Decepticon is an autonomous red-team agent framework written in Python that orchestrates reconnaissance, exploitation, and post-exploitation actions with a sandboxed, multi-network architecture. It provides a client SDK for integration and a Docker-based stack for running engagements.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
Decepticon is an autonomous Red Team agent framework written in Python. It executes attack chains such as reconnaissance, exploitation, privilege escalation, lateral movement, and C2 within defined engagement rules.
How it works
It operates across two networks: a management plane (LiteLLM, PostgreSQL, Neo4j, Skillogy, LangGraph) and a sandbox plane where actions run inside a Kali Linux sandbox. The system supports dynamic, on-demand specialist workloads (e.g., BloodHound CE, Sliver C2, Ghidra MCP) and a web dashboard accessible from the CLI. It uses a plugin-based, credential-aware provider chain for models and fallbacks, and routes LLM calls and sandbox execution to runtime services over HTTP. The architecture includes an engagement workflow with RoE, ConOps, Deconfliction Plan, and an OPPLAN with MITRE ATT&CK mapping.
Getting started
Prerequisites include Docker and Docker Compose v2. Installation commands for macOS/Linux/WSL2 are:
curl -fsSL https://decepticon.red/install | bash
decepticon onboard # Interactive setup wizard (provider, API key, model profile)
decepticon # Start the core stack and drop into the terminal CLI
Windows installation commands:
irm https://decepticon.red/install.ps1 | iex
decepticon onboard
decepticon
As a library, install via:
pip install decepticon # core SDK
pip install "decepticon[neo4j]" # + the knowledge-graph attack-chain tools
Getting started (continued)
The README notes that the Docker stack provides the core services, while the library serves to build custom orchestrators and agent factories. It also mentions a quick start and full setup walkthrough via docs links: Quick start → Full setup walkthrough.
Recent releases
Latest releases and notable changes include:
- v1.1.40 (2026-07-27): Changelog
- v1.1.39 (2026-07-27): Changelog
- v1.1.38 (2026-07-12): feat(oauth): register gpt-5.6-terra + gpt-5.6-luna Codex routes (#769)
- v1.1.37 (2026-07-12): feat(oauth): reasoning params (adaptive thinking + effort) + output caps for auth/* lanes (#768)
- v1.1.36 (2026-07-12): feat(llm): compose per-role model via PluginBundle.models + env (#767)
Traction
Stargazers: 4970, Forks: 969, Open issues: 5
License
Apache-2.0
Getting started (library usage)
pip install decepticon # core SDK
pip install "decepticon[neo4j]" # + the knowledge-graph attack-chain tools
Documentation/Contributing
References to docs exist for getting started, setup, CLI reference, and more. Typical commands for cloning and development are:
git clone https://github.com/PurpleAILAB/Decepticon.git
cd Decepticon
make dogfood # Full OSS UX (launcher → onboard → CLI) on local code
make dev # Backend hot-reload (compose watch) — daily dev loop
Note: The tool emphasizes an autonomous, policy-driven approach to red-teaming engagements with an emphasis on real attack workflows rather than simple scanning.