Overview
Vigil is a command-line system for AI-driven security engagements. An LLM operator follows a phased workflow, delegates work to specialist agents, executes security tools in a shared Kali environment, and preserves engagement state in an orchestrator database.
It supports web red-team, white-box code, Android, and blue-team incident-response engagements through a common backend. The project explicitly limits use to authorized targets with a reviewed scope.
Key Features
- Coordinates a central operator with specialist sub-agents for focused security tasks.
- Runs target-facing tools in a long-lived, shared Kali container.
- Records targets, services, request variants, probes, findings, and attack chains durably.
- Supports combined web and code tracks within an offensive engagement.
- Audits commands with their technique, intent, and probe type.
- Requires independent verification before findings can be confirmed, downgraded, or marked as false positives.
Engagement Model
Vigil keeps the operator context small by delegating most work to specialist agents. Each client process runs one mode, while multiple tracks can contribute to the same engagement state.
The documented model options focus primarily on Claude Code and Codex. Access requirements vary by provider and by whether the work is defensive or red-team oriented.
Responsible Operation
Vigil can autonomously drive offensive tooling against live systems, so operators remain responsible for authorization, scope, commands, credentials, infrastructure, and effects on targets. The project is distributed under the Apache License 2.0 and provides a private process for reporting security vulnerabilities.