Suijin

Your team of fully autonomous web app pentesters and red teamers for any situation.

You tell it what to test. It maps the product landscape, spawns the right specialists for each vulnerability class, discusses attack surfaces with the other sessions, shares confirmed findings with the team automatically, and gets hacking. It runs the engagement — recon, exploitation, post-exploitation, report — like a pentester who never gets tired, never skips the boring surfaces, never tunnels-visions on one endpoint while 90% of the target sits untested, and proves every finding by running the exploit before claiming it, all while you supervise from an Operator Console watching over what everyone on the team is doing.

Who it's for

• Bug bounty hunters who can load the program rules, point Suijin at in-scope targets, and get back verified findings — not "the model thinks there's an IDOR here," here's the POC, the output, the marker.
• Pentest teams running authorized engagements. One agent per target, or a whole team on one target — they split lanes, share dead ends, and never re-burn a payload a peer already ruled out.
• CTF players. Flip the profile and the doctrine changes: the flag is the objective, a confirmed bug is a stepping stone, persistence prioritised over tidiness.
• Security researchers who want an agent platform that grades itself — onboard labs with chain-verification tests and bench scoring, so "did my change make the agent better" is a number, not a vibe.

What a run looks like

1. Start it.

suijin lab up

suijin
(mode: type 1)
target: 127.0.0.1:6000

It maps the surface, probes, exploits, escalates to as far as it can go, and writes the report — narrating its reasoning in your terminal the whole way. You can interrupt at any point to redirect it; it can pause between turns, resume saved runs, and pick up an engagement weeks later from its .sje snapshot.

2. Or start a team. Open one terminal per agent. Sessions on the same target find each other, introduce their lanes, and coordinate — while agents on different targets are kept strictly apart.

3. Watch from one screen.

suijin operator

Every running agent on one dashboard: live cards, iteration history, confirmed exploits, the team's chat. Keyboard-first — tab cycles panels, j/k pages the roster, ←→ walks any agent's iteration history. The input box is a command line:

4. Trust the output. A finding only counts when its POC ran and the target produced the expected marker — unique, target-derived strings; 200 OK proves nothing. No match means the exploit comes back with every command and output attached so you can fix or drop it. A finding without a cataloged POC is a rumor. Confirmed findings capture their verifying output as tamper-evident, content-addressed evidence — the report re-hashes every proof at generation time and flags drift, so what you submit is provably what you verified. And severity is honest by construction: the system caps claims whose evidence only shows information-class output.

4a. The system catches what the model misses. Every HTTP request feeds an observation engine that deterministically detects IDOR and access control gaps from accumulated evidence — different credentials getting different responses for the same object surfaces as a finding the model can't ignore. When a vulnerability class is detected, sub-agents get the specialist's doctrine: the IDOR expert tests cross-account systematically, the injection expert knows the filter evasion playbook. And when the agent tunnels on one endpoint, the breadth alert tells it to rotate: "68% of your last actions target Search & Redirectors. 5 product families untested. Pick one."

5. Come back tomorrow. Suijin remembers: blocked patterns, WAF rules, false positives, dead batteries, what worked where. The next engagement — same target or same tech — starts with all of it and skips the graveyard. Resumed runs scrub verified-dead credentials from carried state — a key that was SERVICE_DISABLED yesterday doesn't come back as today's "discovery."

6. Or run it in a box.

suijin box

A sealed linux container that runs Suijin and its tools with your device untouched — build once, enter, work inside. See The Box section below for the full command set, engine choice, and bring-your-own-container.

Comparison

Safety first

New to it — or new to the agent? Run it against the onboard lab: a multi-service target (15 named services behind a gateway/auth/core plane, ~100+ vulnerability instances, cross-service chains, decoys, 22 flags) that runs on your machine. Sharpen against something that can't get you arrested.

suijin lab up
suijin
press 1
press 1
target: 127.0.0.1:6000

Quick start

# one command (macOS / Linux)
curl -fsSL https://raw.githubusercontent.com/0xwi11iam/Suijin/main/install.sh | bash

# first engagement
suijin engage "http://127.0.0.1:6000 — full assessment"

# watch every agent from one screen
suijin operator

# pipx / uv (installable package)
pipx install suijin

# with the Neo4j knowledge-graph backend (json is the default)
pipx install "suijin[kg]"

# manual
git clone https://github.com/0xwi11iam/Suijin
cd Suijin && pip install -e .

# dev install (live local copy)
pip install -e ".[dev]"

The Box

suijin box          # the manager tui — or use the verbs directly

The Box is a sealed linux container that runs Suijin and its whole toolchain. Your device stays untouched: nothing installs on the host beyond Suijin itself, engagements live on the box's own disk, and the agent, its tools and its network activity all stay contained. Bare suijin keeps working exactly as before — the box is a choice, not a migration.

Engines. OrbStack on macOS, Docker on every other platform — full compatibility with both. When both are installed the first screen lets you pick with the arrow keys (the choice persists). A Linux user with Docker is never asked anything. On machines where another tool hijacks the docker CLI, pin the daemon with SUIJIN_DOCKER_CONTEXT or container.docker_context in config — Suijin shows which daemon it's using in suijin box status.

The commands.

suijin box build      # create + provision (kali, suijin, 40+ tools) — resumable
suijin box            # manager tui: live build screen, drift, tools, destroy
suijin box enter      # drift check → the Suijin menu inside the box
suijin box shell      # straight into a bash shell inside the box
suijin box status     # one-glance state: engine, sync, tools
suijin box refresh    # re-sync host config/packs/prompts → box
suijin box stop       # stop it (data kept)
suijin box start      # start it again
suijin box destroy    # archives engagements to the host, typed confirm

Bring your own container.

suijin box adopt <name>    # provision Suijin into a container you already run
suijin box unadopt         # back to the managed box

Adopting is the escape hatch for any setup the managed box doesn't like: Suijin provisions into your container — base packages, an editable install, the toolchain — and never deletes it. Destroy on an adopted container removes only Suijin's footprint inside (the workspace, the tools, the profile drop-in); the container survives.

What you get, guaranteed.

• one-way sync: your config, packs, prompts and provider keys flow into the box; nothing the box generates ever flows back
• every tool lands on PATH in every shell — login, interactive, box shell (pip user bins, Go bins, the gcloud SDK, sbin)
• the toolchain installs from declared fallback chains (apt → pip/go/vendor) with clean row-by-row output, and builds resume per stage and per tool
• entering detects drift against the last sync and offers to fix it
• TLS-intercepting networks (school/corporate filters) just work: your host trust anchors install into the box automatically
• suijin box build after a host git pull is active in the box instantly (editable, live-mounted)

Config keys (in config.json under container, all optional):

Environment overrides: SUIJIN_CONTAINER_ENGINE, SUIJIN_DOCKER_CONTEXT.

_{Authorized security testing only.
On a more serious note, never point Suijin at a system you do not own or lack written permission to test. Unauthorized access is illegal — you accept full responsibility for what you run.}

_{Licensed under AGPL v3.0 · Suijin · By 0xwi11iam(William Jiang)}