Cairn searches for a path from an origin to a goal by having agent workers read and write a shared graph of Facts, Intents and human Hints. A server keeps the graph consistent, and a dispatcher schedules Bootstrap, Reason and Explore tasks to workers running Claude Code, Codex or Pi. Penetration testing is the validated use case; the README reports 54 of 54 problems solved at a Tencent Cloud hackathon.
Who it is for: Security researchers and CTF players running authorized AI-driven pentests
Strengths
No fixed agent roles; tasks are generated at runtime from the shared graph
Hackathon result reported: 54/54 problems solved, 3rd place overall
Workers run in per-project containers or locally via existing claude/codex/pi CLIs
Humans can inject Hints that agents pick up on their next read
Weaknesses
Local mode runs agents with your user's permissions and no sandbox
AGPL-3.0; commercial or proprietary use needs a separate paid license
Depends on external coding-agent backends (Claude Code, Codex, Pi) and LLM API access
Benchmark results come from one competition; no independent evaluation is cited
What it needs
no GPU
Docker + Compose
Needs Docker (not needed in local mode), Python >= 3.12, uv, Claude Code, Codex or Pi CLI/LLM endpoints