Practical overview
When it fits
Use Cain when conducting an authorized assessment with a defined target scope and a need for a structured CLI workflow and report artifacts.
Who it is for
- Security practitioners running authorized assessments of enterprise assets or bug-bounty targets.
- Cloud security teams assessing supported provider environments.
- Teams that want assessment findings and evidence summaries in Markdown and JSON.
Documented uses
- Run an AI-assisted penetration-testing workflow against an explicitly scoped target.
- Assess cloud environments across the six named providers.
- Produce findings, evidence-chain digests, validation summaries and remediation advice for review.
Requirements & limits
Cain is distributed through a public GitHub repository under the Apache-2.0 license. It is installed locally as a Python CLI.
- The default backend is Claude; the optional pi backend requires Node.js 20 or newer and a one-time bridge installation.
- Provider credentials and model configuration are required according to the selected pi provider.
- The optional
[cloud]extra adds AWS S3, Huawei OBS and Kubernetes checks. - Assessment output is written to a workspace
report/directory and includes Markdown, aggregate JSON and validation-summary JSON.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Install Cain and verify the CLI
Install Cain in editable mode and check that its command-line entry point responds.
Before you start
- A local environment capable of cloning the GitHub repository.
- Python package installation with pip or uv.
Steps
Clone https://github.com/cdxiaodong/cain-agent and change into the cain-agent directory.
Install the project with the command below or the command below.
pip install -e .uv pip install -e .Run
cain-agent --versionto verify the CLI entry point.
Expected outcome
The project is installed in editable mode and the CLI version command has been run.
Guide limitations
- This guide covers installation and the CLI check only; it does not configure an AI backend or run an assessment.
Start a scoped assessment
Run Cain against an authorized target with an explicit time budget using its default Claude backend.
Before you start
- Cain installed and its default Claude backend configured for use.
- Authorization to assess the target.
Steps
Choose the authorized target and set it as the
--targetvalue.Run
cain-agent run --target https://app.example.com --total-budget 1800, replacing the example URL and budget as appropriate.Review the completed run’s
report/directory in the workspace forreport.md,aggregated-report.jsonandvalidation-summary.json.
Expected outcome
Cain runs the assessment with the target recorded in `scope.yaml` and provides the documented report artifacts when the run finishes.
Guide limitations
- The documented command uses the default Claude backend; alternative backend and provider setup is separate.
- Only assess targets for which authorization has been obtained.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 5 November 2026
- Original website title
- cdxiaodong/cain-agent · Official homepage title · retained in its source language