WHAXON

WHAXON is a framework for authorized penetration testing. Point it at a target. It chains your tools, correlates what they find, optionally assists with AI, and produces an accurate report — deterministically, with every AI action gated by a human-approved executor.

Three things it does that most tools do not

Deterministic auto-chaining. When nmap finds an HTTP port on 127.0.0.1:8090, WHAXON queues nikto against that specific port automatically. Rule-based, no LLM in the loop. Turn it off with WHAXON_AUTOCHAIN=false.

Cross-tool correlation. nmap says port 8090 is open. nikto says /login.php is on 8090. WHAXON emits a web_login_surface finding that says both, because that is what a pentester wants to know. Eight rules today, all deterministic, all testable offline.

AI with hard guardrails. An optional AI layer proposes the next action. A deterministic executor validates every proposal before anything runs: catalog check, scope check, target lock, dedup guard, stagnation stop. The planner proposes; the executor disposes.

Try WHAXON in 60 seconds

pip install whaxon
whaxon init --demo
whaxon run nmap scanme.nmap.org --extra "-F -T4"

That last command scans scanme.nmap.org — a public host Nmap's authors maintain specifically for people to test their scanners against. You get:

[2 findings]
  [MEDIUM  ] open_port  22/tcp  open  ssh    OpenSSH 6.6.1p1
  [INFO    ] open_port  80/tcp  open  http   Apache httpd 2.4.7

job: 9a52ab3c5b7b
report: whaxon report 9a52ab3c5b7b

Then:

whaxon findings scanme.nmap.org        # every finding against that target
whaxon report 9a52ab3c5b7b --open      # view the report

The demo scope permits only 127.0.0.1, ::1, and scanme.nmap.org. Try google.com and it will refuse — that is what fail-closed scope looks like.

Status

v0.9.0 — deterministic pipeline, cross-tool correlation, session transports, optional AI with executor guardrails, four working interfaces.

Working now

Feature	Status
Headless core (catalog + runner + event bus)	Working
Terminal interface (Textual)	Working
Desktop interface (PySide6 + QWebEngineView)	Working
Web interface (Flask + SSE + Basic auth)	Working
Production WSGI server (whaxon serve --daemon)	Working
Tool catalog with argument templates	Working (21 tools + echo test fixture)
Adapter layer	Working (25 adapters)
Enriched findings (CVSS, CWE, impact, remediation)	Working
Fail-closed scope enforcement	Working
Deterministic auto-chain (nmap -> nikto per web port)	Working
Correlation engine	Working (8 rules)
Pivot chain graph + rendering	Working
Burp XML import	Working
SQLite persistence across all interfaces	Working
Reports (per-job MD/HTML/PDF + engagement MD/JSON/PDF)	Working
Evidence attachments	Working
Metasploit RPC integration	Working
SSH transport	Working (live-verified)
SMB transport	Working (live-verified)
WMI transport	Working (mocked)
Phase-gated catalog	Working
Session-scoped tools	Working
AI layer (null / rules / Ollama / OpenAI / Anthropic / Google)	Working, opt-in
AI modes (interactive / --auto / --resume)	Working, opt-in
Approval queue (store + API + web UI + CLI)	Working
Plugin API (entry-point adapters)	Working
HAR ingestion (browser traffic capture)	Working (bounty add-on input layer)
Published to PyPI
Test suite	620 passing

Planned

Install

pip install whaxon

Optional extras:

pip install "whaxon[tui]"           # Terminal UI (Textual)
pip install "whaxon[gui]"           # Desktop app (PySide6)
pip install "whaxon[web]"           # Web interface (Flask)
pip install "whaxon[metasploit]"    # Metasploit RPC client
pip install "whaxon[tui,gui,web]"   # Everything

Then:

whaxon init                # create data/ with strict default scope
whaxon tui                 # Terminal UI (Textual)
whaxon gui                 # Desktop app (PySide6)
whaxon serve --daemon      # Production web server
whaxon web                 # Web, foreground (dev)

Quick start (from source)

git clone https://github.com/andreipath26/WHAXON.git
cd WHAXON
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[tui,gui,web]"

Requires Python 3.11+.

whaxon init                # create data/ with strict default scope
whaxon tui                 # Terminal UI (Textual)
whaxon gui                 # Desktop app (PySide6)
whaxon serve --daemon      # Production web server
whaxon web                 # Web, foreground (dev)

Web UI: http://127.0.0.1:5001/ui

Configuration

Change the auth credentials before exposing WHAXON on any network.

Adapters

Every tool can have an adapter — a Python class that parses its output and enriches findings.

Built-in (25): arjun, burp, dig, dnsrecon, ffuf, gobuster, har, hashcat, impacket, msf, msf_getuid, msf_hashdump, msf_sysinfo, netexec, nikto, nmap, nuclei, smb_ls, smb_shares, sqlmap, theharvester, whatweb, whois, wmi_exec, wpscan.

Catalog tools without an adapter still run; their output just isn't enriched.

See docs/adapters.md for the built-in adapter layer.

For shipping an adapter as a separate pip package, see docs/plugins.md.

Scope

Fail-closed. Missing data/scope.json gets a strict default on first load. Unreadable config raises.

whaxon scope --show
whaxon scope --check <target>
whaxon scope --set scope.json
whaxon scope --enable / --disable
whaxon scope --clear

See docs/scope.md.

Interfaces

• Terminal (whaxon tui): r run, x cancel, g chain, s save report, i target input, a AI runs, Ctrl+Q quit.
• Desktop (whaxon gui): native window hosting the web UI in a QWebEngineView.
• Web (whaxon serve --daemon): Flask + SSE. API + browser UI at /ui.
• CLI: 21 subcommands — see docs/interfaces.md. Includes:
  • whaxon lookup — offline exploit search via searchsploit (search, --cve, --id, --save)
  • whaxon cve — online CVE lookup via NVD with a local SQLite cache (exact ID, --keyword)

Reports

whaxon report <job_id>                              # Per-job, Markdown
whaxon report <job_id> --format html                # Per-job, HTML
whaxon report <job_id> --format pdf --out scan.pdf  # Per-job, PDF
whaxon report --engagement default --format md      # Engagement, Markdown
whaxon report --all --format whaxon                 # Engagement, signed .whaxon
curl -u whaxon:whaxon "http://127.0.0.1:5001/api/report?format=md"   # Engagement via HTTP

HTML output is escaped — a raw_line with <script> can't execute in a browser.

Roadmap

WHAXON is a solo-founder project. Scope is tracked in full on the founder's Desktop roadmap; this section is the summary.

Shipped (v0.9.0)

• Deterministic pipeline, cross-tool correlation (8 rules)
• Four interfaces: CLI, TUI, Web, GUI
• Four transports: MSF, SSH, SMB (live-verified), WMI (mocked)
• Six AI providers, three AI modes (interactive, --auto, --resume)
• Approval queue, phase-gated catalog, session-scoped tools
• CVE lookup (NVD) and offline exploit search (searchsploit)
• 21 tools + echo test fixture, 25 adapters
• HAR ingestion adapter (browser traffic capture — bounty add-on input layer)
• Bug-bounty add-on design (§26, docs/bounty-addon.md) — per-program policy, differential analysis, invariant engine, workflow inference
• 612 tests passing

Urgent (next)

• UI redesign. All four interfaces, unified design system. Design mockup complete. Web UI rebuilt to ui-v4 (session 59). TUI, GUI, and CLI passes queued.
• PTaaS delivery layer. Client portal, self-service scoping, on-demand test launches.

Near-term (~271h)

• Deferred items from v0.9.0
• Full tool adoption: 21 to 120 tools (Tier 1 = 44, Tier 2 = 42, Tier 3 = 14)
• Cloud scope design and first cloud tool
• Distro portability (beyond Kali/Debian)
• AI modes: confidence-gated auto-approval, escalation path, budget caps
• Bug-bounty add-on implementation (§26.1–§26.8): policy layer, differential session analysis, invariant engine, workflow inference, report generation
• Five web UI backends: Retest finding lifecycle; Monitoring scheduled recon + diff; Audit Log append-only hash-chained events; Threat Intel routes over existing whaxon cve / lookup; Compliance framework mapping from finding kind

Team-ready (~53-62h)

• MCP server - expose the catalog via Model Context Protocol so Claude Desktop, Cursor, and Codex can drive WHAXON. The keystone for team work.
• Verification layer - findings become candidates, then verified or refuted
• Persistent knowledge graph, multi-agent split, RAG for pentest knowledge
• Team-scale approvals with role gating

Company-grade (~125-170h)

• Organization layer: orgs, teams, users, engagements
• RBAC: Owner, Admin, Pentester, Reviewer, Client-viewer, Auditor
• Client engagement lifecycle, compliance and audit (immutable log)
• Deployment: Docker, Kubernetes, air-gapped, cloud
• Commercial layer: licensing, billing, support tooling

Market coverage (~185-235h)

• PTaaS delivery, remediation tracking, ASM / continuous monitoring
• Client reporting, compliance framework mapping
• Collaboration, threat intel, training mode, i18n, air-gapped
• Full CSPM / CIEM, BAS / AEV

Explicitly out of scope (never built)

Wireless, SDR, forensics, reverse-engineering, malware analysis, social engineering, hardware, unstructured network attacks, mobile, honeypots, commercial scanners without CLI parity.

Sister projects

WHAXON is one of three projects built to compose:

• KILN — the fastest local LLM runtime. One binary per platform, one model file, one API. No cloud, no GPU required.
• Aletheia Framework — the advisor framework. Local-first, modular, governed personal AI. Indexes everything, remembers with provenance, advises — never acts without authorization.

WHAXON is the deterministic domain expert in that stack: KILN provides local inference, Aletheia provides memory and governance, WHAXON provides the security testing pipeline.

Each project stands alone. None requires the others to run. Integration between them (MCP/ACP) is designed but not yet built.

Testing

python -m pytest tests/ -q

612 tests passing.

Documentation

docs/ — getting started, architecture, adapters, plugins, tools, scope, interfaces, findings, reports, API, deployment, troubleshooting, changelog.

Responsible use

Authorized testing only. Use on systems you own or have explicit permission to assess.

Licensing

AGPL-3.0-or-later. See LICENSE-COMMERCIAL.md and LICENSE-ENTERPRISE.md.