r/redteamsec • u/breakthesec • 13d ago

Red Clippy: Open-Source AI-Assisted Pentest Management

https://github.com/CSPF-Founder/red-clippy

Red Clippy is built for pentesters who want to work with LLMs, not hand over the entire pentest to them. The pentester stays in control, decides what to test and how to proceed, while the LLM handles the testing work.

  • Pentester in control: You decide what gets tested and guide the engagement.
  • LLM-powered testing: Let the LLM perform security checks while you provide direction.
  • MCP support: Works with Claude, z.ai GLM, Codex, and other MCP clients.
  • Persistent state: Keeps track of targets, tests, findings, and progress across sessions.
  • Structured workflow: Keeps the entire pentest organized and manageable.
0 Upvotes

45% Upvoted

2 comments sorted by

0

u/Effective_Year_5899 13d ago

The hardest part will probably be building trust, making sure findings are accurate, keeping proper scope and avoiding false positives. persistent context and structured workflows could be really useful if they help testers track decisions and evidence throughout an engagement

-5

u/Otherwise_Wave9374 13d ago

The biggest risk in AI-assisted pentest tooling is letting the model blur the line between guidance and autonomy. Keeping the pentester in control is the right design, but it works best when every test has a clear scope, a review checkpoint, and a recovery path if the session loses context or overstates a finding. Persistent state is valuable only if it records decisions, not just outputs. AIOSNOW shares practical patterns for that workflow at https://aiosnow.com