----------------
🛠️ Tool
===================
Decepticon is an open-source autonomous red team agent developed by PurpleAILAB. The project explicitly distances itself from tools that "run nmap and write a report," targeting end-to-end engagement automation instead.
Core Architecture
The tool runs as a Docker-based stack with several components:
• LiteLLM for LLM call routing across providers
• PostgreSQL for data persistence
• Neo4j as a knowledge graph for attack chain representation
• LangGraph for agent orchestration
• Skillogy for skill management
• A sandboxed execution environment
The orchestrator spawns specialist workloads on demand rather than running everything upfront. Documented specialists include BloodHound CE for AD reconnaissance, Sliver C2 for command and control, and Ghidra MCP for binary analysis. Activation is via commands like ops_start("ad").
Installation and Deployment
Installation is via curl pipe to bash on macOS/Linux/WSL2, or PowerShell on Windows. The decepticon onboard command provides an interactive setup wizard for provider, API key, and model profile configuration. A web dashboard is accessible from the CLI via /web.
A cloud-hosted version is available at app.decepticon.red for users who prefer not to self-host.
SDK Usage
The project ships a pip-installable SDK (pip install decepticon) with an optional neo4j extra for knowledge-graph attack-chain tools. The SDK provides agent factories, middleware, tools, and skills, routing LLM calls and sandbox execution through Decepticon infrastructure. This enables building custom orchestrators or integrating agents into existing products and research workflows.
Technical Observations
The on-demand specialist spawning model is worth noting. Rather than a monolithic tool, Decepticon treats each capability as a separate workload the orchestrator launches when needed. This modular approach makes it easier to extend or replace individual components.
The Neo4j knowledge graph for attack chain representation is a meaningful design choice. It maintains structured state about engagement progress rather than relying purely on LLM context, which could make state inspection and chain reasoning more reliable.
Limitations
The project is relatively new. The README provides no benchmarks or comparison data against manual red team engagements. Haven't tested personally, so stability and orchestration quality in real environments remain open questions. The reliance on external LLM providers introduces API cost and rate limit concerns for extended operations.
References
• Repository: PurpleAILAB/Decepticon (GitHub)
• Documentation: docs.decepticon.red
• License: Apache 2.0
🔹 tool #redteam #decepticon #offensivesecurity #autonomousagent
🔗 Source: https://github.com/PurpleAILAB/Decepticon