Practical overview
When it fits
Use it when an authorized assessment needs a coordinated Claude Code workflow with explicit target scoping and multiple security-testing domains.
Who it is for
- Security teams conducting authorized penetration tests
- Practitioners running controlled internal assessments
- Teams combining offensive testing, DFIR and reporting workflows
Documented uses
- Coordinate reconnaissance through reporting in one assessment session
- Route findings to specialist exploitation and security-testing agents
- Support post-exploitation, threat hunting and DFIR activities
- Produce vulnerability reports with CVSS-oriented scoring
Requirements & limits
The repository is public, active and MIT-licensed. The documented access paths use Claude Code with either a marketplace installation, a cloned repository or the --plugin-dir option. No pricing or account requirement is provided.
- It requires Claude Code rather than functioning as a standalone web application.
- Target scope is configured through scope.txt and the repository describes scope checks for network commands.
- The workflow spans 27 agents and 754 MITRE-mapped skills, with tools varying by security domain.
- The documented setup includes an attacker IP in .claude/settings.json.
- The project is intended for authorized security testing.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Set up Threatswarm for a scoped assessment
Prepare the documented Claude Code plugin configuration and authorized target scope.
Before you start
- The Threatswarm repository
- Claude Code
- Authorized targets
- An attacker IP address
Steps
Clone the Threatswarm repository or load it with Claude Code using the documented plugin directory path.
Add authorized target addresses or domains to scope.txt.
Set the attacker IP in .claude/settings.json under LHOST.
Start Claude Code and load the Threatswarm plugin.
Expected outcome
The plugin is configured with a target scope and attacker address for the documented assessment workflow.
Guide limitations
- This recipe covers setup only; it does not verify execution or compatibility.
- Organization-specific scope-policy configuration is described as Likely compatible, not demonstrated.
Compare options for Agent orchestration
These projects document a common task and share a project role. This is a source-based comparison, not an execution benchmark or a guarantee of interchangeability.
| Project | Documented purpose | Platform | Access and requirements |
|---|---|---|---|
| Threatswarm | Coordinate reconnaissance through reporting in one assessment session | CLI, Desktop, Self-hosted | The repository is public, active and MIT-licensed. The documented access paths use Claude Code with either a marketplace installation, a cloned repository or the --plugin-dir option. No pricing or account requirement is provided. |
| Redcell | Coordinate planning and execution across LLM security agents | Cloud, Docker, Linux, Server | The repository is public and identified as MIT-licensed. The documented quickstart requires Docker, uv and bun. The project warning restricts use to education, research and legal, authorized security testing within an agreed scope. |
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 4 October 2026
- Original website title
- mukul975/Threatswarm · Official homepage title · retained in its source language