Unclecheng-li / VulnClaw

项目摘要

VulnClaw is an AI-driven penetration testing CLI tool that combines LLM Agent architecture with MCP toolchain and penetration testing Skill orchestration. It accepts natural language input and autonomously executes the full security assessment workflow: information gathering, vulnerability discovery, exploitation, and report generation.

为什么值得关注

Introduces a goal-driven solving engine using blackboard graph state space search and OODA loop for penetration testing, replacing naive fixed-round loops. Features evidence-based anti-hallucination gates that require tool output verification, 21 specialized penetration skills, and support for 13 LLM providers — a structured approach to preventing AI agents from 'spinning in circles' during security assessments.

优势

• Goal-driven solving engine with blackboard graph state space search avoids fixed-round loops and 'spinning in circles'
• Evidence-based anti-hallucination gates require real tool output verification before accepting conclusions
• Rich skill ecosystem: 21 penetration skills with 180 reference docs covering CTF, OSINT, web exploitation
• Broad LLM provider support (13 providers) with OpenAI-compatible protocol
• MCP toolchain integration for extensible tool calling (fetch, memory, chrome-devtools, burp)
• Web UI mode and structured Markdown report generation with runnable Python PoC scripts

局限性

• Primary documentation and community are Chinese-centric, limiting global accessibility
• Python execution tool is explicitly high-risk and not a strong isolation sandbox
• Relatively new project (created April 2026) with evolving architecture and limited track record
• Niche domain focus means smaller community compared to general-purpose agent frameworks

使用场景

• Authorized penetration testing with natural language task descriptions
• CTF competition assistance across Web, Crypto, and Misc categories
• Security education and red team training exercises
• Automated vulnerability assessment with structured reporting