{"repo":"mukul975/Threatswarm","free":true,"listed":false,"github":"https://github.com/mukul975/Threatswarm","clone":"git clone https://github.com/mukul975/Threatswarm.git","description":"27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.","language":"Python","stars":67,"topics":["ai-agents","ai-security","anthropic","autonomous-agents","blue-team","bug-bounty","claude-code","claude-code-plugin","cybersecurity","dfir"],"license":"MIT","category":"ai-agents","readme_excerpt":"27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills. --- For authorized security testing only. Every network command is scope-gated by scope check.py — violations are blocked deterministically at the OS level, not by convention or prompt instruction. Why ThreatSwarm Most AI pentest tools stop at exploit. ThreatSwarm runs the complete kill chain — recon, exploitation, post-exploitation, DFIR, and a CVSS-scored report — in a single session. It ships as a one-command Claude Code plugin (no Docker, no Postgres, no cloud account required), enforces scope on every tool invocation across all 27 agents, and loads its methodology from the 754-skill Anthropic-Cybersecurity-Skills library mapped to ATT&CK, CSF 2.0, ATLAS, D3FEND, and AI RMF. Demo Scope enforced throughout. Evidence written to evidence/20260429/10.10.10.5/ . Install Marketplace (recommended — installs into any project): Standalone — clone and use directly: Single session — load without installing: Quickstart 1. Add authorized targets to scope.txt : 2. Set your attacker IP in .claude/settings.json → \"LHOST\": \"10.10.14.1\" 3. Run claude and start a kill chain: The 27 Agents Agent Domain Key Tools --- --- --- — Offensive — recon Port scan · service enum · subdomain discovery nmap, nuclei, httpx, subfinder, amass exploit CVE exploitation · initial shell access Metasploit, searchsploit, PoC analysis p","default_branch":null,"files":null,"tree":[],"storefront":"/r/mukul975","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/mukul975/Threatswarm/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}