Traditional penetration testing has an undeniable scaling bottleneck: human calendar time. Manual assessments require senior practitioners spending days methodically probing infrastructure, yielding inconsistent coverage that varies wildly depending on who is at the keyboard. Yet simply handing an unrestricted shell to an autonomous LLM agent is an architectural disaster waiting to happen. Unbounded autonomy leads to hallucinations, scope creep, and unpredictable execution.
DarkMoon tackles this engineering problem by decoupling cognition from execution. Instead of letting a language model run wild, the platform separates the brain that reasons from the isolated mechanisms that act, providing a deterministic, auditable framework for automated security assessments.
The Architecture: Decoupling Brains from Execution
At the core of DarkMoon is a strict separation of concerns implemented across two distinct layers: orchestration and containerized execution.
+-------------------------------------------------------------+
| LLM Core |
| (Planning, Reasoning, Tech Surface Model) |
+-------------------------------------------------------------+
|
v
+-------------------------------------------------------------+
| OpenCode Orchestrator |
+-------------------------------------------------------------+
|
[ MCP Protocol Layer ]
|
v
+-------------------------------------------------------------+
| Isolated Docker Containers |
| +-----------------------------------------------------+ |
| | Allow-listed Toolset: Nuclei, sqlmap, | |
| | BloodHound, NetExec (50+ utilities) | |
| +-----------------------------------------------------+ |
| | Specialized Sub-Agents: Web, AD, K8s, Network | |
| +-----------------------------------------------------+ |
+-------------------------------------------------------------+
The orchestrator, OpenCode, handles communications with the LLM, breaks down objectives, and establishes an assessment plan. Execution does not happen directly on the host system. Instead, OpenCode delegates operations through a control layer powered by the Model Context Protocol (MCP).
This MCP layer interfaces with sandboxed Docker containers running an allow-listed suite of over fifty security utilities, including Nuclei, sqlmap, BloodHound, and NetExec. Furthermore, DarkMoon provisions specialized sub-agents tailored to target specific domains:
- Web applications
- Active Directory environments
- Kubernetes clusters
- Network protocols
The Feedback-Driven Execution Loop
DarkMoon does not run static, blind scripts. It processes assessment data through a disciplined, reactive sequence:
- Discovery & Fingerprinting: The engine scans for open ports, maps accessible services, and identifies the underlying technology stack.
- Surface Modeling: OpenCode constructs a real-time model of the attack surface based exclusively on verified findings.
- Dynamic Agent Dispatch: Specialized sub-agents spin up contextually. When discovery surfaces a WordPress deployment, the CMS agent triggers. If a GraphQL endpoint appears downstream, the GraphQL sub-agent initializes automatically.
This cyclical approach maps execution directly against established security assessment methodologies such as NIST SP 800-115 and ISO 27001.
Hard Scope Guardrails: Eliminating Unbounded Execution
The primary risk in autonomous security tooling is non-deterministic, out-of-scope behavior. DarkMoon prevents this by removing direct command execution capabilities from the reasoning model.
The LLM never issues raw shell commands to the target. Every operational step must route through the MCP server, which exposes strictly allow-listed tools and pre-registered workflows.
[ User-Defined Scope: Domains / IPs / Apps ]
|
v
[ OpenCode In-Scope Surface Model ]
|
v
[ MCP Explicit Allow-List Verification ]
|
v
[ Deterministic Tool Execution ]
Target parameters (IP ranges, domain boundaries, specific applications) are hard-coded at initialization. The orchestrator is structurally constrained to discover and evaluate assets strictly inside that authorized perimeter. If a utility is not registered with the MCP server and mapped to the orchestration layer, the agent cannot execute it. The result is an assessment pipeline that remains auditable, deterministic, and strictly scoped.
Model Selection, Token Economics, and Stability
Token expenditure and runtime stability vary significantly depending on the operational footprint of the assessment and the underlying model provider.
The Cost Equation
| Assessment Type | Typical API Spend | Primary Cost Drivers |
|---|---|---|
| Standard Web App | ~$10 (Frontier Model) | Initial fingerprinting, surface modeling, single-agent dispatch |
| Heavy Infrastructure / Active Directory | Higher Token Burn | Multi-host pivoting, deep reasoning over dynamic evidence, state tracking |
| Local Deployments (Ollama / llama.cpp) | $0 (Self-hosted) | Compute-bound to local hardware infrastructure |
Frontier Models and Vendor Guardrails
DarkMoon supports backends spanning OpenAI, Anthropic, OpenRouter, and local runtimes like Ollama and llama.cpp. While local setups provide a zero-marginal-cost tier, frontier models offer superior planning and context retention.
However, upstream safety filters introduce significant operational variances during authorized tasks:
- Claude Opus 4.8: Encountered vendor-level classification guardrails during testing, leading to mid-assessment refusals and interruptions.
- Claude Opus 4.6: Completed end-to-end assessments without operational degradation or mid-flight interruptions, making it the current recommended baseline for stability.
Organizations running approved workflows can also leverage the Anthropic Cyber Verification Program to navigate upstream classification hurdles. Note that smaller parameter-class models are currently not supported for autonomous orchestration duties due to reasoning constraints.
Evidence-Based Reporting: Ground Truth Over Model Output
Generative models are prone to hallucinating vulnerabilities when reading ambiguous signals. DarkMoon mitigates this risk by separating proof from inference. The LLM is never treated as the source of truth; ground-truth evidence gathered directly from the target environment is the sole arbiter of a finding.
+-------------------------------------------------------------+
| Signal Ingestion |
+-------------------------------------------------------------+
|
+---------------------+---------------------+
| |
v v
[ Weak / Ambiguous Signals ] [ Verified Direct Proof ]
- Generic HTTP 200 responses - Exact command invocations
- Reflected input without impact - Raw execution stdout/stderr
- Ambiguous service banners - Full HTTP request/response
| |
v v
Status: UNCONFIRMED Status: CONFIRMED
(Downgraded for Review) (Traceable & Reproducible)
Weak signals, such as bare HTTP 200 statuses or unverified input reflections, are automatically marked as Unconfirmed. For an issue to reach Confirmed status, the final report must package the complete operational trace: the precise command executed, raw standard output, complete HTTP request/response payloads, and execution logs.
By demanding end-to-end reproducibility for every finding, the platform removes guesswork from remediation, giving engineering teams an auditable, deterministic record of their security posture.