Pulse
Problem
Penetration testing is largely manual, and most automated tools send target data to third-party cloud services — a non-starter in security-critical environments.
Approach
A LangGraph state machine fingerprints a web or repository target, then a planner node selects which of twelve industry-standard tools to run — nmap, sqlmap, dalfox, semgrep, bandit, trufflehog and pip-audit among them. An LLM reads the raw output, reasons across findings to build a MITRE ATT&CK–aligned exploit graph, and writes a structured vulnerability report. Reasoning streams live to a Next.js and FastAPI interface over Server-Sent Events. Ollama runs the models locally by default, with OpenAI and Claude available as optional backends.
Challenges
Coordinating non-deterministic model output with deterministic security tooling required strict state management and guardrails, delivered under a zero-data-leakage constraint and a 24-hour deadline.
Outcome
A local-first pipeline that runs end to end without sending target data off the machine, and won first place at BirmingHack 2.0 for Best Use of AI Agents on Arm.