BlackCrowSec is an AI-native offensive-security workbench: an autonomous agent console that drives a full pentest toolchain behind deterministic scope gates, allowlists and audit logging — with a feedback loop that trains the model on every engagement.
A deterministic allowlist of domains, IPs and CIDRs you sign. Anything outside is refused before execution — logged, never retried.
Ordered step programs: command steps run verbatim through the gate, prompt steps make the model emit one command from your directive, auto steps plan and report. Branching, retry and expect — from quick recon to full MITRE campaign chains.
133 runtime-verified tools — nmap, sqlmap, nuclei, ffuf, legba, katana, trivy, gitleaks, graphql-cop, smuggler — the model reads the oracle and knows what actually exists on the box.
The whole console runs as a Tor hidden service. CROWSINT harvests through 17 live search engines, fetches page titles by TBB circuit, and indexes everything into your own map.
Param-LoRA fine-tuned BlackCrowSec models, refreshed from curated engagement traces — a feedback loop that teaches methodology. Inference stays local: nothing leaves your lab.
Every access key gets its own isolated job history — clear, bundle and download your runs. Teammates see only their own data, never yours.
Members get private VPN access — per-device keys, data-capped, revocable, no traffic logs. One click in the console; paste the key into the Outline client. plans & details →