Guardian AI-Penetration Testing Tool Connects Gemini, GPT-4 with 19 Security Tools Including Nmap

Guardian AI-Penetration Testing Tool A new open-source framework is reshaping how security professionals approach penetration testing by placing multiple large language models directly at the helm of automated security assessments.

Guardian, developed by Zakir Kun and available on GitHub, is an enterprise-grade AI-powered penetration testing automation framework that orchestrates OpenAI GPT-4, Anthropic Claude, Google Gemini, and OpenRouter in a unified multi-agent architecture designed to deliver intelligent and adaptive security assessments with complete evidence capture.

Guardian’s design philosophy focuses on teamwork among agents. Instead of using AI as a passive helper, it uses four specific agents: Planner, Tool Selector, Analyst, and Reporter. These agents work together during each project to achieve the best results.

The Planner agent defines the assessment strategy, the Tool Selector determines which of the 19 integrated security tools to invoke, the Analyst interprets findings and suppresses false positives, and the Reporter generates professional-grade documentation.

This pipeline enables the framework to adapt its tactics dynamically based on discovered vulnerabilities and system responses, simulating the decision-making of an experienced human pentester.

19-Tool Arsenal with Intelligent Orchestration

Guardian integrates 19 battle-tested security tools across key domains, including network scanning with Nmap and Masscan, web reconnaissance via WhatWeb, and Wafw00f, subdomain discovery through Subfinder, Amass, and DNSRecon, vulnerability scanning with Nuclei, Nikto, SQLMap, and WPScan, SSL/TLS analysis using TestSSL and SSLyze, content discovery via Gobuster, FFuf, and Arjun, and advanced security analysis through XSStrike, GitLeaks, and CMSeeK.

ToolCategoryPurposeNmapNetworkComprehensive port scanning and service detectionMasscanNetworkUltra-fast large-scale port scanning class="has-text-align-left" data-align="left">Web ReconnaissanceHTTP probing and response analysisWhatWebWeb ReconnaissanceTechnology fingerprintingWafw00fWeb ReconnaissanceWeb Application Firewall (WAF) detectionSubfinderSubdomain DiscoveryPassive subdomain enumerationAmassSubdomain DiscoveryActive and passive network mappingDNSReconSubdomain DiscoveryDNS enumeration and analysisNucleiVulnerability ScanningTemplate-based vulnerability scanningNiktoVulnerability ScanningWeb server vulnerability scanningSQLMapVulnerability ScanningAutomated SQL injection detection and exploitationWPScanVulnerability ScanningWordPress-specific vulnerability scanningTestSSLSSL/TLS TestingCipher suite and protocol analysisSSLyzeSSL/TLS TestingAdvanced SSL/TLS configuration analysisGobusterContent DiscoveryDirectory and file brute-forcingFFufContent DiscoveryAdvanced web fuzzingArjunContent DiscoveryHTTP parameter discoveryXSStrikeSecurity AnalysisAdvanced XSS detection and exploitationGitLeaksSecurity AnalysisSecret and credential scanning in repositoriesCMSeeKSecurity AnalysisCMS detection and enumerationDNSReconSecurity AnalysisDNS enumeration (dual-use across categories) Crucially, the framework operates even if only a subset of these tools is installed; the AI adapts its testing approach based on available resources and discovered attack surface.

Asynchronous execution allows up to three tools to run in parallel by default, significantly reducing overall assessment duration.

The framework ships with predefined workflows for Recon, Web, Network, and Autonomous modes, all customizable through YAML files.

Workflow parameters follow a clear priority hierarchy: workflow-level YAML overrides the central configuration file, which in turn overrides tool defaults, allowing teams to run multiple parallel engagements with entirely independent settings.

Reports are generated in Markdown, HTML, or JSON, each including raw tool output, AI decision traces, and executive summaries. Each finding is linked back to its originating command execution via a 2,000-character evidence snippet, enabling full session reconstruction.

Guardian includes built-in safety mechanisms critical for authorized use. Scope validation automatically blacklists private RFC-1918 address ranges, and a safe mode prevents destructive operations by default.

Configurable confirmation prompts before sensitive operations create a human-in-the-loop checkpoint, while comprehensive audit logging records all AI decisions for post-engagement review.

The framework requires Python 3.11 or higher and at least one AI provider API key to function, with support for environment variable-based key management across Linux, macOS, and Windows.

Released as version 2.0.0, Guardian’s roadmap includes a web dashboard for visualization, a PostgreSQL backend for multi-session tracking, MITRE ATT&CK mapping for findings, plugin system support, CI/CD pipeline integration , and support for additional models, including Llama and Mistral.

The project is available at GitHub and is designed exclusively for authorized penetration testing, security research, and educational environments.

Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.

Based on reporting by Cyber Security News.