RedAmon

Why it's ranked here

The strongest reason to consider RedAmon is integration depth. Reconnaissance, graph storage, agent chat, vulnerability scanning, browser automation, and remediation share one project model. That cohesion is valuable for serious labs, but the large container stack and powerful execution surface demand experienced operators.

What's good

The knowledge graph gives findings useful structure instead of leaving them as unrelated scanner reports. Parallel tools can feed discoveries into later stages. MCP separates agent reasoning from Kali-based executors, while loopback binding and bearer-token checks reduce accidental exposure. Local and hosted model providers are both supported.

Tradeoffs

This is substantial infrastructure, not a lightweight scanner. The documented deployment uses more than fifteen containers plus PostgreSQL, Neo4j, Redis, and a separate GVM stack. Some MCP tools accept raw command-line arguments, placing meaningful trust in model behavior. Reverse-shell access is intentionally exposed, and GVM increases memory requirements.

How to use it well

Use RedAmon in an isolated, authorized security lab where an experienced operator can define scope, supervise critical actions, and review proposed fixes. It fits teams wanting one workspace for recon, attack-path analysis, exploit validation, and remediation. It does not replace written permission, network isolation, or human security judgment.

Observed

License

MIT

Languages

Python 3.11 backend services and a TypeScript frontend

Installation

Docker and Docker Compose v2 are required; components run as containers

User interfaces

Next.js web application and terminal or CLI entry points

Service interfaces

REST, WebSocket, SSE, and MCP

Platform guidance

Docker Desktop is documented for macOS and Windows, with WSL2 required on Windows

Data stores

PostgreSQL stores application data; Neo4j stores the attack-surface graph; Redis supports GVM