CoreMind Security Ecosystem
macOS-native security testing platform with 14 AI-powered agents, 48 registered tools,
and 9 pre-built attack chains. Ollama local models provide the AI brain (zero cloud cost).
Quick Reference
# System status
coremind-sec status
# Single agent operations
coremind-sec recon <target> --mode active
coremind-sec scan <target> --type full
coremind-sec osint <target>
coremind-sec web <url> --attack sqli
coremind-sec exploit <target> --vuln sqli --cve CVE-xxxx-xxxxx
coremind-sec creds <target> --attack brute --service ssh
coremind-sec ad <dc-ip> --domain corp.local --attack full
coremind-sec postex <target> --op pivot
coremind-sec cloud --provider aws --assess audit
coremind-sec forensics <file> --type file
coremind-sec posture <url>
coremind-sec comply <target> --framework nist
coremind-sec threat <file> --type malware
coremind-sec endpoint --check full
# Multi-agent missions
coremind-sec mission <target> --obj "full penetration test"
coremind-sec mission <target> --chain red_team
coremind-sec mission <target> --chain web_assessment
# Utilities
coremind-sec tools # Show installed/missing tools
coremind-sec agents # List all agents
coremind-sec chains # List attack chains
coremind-sec audit # Verify audit chain integrity
14 Agents
| Agent |
Division |
Purpose |
| recon |
Offensive |
DNS, HTTP fingerprint, port scan, tech detection |
| scanner |
Offensive |
Multi-tool vuln scanning (nmap, nuclei, nikto, whatweb) |
| osint |
Offensive |
Social media, email, subdomain, IP intelligence |
| web_attack |
Offensive |
OWASP Top 10: SQLi, XSS, fuzzing, crawling |
| exploit |
Offensive |
AI-guided exploitation, payload crafting, CVE verification |
| cred_attack |
Offensive |
Brute force, hash cracking, password spraying |
| ad_attack |
Offensive |
AD enum, Kerberoast, ADCS, SMB, lateral movement |
| post_exploit |
Offensive |
C2, persistence, pivoting, data exfil |
| cloud_recon |
Offensive |
AWS/Azure/GCP audit, IaC scan, privesc |
| forensics |
Defensive |
File analysis, PCAP, memory forensics, YARA |
| web_posture |
Defensive |
Security headers, TLS, cookies, CSP |
| compliance |
Defensive |
CIS, NIST CSF, OWASP, PCI-DSS gap analysis |
| threat_intel |
Defensive |
IoC analysis, log patterns, malware triage |
| endpoint |
Defensive |
macOS hardening, baseline drift, process audit |
9 Attack Chains
| Chain |
Agents |
| full_pentest |
recon -> scanner -> osint -> web_attack -> exploit -> post_exploit |
| red_team |
osint -> recon -> scanner -> exploit -> post_exploit -> cred_attack |
| web_assessment |
recon -> web_posture -> scanner -> web_attack |
| network_pentest |
recon -> scanner -> cred_attack -> post_exploit |
| ad_attack |
recon -> scanner -> ad_attack -> cred_attack -> post_exploit |
| cloud_audit |
cloud_recon -> compliance -> scanner |
| osint_investigation |
osint -> recon -> threat_intel |
| incident_response |
forensics -> threat_intel -> endpoint |
| defensive_audit |
web_posture -> endpoint -> compliance -> threat_intel |
AI Models (Ollama)
| Role |
Model |
Purpose |
| Fast |
qwen3:8b |
Quick tactical decisions, scan analysis |
| Code |
code-assistant |
Exploit review, payload craft, script analysis |
| Analysis |
qwen3.5:cloud |
Attack paths, reports, complex reasoning |
| Embed |
nomic-embed-text |
Vector search over findings/vulndb |
Tool Installation
When online: bash ~/coremind-sec/scripts/install_tools.sh
Installs 48 tools via Homebrew + pip + Go, plus Z4nzu/hackingtool and SecLists wordlists.
Project Location
~/coremind-sec/ — 24 Python files, 2604 lines
1---2name: coremind-sec3description: Autonomous Security Ecosystem — 14 AI-powered agents, 48 tools, 9 attack chains for macOS native pentesting4---56# CoreMind Security Ecosystem78macOS-native security testing platform with 14 AI-powered agents, 48 registered tools,9and 9 pre-built attack chains. Ollama local models provide the AI brain (zero cloud cost).1011## Quick Reference1213```bash14# System status15coremind-sec status1617# Single agent operations18coremind-sec recon <target> --mode active19coremind-sec scan <target> --type full20coremind-sec osint <target>21coremind-sec web <url> --attack sqli22coremind-sec exploit <target> --vuln sqli --cve CVE-xxxx-xxxxx23coremind-sec creds <target> --attack brute --service ssh24coremind-sec ad <dc-ip> --domain corp.local --attack full25coremind-sec postex <target> --op pivot26coremind-sec cloud --provider aws --assess audit27coremind-sec forensics <file> --type file28coremind-sec posture <url>29coremind-sec comply <target> --framework nist30coremind-sec threat <file> --type malware31coremind-sec endpoint --check full3233# Multi-agent missions34coremind-sec mission <target> --obj "full penetration test"35coremind-sec mission <target> --chain red_team36coremind-sec mission <target> --chain web_assessment3738# Utilities39coremind-sec tools # Show installed/missing tools40coremind-sec agents # List all agents41coremind-sec chains # List attack chains42coremind-sec audit # Verify audit chain integrity43```4445## 14 Agents4647| Agent | Division | Purpose |48|-------|----------|---------|49| recon | Offensive | DNS, HTTP fingerprint, port scan, tech detection |50| scanner | Offensive | Multi-tool vuln scanning (nmap, nuclei, nikto, whatweb) |51| osint | Offensive | Social media, email, subdomain, IP intelligence |52| web_attack | Offensive | OWASP Top 10: SQLi, XSS, fuzzing, crawling |53| exploit | Offensive | AI-guided exploitation, payload crafting, CVE verification |54| cred_attack | Offensive | Brute force, hash cracking, password spraying |55| ad_attack | Offensive | AD enum, Kerberoast, ADCS, SMB, lateral movement |56| post_exploit | Offensive | C2, persistence, pivoting, data exfil |57| cloud_recon | Offensive | AWS/Azure/GCP audit, IaC scan, privesc |58| forensics | Defensive | File analysis, PCAP, memory forensics, YARA |59| web_posture | Defensive | Security headers, TLS, cookies, CSP |60| compliance | Defensive | CIS, NIST CSF, OWASP, PCI-DSS gap analysis |61| threat_intel | Defensive | IoC analysis, log patterns, malware triage |62| endpoint | Defensive | macOS hardening, baseline drift, process audit |6364## 9 Attack Chains6566| Chain | Agents |67|-------|--------|68| full_pentest | recon -> scanner -> osint -> web_attack -> exploit -> post_exploit |69| red_team | osint -> recon -> scanner -> exploit -> post_exploit -> cred_attack |70| web_assessment | recon -> web_posture -> scanner -> web_attack |71| network_pentest | recon -> scanner -> cred_attack -> post_exploit |72| ad_attack | recon -> scanner -> ad_attack -> cred_attack -> post_exploit |73| cloud_audit | cloud_recon -> compliance -> scanner |74| osint_investigation | osint -> recon -> threat_intel |75| incident_response | forensics -> threat_intel -> endpoint |76| defensive_audit | web_posture -> endpoint -> compliance -> threat_intel |7778## AI Models (Ollama)7980| Role | Model | Purpose |81|------|-------|---------|82| Fast | qwen3:8b | Quick tactical decisions, scan analysis |83| Code | code-assistant | Exploit review, payload craft, script analysis |84| Analysis | qwen3.5:cloud | Attack paths, reports, complex reasoning |85| Embed | nomic-embed-text | Vector search over findings/vulndb |8687## Tool Installation8889When online: `bash ~/coremind-sec/scripts/install_tools.sh`9091Installs 48 tools via Homebrew + pip + Go, plus Z4nzu/hackingtool and SecLists wordlists.9293## Project Location9495`~/coremind-sec/` — 24 Python files, 2604 lines
kmshihab7878