Darkmoon

What it does

Darkmoon is an open-source, self-hosted autonomous penetration testing platform that combines 18 specialized AI agents and 80+ offensive security tools. It assesses Active Directory, Kubernetes, cloud infrastructure, APIs, CMSs, and networks. The platform is MITRE-mapped and delivers evidence-backed findings, attack paths, and publication-ready reports. It features a live SSE dashboard for real-time visibility, an infrastructure map, and a hardened runtime with AES-256-GCM sealed storage and hardware-bound licensing.

Who it is for

Darkmoon is designed for professional penetration testers, security teams, and enterprises. It offers a Community edition (free, GPLv3) for self-hosted use, a Pro edition (€149/month) with additional features like managed command center and branded PDF reports, and a Custom edition for enterprises and MSSPs. It also provides a managed pentest service (€799/engagement) and a partner program for resellers.

Why it matters

Traditional vulnerability scanners run one-pass signatures, while Darkmoon orchestrates an end-to-end offensive campaign. It reasons about the target, dispatches domain specialists, validates findings with real payloads, builds an infrastructure graph, and produces structured reports. This reduces manual effort and provides actionable, evidence-backed results quickly. The platform's architecture ensures the AI never gets shell access, with an MCP gateway gatekeeping every tool call, making it safe for production environments.

Launch signal

Darkmoon launched on Product Hunt on the day of this profile. The Product Hunt listing describes it as "Most AI pentesting tools stop at the web layer. Darkmoon goes further." The platform has 52 followers on Product Hunt and is categorized under Security Software.

Brand and naming

The name 'Darkmoon' evokes mystery and stealth, fitting for a security platform, but it's somewhat generic and doesn't directly convey 'autonomous penetration testing.' The domain dark-moon.org is memorable but uses a hyphen, which can be a minor friction point. The tagline and website clearly position it as an autonomous security platform with AI agents, but the name itself lacks immediate clarity about the product's function.