VulnClaw

Why we included this project

VulnClaw turns a plain-language request into a full penetration test run by an AI agent. Give it a target and it works through reconnaissance, fingerprinting, vulnerability discovery, exploitation, and report writing as one continuous loop, calling MCP-based tools for fetching, HTTP replay, and integration with Burp or Chrome DevTools. The evidence handling is the part practitioners will care about: raw tool output gets stored, and the model only accepts flags or conclusions that appear word-for-word in real responses, so it cannot fake a win. It also bundles curated skills for common web and CTF tasks and ends each run with a structured Markdown report plus runnable Python PoC scripts. That makes it a practical fit for authorized engagements, red-team practice, CTF competitors, and security teaching, provided you stick to authorized targets and lab environments.