI (installable via pipx install openhack, uv tool install openhack, or pip install openhack) that runs an agentic recon → hunting → validation → verification pipeline over a local codebase and emits CVSS-scored findings. The summary covers the pipeline; what follows is the operational detail an engineer needs before running it.

How it works

Beyond the four-stage pipeline, two verification stages are gated behind Docker and marked Beta:

• /verify sandbox spins your app up in a Docker container and fires live HTTP requests at each candidate; successfully exploited findings get a ✓.
• /verify browser launches a headless browser against the sandboxed app for client-side issues (XSS, CSRF, DOM). It requires Docker when combined with sandbox.

Source is read and prompts are built locally, but model prompts are sent to whichever provider you select — and with the default hosted OpenHack provider they go through OpenHack Inference. So despite the "exclusively open-source models" framing, the default path ships prompts derived from your source to a third-party inference service.

flowchart TD
  A[Source read locally] --> B{Provider}
  B -->|Hosted OpenHack default| C[OpenHack Inference — offsite]
  B -->|Self-connected provider| D[Your chosen endpoint]

Preconditions / Affected

• Docker Desktop or a running daemon on the scanning machine for either verification stage. Without it, /verify sandbox fails with a clear error before the scan starts.
• First run requires a one-time setup; the recommended path opens a browser, logs you into an OpenHack account, grants $20 free credits, and stores a token.
• Credentials live in ~/.openhack/auth.json, preferences in ~/.openhack/config; both are owner-only permission.

What to do

Headless / CI mode (no TUI) — runs the same pipeline, prints to stdout, writes a JSON report, and exits:

openhack --scan /path/to/repo

Report lands at ~/.openhack/scans/<session-id>.json. Scans are checkpointed per stage; resume an interrupted one:

openhack --resume <session-id>

Providers: /connect to attach one or more, /models to select. Cloudflare Workers AI needs CLOUDFLARE_ACCOUNT_ID; Azure OpenAI needs the full /openai/v1 endpoint in AZURE_OPENAI_BASE_URL; Amazon Bedrock needs AWS_REGION. Force legacy terminal input with OPENHACK_KITTY_KEYBOARD_PROTOCOL=false.

Caveats

Both verification stages are Beta. --flags are the documented interface even though bare-word forms (openhack scan) still work. The provider/model catalog syncs from Models.dev and is cached one day, with a bundled offline fallback — so the model list you see may lag upstream.