Senshi (戦士)

AI-powered SAST + DAST security scanner for bug bounty hunters

Senshi uses LLMs to generate context-aware payloads, analyze responses intelligently, eliminate false positives, and chain findings into exploitable attack paths — all from a single CLI.

Created by Manthan Ghasadiya — creator of mcpsec (4 CVEs including CVSS 10.0) and igris.

Why Senshi?

Traditional scanners fire generic payloads and drown you in false positives. Senshi is different:

• 🧠 AI-First — LLMs generate payloads tailored to the target's tech stack and context
• 🚫 FP Elimination — A skeptical 2nd-pass AI reviewer slashes false positives
• 🔗 Chain Builder — Links individual findings into high-impact exploit chains
• 📋 Bounty Reports — LLM writes your HackerOne/MSRC submission for you
• 🔌 Provider Agnostic — DeepSeek, OpenAI, Groq, Ollama, Anthropic — your choice

Features

Installation

pip install senshi

Or from source:

git clone https://github.com/manthanghasadiya/senshi.git
cd senshi
pip install -e ".[dev,browser,websocket]"

Quick Start

1. Set your API key

export DEEPSEEK_API_KEY="sk-..."
# or: export OPENAI_API_KEY="sk-..."
# or: export GROQ_API_KEY="gsk_..."

2. Scan

# Autonomous Black-Box Pentest (v0.5.0)
senshi pentest https://target.com --provider deepseek --browser --verbose

# DAST \u2014 scan live targets
senshi dast https://target.com --provider deepseek

# With auth + Burp proxy
senshi dast https://target.com/api \
  --auth "Cookie: session=abc" \
  --proxy http://127.0.0.1:8080

# Specific scanners only
senshi dast https://target.com --modules xss,ssrf,injection

# SAST — analyze source code
senshi sast ./my-project
senshi sast https://github.com/user/repo.git

# Recon only
senshi recon https://target.com --depth 3

# Browser-based recon (captures XHR/fetch traffic)
senshi recon https://target.com --browser --output endpoints.json

# DAST with pre-discovered endpoints
senshi dast https://target.com --endpoints endpoints.json

# Generate payloads
senshi payloads --vuln xss --target "POST /api/chat" --param message

# Generate bounty report from findings
senshi report findings.json --platform hackerone --output report.md

CLI Reference

SAST Scanners

Output Formats

• JSON — Machine-readable, re-importable with senshi report
• Markdown — Human-readable with severity indicators and evidence blocks
• SARIF — CI/CD integration (GitHub Code Scanning, Azure DevOps)
• Bounty Report — LLM-written submission tailored to your platform

Supported LLM Providers

Architecture

Architecture

Senshi operates on an autonomous Think \u2192 Act \u2192 Observe loop, building context across iterations:

graph TD
    Start([senshi pentest]) --> Recon[Automated Recon]
    Recon --> Loop
    
    subgraph Agent Loop
    Loop((Pentest Context)) --> Think[AgentPlanner: Decide Next Action]
    Think --> Act[ActionExecutor]
    Act --> Scanners[DAST Scanners]
    Act --> Browser[Browser Exploiter]
    Act --> Custom[IDOR / WS / Auth]
    Scanners --> Observe[Analyze & Update Context]
    Browser --> Observe
    Custom --> Observe
    Observe --> Loop
    end
    
    Think -->|Task Complete| PoC[PoC Generation]
    PoC --> Report([Final Report & Chains])

Development

git clone https://github.com/manthanghasadiya/senshi.git
cd senshi
pip install -e ".[dev]"

# For browser recon support
pip install -e ".[browser]"
playwright install chromium

pytest tests/ -v

See CONTRIBUTING.md for details.

Legal

[!CAUTION] Senshi is intended for authorized security testing only. Only scan targets you have explicit written permission to test. Unauthorized scanning is illegal. See SECURITY.md.

License

MIT License — see LICENSE for details.