Open-source OODA pentest agent drives Kali and Playwright tools directly over MCP
irraz_rulez · reddit · 2026-10-17
A Redditor open-sourced vulnerator-ai (MIT), an autonomous pentesting agent where an LLM (Hermes) runs a straight OODA loop calling tools directly over MCP — just two MCP servers, one for Kali tools and one for Playwright. The architecture exposes only run lifecycle (start/status/stream/steer/stop) at the front door, never raw shell tools, so client apps can trigger and watch runs without becoming the brain; tool output passes back as untrusted data. Local mode uses stdio with no open port; remote streamable-HTTP mode is token-gated. The author warns it ships with essentially zero guardrails and is for lab/authorized targets only.
More from coding & agent
- YC Partner: Personal Software Is Cheaper Than Ever, and Open-Sourced Code Lets Others' Agents Fill the Gaps — ycombinator · 2026-10-17
- Claude Code's contextual UX hints earn praise from a heavy daily user — iamsahaj_xyz · 2026-10-17
- Codex-created worktrees blamed for killing a 600GB-battered SSD; users say disk bloat is the worst part of AI coding tools — natesiggard · 2026-10-17
- Engineer: I'm not smarter than AI anymore — time to learn to orchestrate it — KevinNaughtonJr · 2026-10-17
- DeepSeek V4.1 Flash 1017 finds 54 vulns for $7.53, topping open-weight leaderboard — zizhpan · 2026-10-17
- Gemini CLI PR adds user-facing warning when quota info is unavailable — VinayakSingh2513465 · 2026-10-17