#1414th of 19 in Security
t3mp3st
Multi-agent offensive-security framework driven by your coding agent or local model
- Stars
- 7k
- License
- AGPL-3.0
- Last commit
- Sep 2026
- Last release
- Sep 2026
- Language
- TypeScript
2 on 30 Jun 20267,015 on 10 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
T3MP3ST runs a recon, exploit and report kill chain against authorized targets from a browser War Room or CLI. It uses a connected local coding agent (Claude Code, Codex, Hermes, OpenCode, Oh My Pi), an API key, or an offline model via Ollama or an OpenAI-compatible server. Its benchmark claims (XBEN 90.1% pass@1, Cybench 23/40) come from a single-agent loop and recompute with `npm run verify-claims`.
Who it is for: Security researchers running authorized pentests, CTFs and vulnerability hunts
Strengths
- Benchmark numbers re-derive from committed data with `npm run verify-claims`
- Works keyless via a signed-in local coding agent or an offline model
- Egress-scope containment is on by default and refuses off-target public hosts
- Status table separates stable, experimental and planned components
Weaknesses
- Multi-operator swarm exploitation is unbenchmarked and described as unreliable
- Cloud, mobile, AD and binary domains are scaffolding only
- Raw benchmark transcripts are stripped, so only graded verdicts can be re-checked
- AGPL-3.0 license limits use in closed network services
What it needs
- GPU optional
- Docker + Compose
- Needs Node.js/npm, git, Docker (optional), Ollama or OpenAI-compatible server (optional)
- Models: Claude Code, Codex, Hermes, OpenCode, Oh My Pi
- port 3333
Quick answers
Is t3mp3st open source?
Yes. Its code is on GitHub under the AGPL-3.0 license.
Can you run t3mp3st with Docker?
Yes. Its repository has a Docker setup: a Dockerfile, a Compose file or a published image.
Does t3mp3st need a GPU?
No. It runs on a CPU and can use a GPU when you have one.
Also in Security
See all 19| Rank | Project | Score |
|---|---|---|
| 1 | shannonAutonomous pentester that exploits web apps and APIs using source analysis | 91 out of 100 |
| 2 | ifixaiPython CLI that audits AI agents for policy, access and reliability failures | 87 out of 100 |
| 3 | StrixAutonomous AI pentesting agents that validate vulnerabilities with working exploits | 84 out of 100 |
| #4 | pentagiAutonomous multi-agent penetration testing system with sandboxed security tools | 77 out of 100 |
| #5 | ai-infra-guardRed-teaming platform for AI infra CVEs, MCP servers, agent skills and jailbreaks | 75 out of 100 |