| name | coremind-sec |
| description | Autonomous Security Ecosystem — 14 AI-powered agents, 48 tools, 9 attack chains for macOS native pentesting |
| version | 1.0.0 |
| tags | ["security","pentesting","hacking","offensive","defensive","osint","forensics","cloud"] |
| trigger | security testing, pentesting, hacking, vulnerability scanning, OSINT, forensics, exploit, credential attack, compliance |
CoreMind Security Ecosystem
macOS-native security testing platform with 14 AI-powered agents, 48 registered tools,
and 9 pre-built attack chains. Ollama local models provide the AI brain (zero cloud cost).
Quick Reference
coremind-sec status
coremind-sec recon <target> --mode active
coremind-sec scan <target> --type full
coremind-sec osint <target>
coremind-sec web <url> --attack sqli
coremind-sec exploit <target> --vuln sqli --cve CVE-xxxx-xxxxx
coremind-sec creds <target> --attack brute --service ssh
coremind-sec ad <dc-ip> --domain corp.local --attack full
coremind-sec postex <target> --op pivot
coremind-sec cloud --provider aws --assess audit
coremind-sec forensics <file> --type file
coremind-sec posture <url>
coremind-sec comply <target> --framework nist
coremind-sec threat <file> --type malware
coremind-sec endpoint --check full
coremind-sec mission <target> --obj "full penetration test"
coremind-sec mission <target> --chain red_team
coremind-sec mission <target> --chain web_assessment
coremind-sec tools
coremind-sec agents
coremind-sec chains
coremind-sec audit
14 Agents
| Agent | Division | Purpose |
|---|
| recon | Offensive | DNS, HTTP fingerprint, port scan, tech detection |
| scanner | Offensive | Multi-tool vuln scanning (nmap, nuclei, nikto, whatweb) |
| osint | Offensive | Social media, email, subdomain, IP intelligence |
| web_attack | Offensive | OWASP Top 10: SQLi, XSS, fuzzing, crawling |
| exploit | Offensive | AI-guided exploitation, payload crafting, CVE verification |
| cred_attack | Offensive | Brute force, hash cracking, password spraying |
| ad_attack | Offensive | AD enum, Kerberoast, ADCS, SMB, lateral movement |
| post_exploit | Offensive | C2, persistence, pivoting, data exfil |
| cloud_recon | Offensive | AWS/Azure/GCP audit, IaC scan, privesc |
| forensics | Defensive | File analysis, PCAP, memory forensics, YARA |
| web_posture | Defensive | Security headers, TLS, cookies, CSP |
| compliance | Defensive | CIS, NIST CSF, OWASP, PCI-DSS gap analysis |
| threat_intel | Defensive | IoC analysis, log patterns, malware triage |
| endpoint | Defensive | macOS hardening, baseline drift, process audit |
9 Attack Chains
| Chain | Agents |
|---|
| full_pentest | recon -> scanner -> osint -> web_attack -> exploit -> post_exploit |
| red_team | osint -> recon -> scanner -> exploit -> post_exploit -> cred_attack |
| web_assessment | recon -> web_posture -> scanner -> web_attack |
| network_pentest | recon -> scanner -> cred_attack -> post_exploit |
| ad_attack | recon -> scanner -> ad_attack -> cred_attack -> post_exploit |
| cloud_audit | cloud_recon -> compliance -> scanner |
| osint_investigation | osint -> recon -> threat_intel |
| incident_response | forensics -> threat_intel -> endpoint |
| defensive_audit | web_posture -> endpoint -> compliance -> threat_intel |
AI Models (Ollama)
| Role | Model | Purpose |
|---|
| Fast | qwen3:8b | Quick tactical decisions, scan analysis |
| Code | code-assistant | Exploit review, payload craft, script analysis |
| Analysis | qwen3.5:cloud | Attack paths, reports, complex reasoning |
| Embed | nomic-embed-text | Vector search over findings/vulndb |
Tool Installation
When online: bash ~/coremind-sec/scripts/install_tools.sh
Installs 48 tools via Homebrew + pip + Go, plus Z4nzu/hackingtool and SecLists wordlists.
Project Location
~/coremind-sec/ — 24 Python files, 2604 lines
