Darkmoon: run an AI pentest without leaking your network (open source Privacy Gateway)

I wanted to share Darkmoon, an open source (GPLv3) autonomous penetration testing platform focused on Active Directory, Kubernetes, cloud, web and API, with evidence backed reporting.

It was recently covered by Help Net Security, LinuxSecurity and Cyber Security News, and it is fully open source. It orchestrates 80 plus offensive tools via MCP with a proof trail on every finding.

The newest addition is a Privacy Gateway, and its core is open source. It removes the hardest blocker for AI pentesting: no sensitive data ever reaches the model. The model only sees deterministic placeholders such as IP_PRIVATE_001, HOST_INTERNAL_001 and EMAIL_001, the real values are reinjected locally just before each tool runs then masked again before anything returns to the model, and any exfiltration attempt is blocked. So you get the power of a frontier model like Claude while meeting strict data sovereignty and privacy requirements. We proved it end to end on OWASP Juice Shop with the gateway active the whole run, 56 vulnerabilities found while the model never saw a single real IP or email.

Source: github.com/ASCIT31/Dark-Moon | dark-moon.org