Cairn

Why we included this project

Cairn reframes autonomous security testing as a search problem rather than a set of fixed playbooks. A blackboard holds confirmed findings as facts, open directions as intents, and lets a human drop in hints mid-run, while agent workers loop through observe, orient, decide, act and write what they learn back to the board. That structure proved itself early: at a Tencent Cloud hackathon it was the only entry to solve all 54 AI pentesting challenges, on its first outing and with no domain-specific tooling. It runs as a server plus a dispatcher that schedules containerized workers over supported LLM CLIs, with a Docker-free local mode for hosts that already have Claude Code, Codex, or Pi configured. Security researchers and red teams wanting a transparent, extensible agent for autonomous pentesting will find the general-purpose engine underneath worth exploring too.