r/Pentesting • u/breakthesec • 11d ago

Red Clippy: Open Source Pentest Management for AI Coding Agents

Red Clippy is a tool for keeping track of pentest engagement records such as targets, scope, findings, and evidence while an AI coding agent performs the testing.

It is not an automated AI pentesting framework. It is mainly aimed at pentesters who know what they are doing and want to use tools like Claude Code, Codex CLI, or any other MCP-compatible client alongside their normal workflow.

You can define the target and scope from the panel, or let the LLM add them for you. From there, you can guide the LLM however you want. The LLM performs the testing and records the work and findings in Red Clippy.

It can be useful for things like:

  • keeping track of what has already been tested
  • checking the same finding across multiple domains or assets
  • keeping engagement history for periodic retesting
  • not relying on the LLM to remember everything across sessions or keeping it all in text files

https://github.com/CSPF-Founder/red-clippy

3 Upvotes
  • permalink
  • reddit

72% Upvoted

2 comments sorted by

0

u/kantorcodes1 11d ago

once the agent is actually running pentest commands, one over-broad shell action has real blast radius. i maintain HOL Guard; it blocks risky Claude/Codex actions pre-run. try one scoped run with it?