StrikeAgent_AtkBrain-Flash: an AI pentest console for red team, SRC and CTF runs

What StrikeAgent_AtkBrain-Flash is for

This is an AI penetration testing platform from Yean-Sec (夜安团队), written in Python and licensed AGPL-3.0. The README frames it as an exploration of AI pentesting rather than a general-purpose scanner, and it names one focus explicitly: external attack surface work, described as 外网打点. Three tracks share the console. Red team runs aim at getshell, CTF runs aim at a flag, and SRC runs work from a vendor list toward vulnerabilities. A project can be single-target or a cluster.

The intended user is a practitioner who already has authorization and already has the tooling. The README recommends Kali Linux because the execution layer calls penetration tools that are expected to be present on the machine. Other Debian and Ubuntu systems can bring the console up, but the README warns the tool set may not be complete. That is a real constraint, not a footnote: the agent is a coordinator over local binaries, so an empty PATH produces an agent that plans and cannot execute.

Attack graph, master-worker loop and the memory library

The architecture section describes a console that dispatches reconnaissance and an attack graph that drives a self-loop. A worker finishes a full round, including its role workers, and only then asks the master (御主). It speaks up when it is stuck or when a cycle ends. A human instruction typed into the dialog box interrupts the current round immediately and forces a change of direction. When the round closes, transferable techniques are distilled into a memory library and fed back into the next run.

The reconnaissance runtime is Pi, configured with the model `deepseek-flash`, and the README states plainly that it is not Claude Code. Skills live with the repository, not in a user-global agent directory. At session start the track's skill is copied into the agent workspace under `backend/data/workspaces/<pid>/.agents/skills/`, and Pi loads it with `--skill`. The scheduler starts role workers concurrently by launching Pi processes from Python. Workers are forbidden from opening subprocesses of their own.

One detail worth reading twice: the repository copy of `skills/kali-kit/SKILL.md` uses a `<REPO>` placeholder, and the version the worker actually reads is generated at runtime by `skill_markdown()` in `backend/atkbrain/agents/kali_kit.py`, with `REPO_ROOT` taken as the parent of `backend`. `project_skills.install_into_workspace` overwrites the workspace copy after the transfer. Anyone who hardcodes an absolute path into that file during deployment breaks the mechanism the project built to avoid exactly that.

Installing on Kali and reaching the console

The install path is systemd on Debian-family Kali, and the README's deployment prompt tells the reader not to use Docker as the main path. Start with the system packages. The PDF export libraries are separate because the README notes that omitting them leaves exploitation working while PDF report export fails.

sudo apt update
sudo apt install -y python3 python3-pip python3-dev build-essential \
  nodejs npm curl
sudo apt install -y libcairo2 libpango-1.0-0 libpangocairo-1.0-0 \
  libgdk-pixbuf-2.0-0 libffi-dev shared-mime-info

Pi is a global npm package. The README requires the local `pi --version` to work and a `DEEPSEEK_API_KEY` to be present. Python packages go into the system interpreter with `--break-system-packages`, because the systemd unit runs `/usr/bin/python3` rather than a virtual environment.

sudo npm install -g @earendil-works/pi-coding-agent
pi --version
sudo /usr/bin/python3 -m pip install -r backend/requirements.txt --break-system-packages
cd frontend && npm install && cd ..

Bring the stack up with the project's own scripts. The README states that `frontend/node_modules` must exist before `atkbrain-up.sh` runs, and that starting `python3 -m atkbrain.main` or `npm run dev` in a spare shell will fight the units for ports. The unit names are `atkbrain-flash-backend.service` and `atkbrain-flash-frontend.service`.

sudo scripts/atkbrain-up.sh
sudo scripts/atkbrain-backend.sh restart
sudo scripts/atkbrain-frontend.sh restart

Acceptance is two curl calls and a browser. The health endpoint should return `ok: true` with `claude_sdk.label` reading 「Pi 就绪」; the README notes the field name is still `claude_sdk` even though its meaning is Pi. The frontend should return 200 on port 5001. If either fails, the README points at `backend/data/logs/backend.err.log` and `frontend.err.log` and lists the usual causes: a missing package, a port already taken, `pi` absent from the unit's PATH, or keys that were never snapshotted.

curl -sS http://127.0.0.1:5003/api/health
curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:5001/

Keys are read from the environment and snapshotted by the install script into `backend/data/atkbrain-claude.env` at mode `600`. `DEEPSEEK_API_KEY` is the model key, `ANTHROPIC_AUTH_TOKEN` is accepted as an alias, `ATKBRAIN_PI_BIN` overrides the `pi` binary path, `ATKBRAIN_PI_MODEL` defaults to `deepseek-flash`, and a non-empty `ATKBRAIN_API_TOKEN` makes the API and WebSocket require a token.

The Docker path exists but is not the supported one

The repository ships both a `docker-compose.yml` and a `Dockerfile`, so the claim that Docker is not the main path is about support, not about absence. The compose file runs the backend from `python:3.12-bookworm` on port 5003 and the frontend from `node:20-bookworm` on port 5001, with the frontend pointed at `http://backend:5003` through `ATKBRAIN_API_ORIGIN`. It mounts `./backend` and `./frontend` as volumes and installs dependencies on start.

services:
  backend:
    image: python:3.12-bookworm
    working_dir: /app/backend
    ports:
      - "5003:5003"
    environment:
      ATKBRAIN_HOST: 0.0.0.0
      ATKBRAIN_PORT: "5003"
  frontend:
    image: node:20-bookworm
    environment:
      ATKBRAIN_API_ORIGIN: http://backend:5003
      ATKBRAIN_FRONTEND_PORT: "5001"
    ports:
      - "5001:5001"

The Dockerfile describes itself as a TSecBench hosted image: Debian Bookworm, Python 3.12, Node 22, and a smaller footprint than a full Kali install with common Web, Pwn and Crypto tools preinstalled. It sets `ATKBRAIN_PI_PROVIDER=deepseek` and `ATKBRAIN_PI_MODEL=deepseek-flash` among a long list of model variables, and it expects `DEEPSEEK_API_KEY` to be supplied at runtime rather than baked into the image. The gap between the two paths is the point. The compose file gives you a console; the Kali path gives you a console plus the local penetration binaries the agent is written to call.

Where the design gets in your way

The deployment instructions are the most fragile part of the project, and the README seems to know it. The prompt spends most of its length on what not to do: do not install the repository skills into `~/.claude` or `~/.pi`, do not change the Pi user-level settings to register them, do not install the Claude Agent SDK or MCP because graph tools go through `REPO/pi/extensions/atkbrain-tools.ts`, do not copy the bundled `JSFinder.py` or `bypass-403.sh` into `/usr/bin`, and do not run `which jsfinder` or `which bypass-403`. Those scripts have to be invoked by absolute repository path because the worker's working directory is the project workspace, where relative paths do not resolve.

python3 $REPO/tools/JSFinder/JSFinder.py -u <url> -ou js_urls.txt -os js_subs.txt
bash $REPO/tools/bypass-403/bypass-403.sh http://<host> <path>

That is a lot of implicit knowledge to hold. A deployment that looks healthy can still fail at the first tool call, and the failure surfaces as an agent that cannot find a script rather than as a startup error. Versioning is the second issue. The most recent releases listed are `v0.5.0-beta.2`, `v0.5.0-beta.1` and `v0.4.0-beta.1`, all betas, so anyone expecting a frozen interface should plan for churn. The third issue is scope. This is an external attack surface tool. The README's own framing is 所有努力只聚焦外网打点, and the Pro version the team uses internally is described as deployed across dozens of projects and over a thousand authorized external environments. Nothing here suggests it is the right pick for internal network assessments as a primary use, and the bundled demo report is described as an intranet lab scenario rather than a product claim.

How it compares with a plain agent plus shell

The obvious alternative is running a general coding agent such as Claude Code against a shell and pointing it at a target yourself. The difference is not the model. It is the loop. A general agent has no attack graph, no per-track skill loading, no master-worker round boundary, and no memory library that carries distilled techniques into the next engagement. It also has no interruption model: you stop it, you do not redirect it mid-round.

The cost of that structure is that StrikeAgent_AtkBrain-Flash binds you to Pi as the runtime. The README states the reconnaissance runtime is Pi with `deepseek-flash` and explicitly that it is not Claude Code, and the deployment prompt forbids installing the Claude Agent SDK. If your organization standardized on a different agent runtime, this project does not meet you there. It also means the model choice is narrower than the environment variable list suggests: `ATKBRAIN_PI_MODEL` and `ATKBRAIN_CLAUDE_MODEL` both default to `deepseek-flash`, and the Dockerfile sets the supervisor, evolve and report models to the same value.

Licence and the cost of staying current

The licence is AGPL-3.0. The practical consequence for a security team is the network clause: if you modify the code and expose the modified version to users over a network, the AGPL's source-availability obligation is the thing to read carefully. This is not legal advice, and the terms are worth reading in full before you fork the backend for an internal service. The repository also keeps secrets and state out of git: the README says data, databases, workspaces and keys are written only under `backend/data/`, which is gitignored, and it warns against committing `.env`, `*.db`, workspaces, loot and `atkbrain-claude.env`.

Upgrade cost tracks the beta cadence. Three beta releases landed within two days in September 2026, and the last push to the default branch was on 2026-09-15. Frequent pushes mean fixes arrive quickly and interfaces move. The systemd scripts give you a restart path, but the README does not document rollback, so a version you pin is a version you keep a copy of.

Editorial conclusion

Adopt it if you run authorized external engagements on Kali, you are comfortable with systemd units, and you want an agent loop that pauses for human direction. Do not adopt it if you need a Docker-first deployment, a stable release, or a tool that works without the Pi coding agent and a DeepSeek key. Before trusting a run, verify the health endpoint reports Pi readiness, confirm the frontend answers on port 5001, and check backend/data/logs/backend.err.log when either fails.

Frequently asked questions

Official sources

1. Issues
2. License: AGPL-3.0
3. README
4. Releases
5. Yean-Sec/StrikeAgent_AtkBrain-Flash on GitHub