RedAmon

Overview

RedAmon is a self-hosted AI red-team framework for security practitioners coordinating authorized testing. It suits teams that want reconnaissance, scanning and agent-driven operations in one Dockerized workflow; its breadth is appealing, though the macOS LAN-scanning constraint and unencrypted credential storage demand care.

Its defining strength is the route from parallelized reconnaissance into an attack-surface graph that an AI agent can query for planning and exploitation. Network, secret and offline supply-chain scanning extend that workflow, while scope controls address some of the risks inherent in automating offensive work.

RedAmon is intended for authorized security testing, education and research. Rules of Engagement, approval gates and non-bypassable scope controls help govern operations, and a guardrail blocks government, military and intergovernmental targets. These safeguards do not replace the operator’s responsibility to obtain authorization.

Key features

Reconnaissance and agent planning

The parallelized pipeline maps domains, IP/CIDR targets and batches of domains. Findings are merged into a Neo4j attack-surface graph for the AI agent to query when planning and exploiting. Connecting discovery to agent planning makes RedAmon more suited to coordinated operations than a scanner used in isolation.

Scanning and detection

GVM/OpenVAS integration brings network vulnerability scanning backed by more than 170,000 NVTs. The Secret Multiscanner covers 1,060 detectors across 14 sources, with optional live API verification. Supply-chain scanning checks for malicious and vulnerable packages offline against a local OSV database. Together, these capabilities cover several parts of an assessment without requiring each check to be treated as a separate product.

AI and external agents

One interface supports twelve AI providers and more than 400 language models. The MCP Server lets external agents—including Claude Code, Claude Desktop, Codex CLI, Cursor, Windsurf, Cline, Goose and Gemini CLI—drive RedAmon. That flexibility suits teams already working through those agents, but the framework’s value depends on a deliberate setup of providers and operating controls.

Isolation and governance

Tools, scanners and agents run in separate containers with per-job ephemeral filesystems and network namespaces. This provides meaningful separation between jobs. However, configured API keys and credentials are stored unencrypted in PostgreSQL, and securing that database remains the user’s responsibility. That is a material deployment concern for any team storing sensitive provider or target credentials.

Pricing

RedAmon’s Open-source self-hosted plan costs nothing. It includes the MIT license, Docker stack, and commercial and personal use. The plan is on-prem, which suits teams that want to operate the framework themselves rather than rely on a hosted deployment.

There is no paid tier to compare: the offering is free, and no seat or usage quota is stated. The trade-off is operational responsibility. Teams must run the stack and secure its database, especially because stored API keys and credentials are unencrypted.

Platforms

RedAmon is available as an API, web app and self-hosted deployment, with support for Linux, macOS and Windows. The Dockerized application runs on all three operating systems. On macOS, however, SYN-based scanners cannot see the local LAN because they run inside Docker Desktop’s LinuxKit VM. Teams whose assessments depend on local-LAN SYN scanning should choose another environment or tool for that work.

Web app testing, API testing, network testing and finding management are supported. This makes RedAmon relevant to teams covering multiple target types, subject to the macOS scanning limitation.

Who it's for

RedAmon is a strong fit for security teams and practitioners who can operate a Docker stack and want to connect reconnaissance, vulnerability checks and AI-driven operations in one self-hosted framework. Its governance controls make it a more considered choice for authorized work than an unconstrained agent workflow, but do not remove the need for authorization and oversight.

It is a weaker fit for teams unwilling to manage database security, or for macOS operators who need SYN-based scans of their local LAN. The credential storage warning should be treated as a deployment requirement, not a minor caveat.

Pros and cons

• Pros: A pipeline connects parallel reconnaissance to a queryable Neo4j graph for agent planning and exploitation.
• Pros: Network scanning, broad secret detection and offline supply-chain checks cover distinct assessment needs in one framework.
• Pros: Twelve AI providers, more than 400 models and MCP support offer flexibility for teams using external coding and AI agents.
• Pros: Per-job container isolation and explicit scope controls provide useful operational safeguards.
• Cons: API keys and credentials are stored unencrypted in PostgreSQL, leaving database security to the operator.
• Cons: Docker Desktop’s LinuxKit VM prevents macOS SYN-based scanners from seeing the local LAN.
• Cons: Self-hosting means the team must run and secure the deployment itself.

Alternatives

Choose AgentSeal if a focused MCP security tool is a better fit: its free plan includes 30 basic probes, an MCP registry, Guard and Watch. OpenSecureAI Scanner is worth comparing when API scanning and hosted AI remediation are the priority; its Pro plan costs $49 a month and includes 50,000 API requests per month, a 120 requests-per-minute limit per key, hosted AI remediation, LLM Gateway completions and priority email.

Promptfoo is a relevant alternative for teams focused on LLM evaluation and red-teaming: its Community plan costs nothing, includes 10k red-team probes per month and can run locally or self-hosted. garak is another free, open-source option for teams seeking a tool available on Linux, macOS, self-hosted environments and Windows.

Confident AI, Darkhunt AI Security, Giskard and NVADER are also alternatives to consider.

Verdict

Choose RedAmon if you need a free, self-hosted framework that links reconnaissance, scanning and AI-driven red-team operations, and can take responsibility for deployment security. Its breadth and governance controls are compelling for authorized security work. Look elsewhere if unencrypted database credentials are unacceptable or macOS local-LAN SYN scanning is essential.