Project - Swarm AI
The following project is based on this work
Armur-Ai
This is being a pain in the butt. However progress is being made.
It is now working just fine. The bugs have been ironed out.
However compared to the recent work on Spiderfoot, I just dont see the intelligence being offered that Spiderfoot can offer.
I mean its doing its job but - well - I just dont know
It just is not there yet.
Work in progress but at the moment this project is dropping down my list of priorities in a major way. So the AI and I are having a conversation.
That resulted in something like this. An improvement no end
Without breaking the original intent of the source respository where can we go with this that offers a service that Spiderfoot does not, and can we actually add this service to Spiderfoot as it uses an entire different mechanism to spiderfoot.
Where the fork stands right now:
70 commits ahead of upstream master. Still pulling the other direction too when it's warranted — cherry-picked upstream's OWASP/CWE and MITRE ATT&CK taxonomy work straight into this fork.
A real production deployment path, not just a dev script. A hardened Podman/Portainer stack (read-only containers, dropped capabilities, non-root) alongside the existing Docker dev stack, and a GHCR pipeline so images actually ship somewhere Portainer can pull from — turns out a private git repo can't serve that role no matter how the compose file is written. Every image is linked back to this repo's own GitHub page, not left anonymous in a personal namespace.
Postgres persistence, ASM (scheduled recon + auto-triggered campaigns on real change), authorization gates that mean something
— a scan, a playbook run, a recurring watch all require an explicit, recorded confirmation now, not a line of text you could skim past.
The bug worth writing about
Dashboard came up blank one day — no crash, no error. The campaigns table in Postgres was genuinely empty. Root cause: the scope-validation layer — the thing that's supposed to stop the swarm touching anything outside an authorized target — only recognized full domains and IP addresses. A bare internal hostname never matched that pattern, so it
wasn't rejected, it was invisible to the check. Something reached the platform's own database through that gap and wiped it.
Fixed with an explicit, unconditional block on this stack's own infrastructure that sits in front of scope checking — can't be argued around by whatever a campaign's scope happens to allow. Slightly ironic that a pentesting tool's first serious incident was against itself.
Better here than somewhere that matters.
The more interesting problem: data nobody could read
Fixing that bug surfaced a bigger one, and it's the one actually worth explaining. Every campaign was producing real findings — but the dashboard showed a severity badge, a CVSS number, and a category string. Nothing else. You'd need to be a data analyst to figure out where the actual problems were. Meanwhile the report-generation agent
was already building an Executive Summary, a Risk Summary, a full Attack Narrative, a prioritized Remediation Plan, and OWASP/CWE/MITRE ATT&CK classification per finding — all of it correct, all of it useful — and all of it trapped inside a file you had to separately download and open elsewhere. The live product and the actual intelligence had quietly diverged.
That's the real commitment behind this fork, stated plainly: staying true to what this project is — an autonomous swarm doing real recon, classification, exploitation, and reporting — while making sure the output is something a network administrator or a security engineer recognizes and trusts on sight, not something that needs translating
first. A correct tool nobody can read isn't finished.
Fixed by bringing the synthesis into the live dashboard instead of leaving it in a download:
- Every finding now carries its OWASP/CWE/ATT&CK tags and a
confidence/false-positive-likelihood indicator inline, expandable for
the full description and copy-pasteable reproduction steps — command,
raw HTTP request, or what to expect when it re-triggers. - A campaign's page now has a live Report tab — the same Executive
Summary, Risk Summary, Attack Narrative, and Remediation Plan that
used to only exist in a downloaded file, rendered the moment a
campaign finishes. - Findings are grouped by campaign and ranked worst-first, not flattened
into one undifferentiated list.
Still open
- Playbooks don't yet enforce their own declared tool sequence —
tracked, not fixed. - A known crash in one exploitation tool under specific conditions — fix
designed, not yet built.
No new capabilities until those two are closed. Fundamentals first — and now, legibility counts as a fundamental too.
More soon.
How much effort do I put into this.
#enoughsaid