An autonomous AI penetration testing framework with a real 3D Venom avatar that talks, listens, and hacks. 47 tools. 501 skills. SAST scanner. Brutal tests.
Reasoning-driven vulnerability discovery that thinks like a penetration tester — with a face you can talk to.
Real 3D avatar powered by @met4citizen/talkinghead (MIT, 1449★) with audio-driven lip-sync. Black skin, glowing white eyes, sharp teeth, permanent snarl. Voice recognition + TTS.
Three.js · WebGLDeep distorted growl via Tone.js (MIT, 14693★). PitchShift -9 semitones → Distortion 0.4 → Lowpass 2200Hz → Highpass 90Hz. Configurable in real-time.
Tone.js · Web Audio APInmap, masscan, gobuster, sqlmap, nikto, hydra, metasploit, nuclei, dalfox, crackmapexec and 37 more. All wrapped with safe execution and YOLO mode for unrestricted ops.
CLI · Python5 mandatory pre-hunt skills (port scan, DNS brute, web recon, CVE match, reverse shell) + 496 optional skills across recon, vuln, exploit, post-exploit, OSINT, WiFi, social eng.
Categorized · Searchable10 static analysis tools: semgrep, bandit, ruff, pylint, mypy, pyright, vulture, radon, pip-audit, detect-secrets. Detects eval, exec, SQLi, XSS, SSRF, path traversal, pickle, secrets.
Browser-nativeUniversalAIClient → LLMClient adapter bridges sync→async. Specialist chain routing. 429 retry with 20×60s backoff. Advisory scope (non-blocking). 300s LLM timeout for large models.
OpenRouter · Llama 3.3 70BSingle-page web app with 11 panels: Dashboard, Provider, Skills, Tools, Config, Scope, Terminal, Chat, Hunt, Memory, SAST. All state persisted in localStorage. Responsive 1920→375px.
HTML · CSS · Vanilla JSSAFE → execute immediately. PRIVILEGED → ask user. DESTRUCTIVE → auto-deny. Advisory scope mode logs violations without blocking. Rate limiter at 60 req/min.
Safe · YOLO toggle41 Playwright tests covering page load, 11 panels, XSS injection, memory leaks, responsive layout, SAST scan, Venom mode activation, voice commands, exit/re-enter, console errors.
Playwright · 100% passA real 3D talking head — not hand-drawn SVG. Built on open-source libraries with audio-driven lip-sync and Venom-style voice effects.
The avatar uses @met4citizen/talkinghead — a MIT-licensed JavaScript class that loads GLB models with ARKit (52) + Oculus (15) viseme morph targets. We recolor all 10 Wolf3D_* meshes at runtime: black skin (0x000000), glowing white eyes (emissive 3.0), sharp white teeth, hidden glasses, angry mood.
TTS audio → Tone.Offline() render → PitchShift(-9) → Distortion(0.4, 4x) → Lowpass(2200Hz) → Highpass(90Hz) → Volume. Result: a deep distorted growl.
Web Speech API SpeechRecognition with continuous=true, interimResults=true. Auto-submits on 1.2s silence. Voice commands: show panel, list skills, scan code, status, exit.
Users can paste their own Google Cloud TTS API key in the ⚙ panel below the avatar. When present: TalkingHead uses Google TTS with SSML timestamps for word-accurate visemes. When empty: free StreamElements Brian + Tone.js Venom effects.
Every panel of the SecurAgentX Dashboard TUI — captured from a real Chrome browser running the dashboard.
Three ways to run SecurAgentX. Pick your flavor.
Get the code and enter the directory.
git clone https://github.com/moussa12345678/SecurAgentX.git
cd SecurAgentX
Open the dashboard in any browser. No build step needed.
cd dashboard
python3 -m http.server 8000
# Visit http://localhost:8000
Click the red V button (bottom-right). The 3D avatar loads in ~1 second. Click ⚙ to add your Google TTS key (optional).
# Click 🎤 to enable voice recognition
# Type or speak: "who are you?"
For full pentest capabilities with 47 CLI tools.
pip install -e .
python3 main.py --help
python3 main.py --yolo scan 127.0.0.1
# Install with all dependencies pip install -e . # Run the CLI agent (OpenRouter API key required for LLM) export OPENROUTER_API_KEY="sk-or-v1-..." python3 main.py --model meta-llama/llama-3.3-70b-instruct scan 127.0.0.1 # Or just open the dashboard (no API key needed for UI demo) cd dashboard && python3 -m http.server 8000 # Run the brutal test suite pip install playwright && python3 -m playwright install chromium python3 scripts/test_quick.py # 24 structural tests python3 scripts/test_venom_final.py # 17 Venom mode tests # Total: 41/41 passing
Every library is MIT-licensed and runs in the browser. No proprietary dependencies.
Star the repo, fork it, contribute. Every issue and PR makes the symbiote stronger.