Recommended Free Tools
OIHK is an early-beta, open-source penetration-testing engine built around a strict rule: a suspected vulnerability is not a finding until a governed tool has actually run successfully and the result has been separately validated. Its author, Broskidev, sums up the principle as “An LLM writing a convincing PoC string is not a finding.”
That evidence-first workflow is what the project means when it says it is not just another GPT wrapper. OIHK uses a planner, specialist agents, a versioned scan plan, and an execution evidence ledger rather than relying on one model to reason through a shell session and write a persuasive report. Its safeguards and performance figures are project claims, however—not independent proof of security or effectiveness.
As an Amazon Associate I earn from qualifying purchases.
What OIHK is—and what “not another GPT wrapper” means
OIHK is software, not a physical pentesting device. Its author describes it as a local, open-source, autonomous multi-agent penetration-testing engine. The repository labels it early beta and licenses it under MIT. The distinction from a simple model-plus-shell setup is architectural: OIHK assigns work to a root planner and specialist roles, and it treats tool execution and validation as prerequisites for reporting a vulnerability.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The project’s design principle is “no evidence, no finding.” That is a description of the intended process, not a guarantee that every run will be correct, complete, or resistant to every failure.
#1 Best Overall
How the agent workflow is organized
Planner and specialist roles
The root planner coordinates the scan, while specialist agents handle stages such as reconnaissance, discovery, validation, and reporting. The current README also identifies attack and privilege-escalation work. The planner cannot close a run while critical work remains open, according to the project documentation.
Revisioned plan and evidence ledger
Agents work from a shared scan plan with revision history and resume support. An evidence ledger holds immutable execution records. In the intended workflow, a model’s suspicion can prompt investigation, but it cannot by itself become a confirmed finding.
Rank #2
Discovery is not validation
A potential issue must be tied to a successful execution through the governed tool surface, an execution record, and separate validation. A plausible proof-of-concept string generated by a model is not enough. This separates the act of proposing a vulnerability from demonstrating and checking it.
Free tools Windows power users keep installed
One-click scans. No signup required.
What safety controls the project describes
OIHK’s author and README describe safeguards enforced by the engine, including passive-mode restrictions, exact target scope, DNS pinning, fail-closed network egress, and sandbox controls. The launch article says active tools are rejected in PASSIVE mode even when invoked through the generic shell; declared hosts are resolved once and DNS-pinned; and network egress is constrained by a netfilter allowlist in a per-run namespace. It also describes a read-only root filesystem, dropped capabilities, no-new-privileges, non-root operation, no sudo surface, and startup aborting when isolation cannot be guaranteed.
Rank #3
These are project-authored descriptions, not an independent security audit. The repository says the operator remains responsible for authorization, safe limits, target availability, data handling, and legal compliance. Use is intended for authorized assessments; safeguards do not make testing an unapproved target acceptable.
What the evaluation figures do—and do not—show
The reported scenario count differs between the project’s launch article and its current README. The launch article, published on August 27, 2026, says it evaluated 16 deliberately vulnerable local scenarios. The mutable README currently describes 24 bundled vulnerable scenarios, spanning areas such as web, API, authentication, source code, and configuration.
The README also reports a 24/24 score, or 100/100, for a deterministic mock solver. That is not a score for a general external model, nor an independent benchmark result. The launch article says the engine scores the model programmatically rather than asking the model to grade itself, but the material available here does not establish a third-party comparison, independently measured effectiveness, adoption level, or production track record.
Models, platforms, and stated requirements
The repository says OIHK accepts OpenAI-compatible endpoints, defaults to LM Studio for local inference, and supports per-role model routing. It also lists cloud-provider presets. This describes interface flexibility; it does not establish the privacy properties of every provider or configuration.
Current README requirements list Windows 10/11 and Linux, with Kali noted as tested; macOS is marked untested. Python 3.12 or later and Docker for scan sandboxing are listed. The project states 8 GB RAM as a minimum and 16 GB as recommended. It says OIHK itself does not require a GPU, while a chosen local model may have its own hardware requirements. These are the project’s stated requirements, not independent compatibility test results.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who should consider OIHK—and what remains unproven
OIHK is most relevant to security practitioners interested in agent orchestration, evidence-gated reporting, and testing an early-beta tool in a controlled, authorized environment. Its central design idea is procedural: require tool-backed execution and a separate validation step before calling something a finding.
That does not establish that the engine catches every vulnerability, that its controls withstand all attacks or misconfiguration, or that it can replace a human penetration tester. The repository marks it early beta and active development; readers should treat the implementation, safeguards, and evaluation claims accordingly.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Sources
- Broskidev’s project launch article on DEV Community
- OIHK repository README
- OIHK repository requirements section
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
