OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Luan1Aoagent

Luan1Aoagent is an open-source TypeScript AI agent for autonomous, authorized penetration testing and security research, using the Pi SDK and graph-based reasoning to coordinate tasks and preserve evidence.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Luan1Aoagent — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use it for authorized security research when planning, execution, supervision and evidence provenance need explicit runtime boundaries.

Who it is for

  • Security researchers conducting authorized assessments
  • Cybersecurity developers building autonomous testing workflows
  • Teams that need observable agent actions and evidence-backed reasoning

Documented uses

  • Coordinate bounded penetration-testing tasks
  • Investigate observations through evidence-linked hypotheses and vulnerabilities
  • Preserve tool outputs and task results as durable artifacts
  • Inspect agent reasoning, actions and graph updates
Before you choose

Requirements & limits

The public repository is active and open source under the AGPL-3.0 license. Its setup badges identify Node.js 25 or newer, TypeScript 5.x and the Pi SDK.

  • The project is implemented in TypeScript rather than the earlier Python v1 runtime.
  • Planner, Executor and Observer have separate responsibilities and structured submission points.
  • Large outputs are preserved as immutable artifacts, while tasks retain isolated workspaces and persisted session lineage.
  • The reasoning graph distinguishes hypotheses from confirmed vulnerabilities and successful exploits and requires evidence references for the latter.
  • The README states that v1 benchmark results are not automatically attributable to v2.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Install LuaN1aoAgent v2 and configure its LLM runtime

Prepare the v2 project and local LLM configuration before starting an authorized assessment.

Before you start

  • macOS or Linux; Windows is not a validated v2 release target.
  • Node.js 25 or later.
  • An OpenAI-compatible LLM API and its API key.
  • Docker is recommended for the preferred transparent Gateway backend; on Linux, the user must be able to reach the Docker daemon.
  • Use an isolated host, VM, or container for agent tools.

Steps

  1. Clone the repository, enter its directory, run the command below, then run the command below.

    Documented command
    npm ci
    Documented command
    npm run build

  2. For the preferred Docker backend, build the executor and network images with the command below and the command below.

    Documented command
    npm run build:executor-image
    Documented command
    npm run build:network-image

  3. Create a local .env file with LLM_API_KEY, LLM_API_BASE_URL, and LLM_DEFAULT_MODEL; optionally set LLM_API_TYPE to openai-completions or openai-responses.

  4. Keep .env out of version control; the project ignores it, and it must never be committed.

Expected outcome

The project is built and its local LLM runtime settings are configured for a subsequent Agent run.

Guide limitations

  • The documented setup does not itself start an assessment.
  • Docker is recommended, and required for the preferred transparent Gateway backend; installation falls back to native host backends if the Docker daemon is unavailable.
  • The API must be OpenAI-compatible; Chat Completions is the default and Responses API is optional.
  • Executor tools can run shell commands, so use isolation and test only explicitly authorized targets.
Documentation 1 ↗
Source-based practical guide

Start an authorized LuaN1aoAgent v2 assessment

Start a fresh Agent run with an explicit goal and authorized network scope.

Before you start

  • Complete the repository installation and LLM runtime configuration.
  • Use macOS or Linux, Node.js 25 or later, and an ANSI-compatible TTY for the interactive Agent timeline.
  • Run from an isolated host, VM, or container, and specify only targets explicitly authorized for testing.

Steps

  1. From the project directory, run the command below with a --goal describing the authorized assessment and --scope listing its authorized IPv4 addresses, CIDRs, exact domains, or leading-wildcard domains.

    Documented command
    npm start --

  2. Optionally include documented run settings such as --proxy, --max-cycles, and --max-parallel-tasks.

  3. When stdin and stdout are attached to a TTY, follow the interactive Agent timeline; without --resume, the run starts a fresh session rather than reading an older task graph.

Expected outcome

The agent starts a fresh run under the supplied goal and scope; a TTY enables the interactive timeline.

Guide limitations

  • If --scope is omitted, only IPv4 addresses and CIDRs explicitly present in --goal can be extracted; domain scope must be supplied explicitly. Startup fails if the goal contains no explicit IPv4 target and no scope is provided.
  • The --scope value is the network authorization root; deterministic validation rejects invented or widened ranges.
  • The documented SOCKS5 proxy is a Docker-mode run-level option. SOCKS5 carries TCP; route-matched UDP and ICMP fail closed.
  • Windows has not been validated as a v2 release target.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
4 October 2026
Original website title
SanMuzZzZz/LuaN1aoAgent · Official homepage title · retained in its source language
How we review sourcesSuggest a correction