cdxiaodong/cain-agent

Cain is an AI penetration-testing engineer built around a deterministic state machine — recon, test, report — where the agent's freedom is deliberately narrow. Path selection and evidence analysis are left to Claude; stage transitions, scope enforcement, and dangerous-operation circuit breakers are hard constraints that the model cannot override. That design choice is the whole argument.

Scope enforcement works through a PreToolUse hook that blocks any tool call whose target falls outside scope.yaml. The model's good behavior is not the safety mechanism — configuration is. Similarly, write and exploit operations (POST, PUT, DELETE, cloud storage mutations) are rejected before execution across 46 built-in security tools, each carrying its own dangerous_flags blacklist. Credential redaction happens at the hook level before anything is persisted. None of this is described as AI self-discipline, and that honesty is refreshing.

The separation of finder and validator into distinct agent sessions that never share context is a genuinely interesting architectural decision. A finding cannot be self-confirmed because the session that discovered it is never the session that validates it. Verdicts are four-state structured output. This directly addresses one of the more embarrassing failure modes in agentic security tooling: the agent hallucinates a vulnerability, then hallucinates its own confirmation.

The cloud module is the most distinctive piece. Coverage spans AWS, Azure, GCP, and three Chinese providers — Alibaba Cloud, Tencent Cloud, Huawei Cloud — across storage exposure, IAM and RAM privilege-escalation path analysis, Kubernetes RBAC posture, and cloud metadata SSRF across seven providers. The IAM privilege-escalation component models entities, escalation actions, and high-privilege targets as a directed graph, finds paths via BFS, and exports DOT or JSON for rendering. That's a concrete deliverable, not a vague claim.

The benchmark is self-built: a vulnerable Terraform range with per-scene expected-detection fixtures, scored against detection rate, false-positive rate, wall time, and token cost. Results not yet run are marked untested rather than omitted. Forty-four test files cover cloud modules, skills, and the CLI. The README is explicit that no hallucinated percentages appear — which is a low bar, but one that many comparable projects clear only partially.

All state lives as files in a workspace directory, making runs crash-resumable and auditable. The total-budget flag is wall-clock seconds, which is a practical constraint for real engagements where time and token cost matter.

This is an early MVP — the README says so plainly — and the Chinese cloud coverage alone makes it worth watching for anyone doing assessments in that environment.