Autonomous
pentest.

AI-driven penetration testing that runs entirely on your infrastructure. Self-hosted Docker container. Zero-knowledge architecture — ModularCISO never sees your targets, your results, or your API keys.

Coming Soon v1.0.0 Docker
# Pull the image
$ docker pull ghcr.io/zealot88/
  modularciso-pentest:1.0.0

# Run it
$ docker run -d -p 8443:8443 \
  -v reports:/app/reports \
  ghcr.io/zealot88/modularciso-pentest:1.0.0

# Open
$ open http://localhost:8443
$
Read this before you run it

Only scan systems you own or have explicit written authorization to test.

This tool performs active port scanning, directory fuzzing, vulnerability probing and AI-driven attack chaining against whatever target you give it. Running that against infrastructure you do not own or have permission to test is a criminal offence in most jurisdictions — including under the UK Computer Misuse Act, the US Computer Fraud and Abuse Act, and Article 197 bis of the Spanish Código Penal. Intent is not a defence, and "I was only scanning" is not a defence.

Before you point it at anything:

  • Get authorization in writing, from someone with authority to grant it, naming the exact scope and time window.
  • Confirm the target is actually in that scope — shared hosting, CDNs and cloud tenancies routinely put other people's systems behind the same address.
  • Check your provider's rules. Testing your own cloud-hosted systems can still breach your hosting agreement.
  • Expect it to be noisy. Nuclei, ffuf and an autonomous agent chaining attacks will trip detection, and may disrupt fragile services.

You are the operator, not us. The tool runs entirely on your own infrastructure — we never see your targets, results, or keys, which also means we cannot vet what you point it at. Responsibility for every scan is yours. Use of the security tools to attack, scan, or test systems you do not own or are not authorized to test is prohibited under our Terms of Service.

Five-phase autonomous assessment.
Point it at a domain you are authorized to test. The pipeline runs recon, network scanning, web fuzzing, vulnerability detection, and then hands control to an AI agent that chains attacks autonomously.
01
Recon
WHOIS, DNS records (A, MX, TXT), domain intelligence gathering
02
Network
Nmap port scanning with service and version detection
03
Web Scan
ffuf directory fuzzing + Nuclei vulnerability scanner (9,900+ templates)
04
AI Agent
Autonomous OODA loop — observe, orient, decide, act. Up to 15 chained attack iterations
05
Report
Brutalist threat dashboard with findings sorted by severity
Your keys, your models.
Bring any OpenAI-compatible LLM. Cloud APIs or self-hosted — the tool adapts to your infrastructure.
OpenAI
Anthropic
Ollama
GPUStack
vLLM
Custom

Ollama, GPUStack, vLLM, and Custom endpoints use the OpenAI-compatible /v1/chat/completions protocol. API keys never leave your machine.

Zero-knowledge by design.
ModularCISO has no access to your targets, scan results, AI API keys, or findings. Everything runs inside a Docker container on your machine. We ship the tool — you own the execution.

Your Machine

API keys stay here.
Docker host.

Container

Nmap, ffuf, Nuclei,
AI agent run here.

Your Targets

Results stay on
your machine.

Three commands.
# 1. Pull the image from GitHub Container Registry
docker pull ghcr.io/zealot88/modularciso-pentest:1.0.0

# 2. Run the container (reports persist across restarts)
docker run -d -p 8443:8443 \
  -v pentest-reports:/app/reports \
  ghcr.io/zealot88/modularciso-pentest:1.0.0

# 3. Open the Brutalist web interface
open http://localhost:8443
Bundled toolchain.
Nmap 7.80
Port scanning, service detection, NSE scripts
Nuclei 3.7.0
9,900+ vulnerability templates. CVEs, misconfigs, exposures
ffuf 1.1.0
Directory enumeration, path discovery, content fuzzing
AI Red Team
Autonomous agent with OODA loop. Chains attacks based on findings
Web Dashboard
Real-time scan progress via SSE. Brutalist threat report generation
Persistent Storage
Reports survive container restarts via Docker volume mount

Coming soon

The Pentest Tool is currently in development. Create a free account to be notified when it becomes available.