Skip to content

ARCHON v1.0.0

Choose a tag to compare

View all tags
@ghostshift-content ghostshift-content released this 06 Jul 12:49
v1.0.0
b004e05

ARCHON v1.0.0 — first stable release

A durable multi-agent AI penetration tester for web applications. A lead agent plans a stack-specific attack, per-class specialists go deep in parallel, and independent verifiers reject anything they can't reproduce — confirmed, de-duplicated findings land live on your board. Runs entirely on a Claude subscription over OAuth (no metered API key).

Highlights

  • Three engagement modes — black-box (URL), static/white-box (source, findings at file:line + vulnerable code block), and a combined white-box run that correlates source ↔ runtime into one report.
  • Map-all-then-review code-review pipeline — every feature mapped before Phase 2, no head-of-line stalls; findings stream live.
  • Honest confirmation status (RUNTIME_CONFIRMED / SOURCE_CONFIRMED / NEEDS_LIVE_VALIDATION / DISPROVEN) + an enforced evidence contract.
  • Safety perimeter — fail-closed scope gate, impact-proving exploits off by default (3-gate opt-in), non-destructive, portal binds 127.0.0.1.
  • Zero-build operator console — dispatch, live progress, triage, CVSS 3.1, on-demand reports.
  • Flag-gated, off-by-default Autonomous Agent OS layer (byte-identical to the deterministic pipeline when off).

Field-tested

ARCHON's white-box review found a real broken-access-control flaw disclosed to GitLab via HackerOne, fixed in GitLab's May 2026 security release as CVE-2026-4524 (CVSS 6.5, CWE-288).

Install

git clone https://github.com/ghostshift-content/ARCHON.git archon && cd archon
bash setup.sh && npm start        # + npm run dashboard → http://localhost:4000

Requires Node ≥ 18 and the claude CLI logged in (Claude subscription). See the README and CHANGELOG.

⚠️ Authorized testing only. Only test systems you own or have explicit written permission to assess.

🤖 Generated with Claude Code

Assets 3
Loading