elder-plinius/T3MP3ST

What it is

elder-plinius/T3MP3ST — a Node/npm multi-agent offensive-security framework (AGPL-3.0) that bolts a recon→exploit→report kill chain around an AI coding agent you already run (Claude Code, Codex, Hermes, OpenCode, Oh My Pi) or a local OpenAI-compatible model (Ollama, LM Studio, vLLM, llama.cpp). Driven from a browser "War Room" (http://127.0.0.1:3333/ui/) or CLI. Targets: web apps, CTFs, smart contracts, source code, embedded/robotics OSS.

How it works

The connected agent is the "brain"; T3MP3ST supplies the tooling ("Arsenal") and orchestration. Tool-calling is driven over plain text, so it runs even on models without native function-calling. Keyless by default (uses your local agent); optionally set a provider key. The status table in the README marks features as stable / experimental / roadmap.

What to do

Keyless War Room setup (~2 min):

npm install
npm run server        # War Room → http://127.0.0.1:3333/ui/

Fully offline on a local model:

ollama serve && ollama pull llama3
export TEMPEST_LOCAL_BASE_URL=http://localhost:11434/api    # LM Studio: http://localhost:1234/v1
export TEMPEST_LOCAL_MODEL=llama3
npm run build                                               # only needed from a git clone
npx tempest                                                 # → "Change default provider" → local

Verify the benchmark claims yourself:

npm run verify-claims   # re-derives every headline from committed JSON in bench/ (27/27 green)

Timeout knobs for slow local agents (milliseconds): T3MP3ST_LOCAL_AGENT_TIMEOUT_MS (per CLI call), T3MP3ST_TASK_TIMEOUT_MS (mission tasks), T3MP3ST_GENERAL_TIMEOUT_MS (planning).

Caveats (security-relevant, beyond the summary)

• Claude Code session reuse is disabled by default. A resumed coding-agent session may retain provider-side context and ambient tool authority outside the Arsenal receipt boundary. T3MP3ST_TRUST_CLAUDE_SESSION=1 re-enables reuse (isolated to one task) — but the README explicitly warns this must not be treated as an Arsenal-enforced sandbox.
• Novita provider = data egress. Setting NOVITA_API_KEY sends the model id, prompts/context, generated output, and request metadata to Novita, a third-party host. The project disclaims independent assurance for sensitive workloads — review Novita's terms before pointing it at sensitive target data.
• Benchmark figures are self-run. The 90.1% pass@1 (vs XBOW's self-reported 85%) recomputes from committed data via verify-claims; treat it as reproducible-from-repo, not independently audited.

The trust-boundary distinction below is the thing to internalize before enabling session reuse:

flowchart TD
    A[Agent task] --> B{Session reuse?}
    B -->|default OFF| C[Inside Arsenal receipt boundary]
    B -->|TRUST_CLAUDE_SESSION=1| D[Retains provider context + ambient tool authority]
    D --> E[NOT an enforced sandbox]