Red CLI — Autonomous Red Team Platform

An open-source autonomous cybersecurity testing platform for the terminal. Find vulnerabilities, exploit them, and prove impact.

Combines 8 AI providers and 40+ models with autonomous penetration testing, vulnerability scanning, exploitation tooling, and smart intent detection — all from your terminal.

Features · Installation · Quick Start · Modes · Commands · Configuration

What is Red CLI?

Red CLI is a terminal-native AI penetration testing assistant with a modern React/Ink-based UI. It auto-detects your intent from plain English — type "scan example.com" and it switches to scan mode, runs nmap, looks up CVEs, and reports findings. Type "exploit that SQLi" and it generates payloads and tests them.

Features

🖥️ Modern Terminal UI (Ink-powered)

• Instant slash menu — type / to open a live searchable command menu
• Mode-colored prompt — visual feedback for current security mode
• Live streaming — see AI tokens as they arrive
• Tool call cards — risk-colored indicators (🟢 read, 🟡 write, 🔴 shell/exploit)
• Thinking indicator — elapsed time, mode, message count

🛡️ Cybersecurity-Focused Modes

Intent-based mode auto-detection — just describe what you want to do:

| Mode | Purpose | |------|---------| | recon | Default. Reconnaissance, enumeration, port scanning, subdomain discovery, fingerprinting | | scan | Vulnerability scanning, CVE lookup, nmap/nuclei/nikto analysis | | exploit | Exploitation, payload generation (XSS/SQLi/LFI/SSRF/CMDi), PoC verification | | report | Penetration test report generation with evidence and remediation | | osint | Passive OSINT — web search, DNS lookups, public data only | | audit | Security code audit — read-only source code vulnerability analysis |

🤖 Multi-Provider AI Support (8 Providers, 40+ Models)

| Provider | Models | Pricing | |----------|--------|---------| | AWS Bedrock | Claude Opus 4.7, Haiku 4.5 | AWS pricing | | Anthropic | Claude Sonnet 4, Opus 4, Haiku 4 | From $1/Mtok | | OpenAI | GPT-4o, GPT-4o-mini, GPT-4 Turbo | From $0.15/Mtok | | Google Gemini | Gemini 2.5 Pro/Flash/Flash-Lite, 2.0 Flash | Free tier + from $0.175/Mtok | | OpenCode Zen | GPT-5 series, Qwen, DeepSeek | Free models available | | NVIDIA | GLM-5.1, DeepSeek-V4, Kimi, Llama, Nemotron | API pricing | | Ollama | Llama3, Codestral, Mistral, Phi3 | Free (local) | | OpenRouter | Any OpenRouter model | Varies |

🔍 Built-in Security Tools (25+)

| Tool | Description | |------|-------------| | port_scan | Nmap-based port/service scanning (quick/full/service modes) | | dns_lookup | DNS record resolution (A, AAAA, MX, NS, TXT, CNAME) | | cve_search | CVE database lookup via NVD API + GitHub Advisory fallback | | payload_gen | Payload generation for XSS, SQLi, LFI, SSRF, CMDi, SSTI | | fingerprint | HTTP technology fingerprinting (server, cookies, JS frameworks) | | subdomain_enum | DNS brute force subdomain discovery | | bash | Shell commands with risk classification and safety confirmation | | web_search | DuckDuckGo web search | | web_fetch | URL content extraction | | install_tool | Auto-install security tools (nmap, nikto, subfinder, etc.) | | exploit | Quick exploitation testing (XSS, SQLi, LFI, ports, brute) |

🧠 Autonomous Execution

Auto Mode (/auto) — Let Red complete complex pentest tasks autonomously:

• Built-in task planner
• Loop detection & safety guardrails
• Progress tracking
• Goal-based completion detection

💾 Memory & Learning

• Global Memory — Remember findings across sessions
• Project Memory — Store scan results and exploit chains
• Auto-learning — Learns from your testing patterns

🔒 Safety Features

• Scope-based target authorization (/scope add example.com)
• Destructive command confirmation
• Workspace enforcement
• Configurable blocked commands
• Risk classification for all shell commands

Installation

Prerequisites: Node.js 18+, API key for at least one provider.

npm install -g redai-cli

Or from source:

git clone https://github.com/ragibalikhan/red-cli.git
cd red-cli && npm install && npm link

Quick Start

# Interactive REPL (starts in recon mode)
red

# Scan a target for vulnerabilities
red "scan example.com for open ports"

# Full autonomous penetration test
red --auto "pentest https://target.com"

# Generate XSS payloads
red "generate xss payloads"

# Use a specific model
red --model gemini-2.5-flash "scan example.com"

Modes

Red auto-detects your intent from your input — but you can also switch manually:

| Command | Switches to | |---------|-------------| | /mode recon | Reconnaissance & enumeration | | /mode scan | Vulnerability scanning | | /mode exploit | Exploitation & payloads | | /mode report | Report generation | | /mode osint | Passive OSINT only | | /mode audit | Code security audit |

Command Reference

Type / in the REPL to open the live searchable command menu, or use commands directly:

Security Testing

| Command | Description | |---------|-------------| | /pentest <target> | Full autonomous penetration test | | /scan <target> | Vulnerability scan | | /recon <target> | Reconnaissance & enumeration | | /exploit <type> <target> | Quick exploitation (xss, sqli, lfi, ports, etc.) | | /cve <CVE-ID> | Look up a specific CVE | | /secrets [path] | Scan for leaked secrets | | /scope add <target> | Authorize a target for testing | | /report | Generate penetration test report |

Model & Config

| Command | Description | |---------|-------------| | /model | Open model selector | | /mode <name> | Switch mode (recon/scan/exploit/report/osint/audit) | | /provider <name> | Switch AI provider | | /setkey <provider> <key> | Save API key |

Planning & Auto

| Command | Description | |---------|-------------| | /plan <task> | Create and execute a plan | | /auto <task> | Run in autonomous mode | | /goal <condition> | Run with goal-based completion |

Utilities

| Command | Description | |---------|-------------| | /doctor | Run diagnostics | | /usage | Show usage statistics | | /tokens | Show current session tokens | | /compact | Compact conversation to save tokens | | /save [file] | Save session to file | | /clear | Clear conversation | | /help | Show help |

Configuration

Interactive Setup

red doctor
red doctor --fix

Config File

Create ~/.red/config.json:

{
  "provider": "bedrock",
  "model": "anthropic.claude-opus-4-7",
  "mode": "recon",
  "awsRegion": "us-east-1",
  "apiKeys": {
    "bedrock": "your-bedrock-api-key",
    "openai": "sk-...",
    "gemini": "...",
    "nvidia": "nvapi-..."
  }
}

AWS Bedrock Setup

1. Get an API key from AWS Console → Bedrock → API Keys
2. Run: /setkey bedrock <your-api-key> us-east-1
3. Select a Bedrock model via /model

Environment Variables

export AWS_BEDROCK_API_KEY="..."
export AWS_REGION="us-east-1"
export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."
export GEMINI_API_KEY="..."
export NVIDIA_API_KEY="nvapi-..."

CLI Options

red [options] [message]

Options:
  --version              Show version
  --model <name>         Set model
  --mode <name>          Set mode (recon/scan/exploit/report/osint/audit)
  --provider <name>      Set provider
  --no-tools             Disable tools (chat only)
  --auto                 Run in autonomous mode
  --max-iter <n>         Max iterations for auto mode

Contributing

Contributions welcome! See CONTRIBUTING.md for development setup and guidelines.

Security

See SECURITY.md for security policy and responsible disclosure.

License

MIT — Star this repo if you find it useful! ⭐