AI-Powered Cybersecurity & Bug Bounty Automation Platform
The autonomous brain that hunts bugs while you sleep.
Recon → Scan → Analysis → Exploit → Report — fully AI-driven.
╔═══════════════════════════════════════════════════════════════╗
║ ║
║ █████╗ ███╗ ██╗ █████╗ ██████╗ ███████╗██╗ ██╗███████╗║
║ ██╔══██╗████╗ ██║██╔══██╗██╔══██╗██╔════╝██║ ██║██╔════╝║
║ ███████║██╔██╗ ██║███████║██║ ██║█████╗ ██║ ██║███████╗║
║ ██╔══██║██║╚██╗██║██╔══██║██║ ██║██╔══╝ ██║ ██║╚════██║║
║ ██║ ██║██║ ╚████║██║ ██║██████╔╝███████╗╚██████╔╝███████║║
║ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚══════╝║
║ ║
║ ◈ A I C Y B E R S E C U R I T Y ◈ ║
║ B R A I N ║
║ ║
║ Built by Chandan Pandey · MIT License ║
║ ║
╚═══════════════════════════════════════════════════════════════╝
ANADEUS is not just another scanner — it's an AI cybersecurity brain that thinks, adapts, and executes like a senior penetration tester.
It orchestrates 5 autonomous agents across a complete attack pipeline, powered by LLM-driven decision-making. From subdomain discovery to a polished vulnerability report with PoC evidence — one command does it all.
Built for: Security researchers · Penetration testers · Bug bounty hunters · Red teams
@auto example.com --deep
↓ That's it. ANADEUS handles the rest. ↓
┌─────────┐ ┌─────────┐ ┌──────────┐ ┌──────────┐ ┌─────────┐
│ RECON │───▶│ SCAN │───▶│ ANALYSIS │───▶│ EXPLOIT │───▶│ REPORT │
│ Agent │ │ Agent │ │ Agent │ │ Agent │ │ Agent │
└─────────┘ └─────────┘ └──────────┘ └──────────┘ └─────────┘
Subdomains Port scan AI-powered Safe PoC Impact +
Alive hosts Directories vuln candidates validation Final report
Tech detect Web servers Prioritization Zero-damage Markdown PoC
| Agent | What It Does |
|---|---|
| 🔍 Recon Agent | Subdomain enumeration, alive host detection, technology fingerprinting |
| 📡 Scanner Agent | Port/service scanning, directory fuzzing, endpoint discovery, web server analysis |
| 🧪 Analysis Agent | AI + heuristic vulnerability candidate identification and prioritization |
| 💥 Exploit Agent | Safe validation of SQLi, XSS, IDOR, CSRF, Auth Bypass — zero destructive payloads |
| 📄 Report Agent | Impact assessment, confidence scoring, PoC markdown, final report generation |
- Dual-provider architecture — Bytez (primary) + OpenRouter (fallback)
- Intelligent phase selection based on context quality and completed work
- Automatic confidence calibration and scoring
- Context-aware prompt generation for each phase
Subfinder · Amass · Assetfinder · httpx · WhatWeb
Nmap · ffuf · dirsearch · Feroxbuster · Nikto
WebProbe · SocketProbe · RouteProbe · and more...
Every tool has a smart fallback chain — if
nmapfails,socketprobetakes over instantly. No phase ever silently dies.
- Strict tool option sanitization — per-tool schemas prevent option leakage across fallback chains
- Deterministic state management — atomic writes, hard resets, single source of truth
- Early CLI injection prevention — malicious targets rejected before anything executes
- Degraded scan recovery — empty results trigger automatic retry with alternate tools
| Requirement | Version | Why |
|---|---|---|
| Node.js | ≥ 20.x | Core runtime |
| Python | ≥ 3.9 | Tool runner |
| Kali Linux | 2024.x+ | Pre-installed security tools |
# 1. Clone the repository
git clone https://github.com/thecnical/ANADEUS.git
cd ANADEUS
# 2. Install Node.js dependencies (CRITICAL: Required for CLI)
npm install
# 3. Install Python dependencies (with Kali Linux fix)
pip install -r requirements.txt --break-system-packages
# 4. Configure API keys
cp .env.example .env
# → Edit .env with your keys (see API Configuration below)
# 5. Verify installation
npm run bannerNote: Nmap, Subfinder, ffuf, Nikto, etc. come pre-installed on Kali Linux. On other distros, install them via your package manager.
ANADEUS uses a dual-provider AI architecture with automatic fallback.
cp .env.example .env# ── PRIMARY: Bytez ──────────────────────────
BYTEZ_API_KEY=your_bytez_key_here
BYTEZ_BASE_URL=https://api.bytez.com/v1
BYTEZ_MODEL=your_preferred_model
# ── FALLBACK: OpenRouter ────────────────────
OPENROUTER_API_KEY=your_openrouter_key_here
OPENROUTER_MODEL=openai/gpt-4o-mini| Provider | Link | Notes |
|---|---|---|
| Bytez | bytez.com | Primary — fast, dedicated infrastructure |
| OpenRouter | openrouter.ai | Fallback — 200+ models, pay-per-token |
💡 You only need one provider to get started. Both configured? Bytez runs first, OpenRouter kicks in automatically on failure.
ANADEUS auto-loads .env at startup — no extra setup needed.
Let the AI brain run the entire pipeline:
# Deep scan — full pipeline, thorough analysis
node src/index.js auto --target example.com --deep
# Light scan — faster, reduced scope
node src/index.js auto --target example.com --mode lightIf you want the terminal to stay open so you can type multiple commands, start the interactive chat mode:
node src/index.js
# or
node src/index.js chatThen you can type commands directly into the ANADEUS prompt:
> @recon example.com
> @scan example.com
> /show recon
Run specific phases manually from your normal terminal:
@recon example.com # Subdomain enum + alive detection + tech fingerprinting
@scan example.com # Port scan + directory fuzzing + web server analysis
@analysis example.com # AI vulnerability identification + prioritization
@exploit example.com # Safe PoC validation (SQLi, XSS, IDOR, CSRF, Auth)
@report example.com # Impact assessment + final markdown reportVia CLI:
node src/index.js chat --message "@recon example.com"
node src/index.js chat --message "@scan example.com"
node src/index.js chat --message "@analysis example.com"
node src/index.js chat --message "@exploit example.com"
node src/index.js chat --message "@report example.com"node src/index.js agent recon example.com
node src/index.js agent scan example.com
node src/index.js agent recon example.com --json # Structured JSON outputnpm run dashboard # Launch real-time monitoring UILive phase tracking · Tool execution logs · WebSocket updates · Artifact browser
🚨 ANADEUS is designed exclusively for authorized security testing, educational research, and legitimate bug bounty programs.
❌ DO NOT use on systems without explicit written permission.
⚖️ Unauthorized access is illegal under CFAA, CMA, and equivalent laws worldwide.
🛡️ All exploit validation uses harmless, non-destructive probes — zero damage payloads.
📋 The developers assume no liability for misuse.
By using ANADEUS, you agree to use it responsibly, ethically, and legally.
Contributions are welcome — bug fixes, new tool integrations, documentation, and ideas.
- Fork the repo
- Branch:
git checkout -b feature/your-feature - Commit:
git commit -m "Add your feature" - Push:
git push origin feature/your-feature - PR → Open a Pull Request
If ANADEUS helps your security research or earns you bounties, consider fueling its development:
→ buymeacoffee.com/chandanpandit ←
Your support keeps ANADEUS free, open-source, and actively maintained. ❤️
Every coffee funds tool research, server costs, and new features.
If ANADEUS saved you time, give it a ⭐ — it helps others discover the project and motivates continued development!
MIT License — see LICENSE for details.
Copyright © 2026 Chandan Pandey. Free to use, modify, and distribute.
Built with 🧠 by Chandan Pandey
ANADEUS — The AI that thinks like a hacker, so you don't have to.