1200km-auditai

AuditAI

AI-powered host vulnerability assessment tool running entirely inside Docker.

AuditAI runs nine security scanner modules against your Linux host, feeds the raw findings to Claude, and produces a prioritized vulnerability report with attack chain analysis — all from a single command.

export ANTHROPIC_API_KEY=sk-ant-...
./run.sh

Full write-up: Building a Dockerized AI-Powered Host Vulnerability Assessment Tool

---

How It Works

AuditAI is a three-stage pipeline:

┌─────────────────────────────────────────────────────────────────┐
│                        HOST MACHINE                             │
│                                                                 │
│  ┌──────────────────────────────────────────────────────────┐  │
│  │              DOCKER CONTAINER (read-only)                │  │
│  │                                                          │  │
│  │  ┌─────────────┐   ┌────────────────┐   ┌────────────┐  │  │
│  │  │   STAGE 1   │   │    STAGE 2     │   │  STAGE 3   │  │  │
│  │  │  9 Scanner  │──▶│  Preprocessor  │──▶│   Report   │  │  │
│  │  │  Modules    │   │  + Claude AI   │   │ Generator  │  │  │
│  │  │  (parallel) │   │  (sequential)  │   │            │  │  │
│  │  └─────────────┘   └────────────────┘   └────────────┘  │  │

│ │ ▼ ▼ ▼ │ │ │ │ rawoutput dicts Finding[] + HTML + .md │ │ │ │ attack chains ./output/ │ │ │ └──────────────────────────────────────────────────────────┘ │ │ │ │ /proc /sys /etc /var /home /usr (mounted read-only) │ └─────────────────────────────────────────────────────────────────┘

**Stage 1 — Scan:** Nine modules run in parallel collecting raw host data (process table, network state, filesystem, packages, kernel parameters, etc.).

**Stage 2 — AI Analysis:** A preprocessor filters each module's raw output (60–90% size reduction), then Claude analyzes each module sequentially and performs a cross-module synthesis to identify attack chains.

**Stage 3 — Report:** Findings, attack chains, and priorities are rendered to a self-contained HTML report and Markdown file.

The container mounts the host filesystem **read-only** and uses `--pid=host` + `--network=host` to see the real process table and network state. It **cannot modify** anything on the host.

---

## Requirements

• Docker (any recent version)
• Linux host (Ubuntu/Debian recommended; other distros work)
• Anthropic API key — ~$0.10–0.30 per full scan on Sonnet

The installed auditai CLI can run directly on a Kali/Linux host without Docker or an API key:

pip install 1200km-auditai
sudo auditai --no-ai --output-dir ./output

---

Quick Start

PyPI CLI install

pip install 1200km-auditai
auditai --help
sudo auditai --no-ai --output-dir ./output