AI penetration testing, from your shell

The AI pentesting agent for your terminal

RedCell automates reconnaissance, CVE scanning, and vulnerability verification for authorized security testing—and blocks actions outside your approved scope. Install in one line and run your first scoped assessment from the terminal.

curl -fsSL https://redcell.sh/install.sh | sh

Then run redcell login and redcell.

macOS, Linux, and Windows · Models included in paid plan budgets · Try 24 hours for $1 on any monthly plan

Built with

AI penetration testing for authorized security work.

Services used to run RedCell’s product and account workflows.

Nvidia — supported by RedCellSupabase — supported by RedCellOpenAI — supported by RedCellTurso — supported by RedCellVercel — supported by RedCellGitHub — supported by RedCellClaude AI — supported by RedCellClerk — supported by RedCell
Nvidia — supported by RedCellSupabase — supported by RedCellOpenAI — supported by RedCellTurso — supported by RedCellVercel — supported by RedCellGitHub — supported by RedCellClaude AI — supported by RedCellClerk — supported by RedCell
Nvidia — supported by RedCellSupabase — supported by RedCellOpenAI — supported by RedCellTurso — supported by RedCellVercel — supported by RedCellGitHub — supported by RedCellClaude AI — supported by RedCellClerk — supported by RedCell
Nvidia — supported by RedCellSupabase — supported by RedCellOpenAI — supported by RedCellTurso — supported by RedCellVercel — supported by RedCellGitHub — supported by RedCellClaude AI — supported by RedCellClerk — supported by RedCell

One connected workflow

Automated penetration testing, from scope to report

RedCell carries an authorized security assessment through discovery, validation, and reporting, with scope and engagement context attached at each stage.

Stage 01 / Discover

See the surface before you test it.

Start with authorized recon for a security audit or cyber defense review. RedCell maps the exposed services and assets that belong in the engagement.

  • Passive recon, OSINT, and subdomain discovery
  • Port and service fingerprinting
  • Findings organized in the engagement
redcell — sample engagement

❯ redcell "map the approved application scope"

›scope check target.com approved

›host map api.target.com discovered

›service HTTPS / 443 fingerprinted

✓evidence 03 assets saved locally

Example output · target.com

Stage 02 / Validate

Turn scan output into evidence.

Run an authorized security audit with vulnerability checks and exploit testing through proof-of-concept verification, while honoring engagement scope and rules.

  • Template-based CVE scanning
  • Scoped exploit testing with proof-of-concept verification
  • Human review of findings and impact
redcell — sample engagement

❯ redcell "verify scoped vulnerability findings"

›scope check target.com approved

›template scan known CVEs complete

›verification evidence collected recorded

✓review state operator review ready

Example output · target.com

Stage 03 / Report

Hand off work people can act on.

Turn security audit and exploit testing results into evidence-backed findings for remediation, technical review, or an executive readout.

  • Evidence linked to each finding
  • Markdown and JSON exports
  • A clear handoff for remediation
redcell — sample engagement

❯ redcell "prepare the engagement report"

›engagement target.com

›findings organized by severity

›evidence linked to each item

✓export Markdown + JSON

Example output · target.com

Why RedCell

Agentic pen testing without the setup tax

RedCell brings model access, scope guardrails, evidence, and extensible tools into one terminal workflow for authorized security work.

Models included

Paid plans include a monthly model usage budget; bring no separate model provider API key for RedCell inference.

Scope guardrails

Define targets and rules of engagement. RedCell blocks prohibited out-of-scope activity.

Evidence with findings

Keep findings organized with supporting evidence and export Markdown or JSON reports.

Your tools, connected

Extend workflows with custom MCP servers, Python scripts, and native security binaries.

Model Context Protocol

Connect MCP tools with Redcell

Connect your tools with MCP

Connect MCP servers you choose and bring their tools into your RedCell workflow. Keep your specialist tools in reach from the terminal, alongside RedCell’s built-in capabilities.

01

Connect

Register and manage MCP servers from the CLI.

02

Discover

See the tools your connected servers make available.

03

Compose

Use those tools as part of your terminal workflow.

Explore MCP commands
$ redcell mcp ...ready to connect

Common MCP examples

choose your servers

GitHub

Repos & pull requests

Filesystem

Files & folders

Playwright

Browser automation

Fetch

Web content

RedCell CLI

Tools in the workflow

DiscoverCall toolsReview results

The RedCell advantage

Agentic pentesting with the operator in control

RedCell is built to do more of the repetitive work while keeping authorization, review, and evidence visible to the person running the engagement.

01 / Guardrails

Scope is part of the workflow—not a footnote.

Confirm the authorized targets and rules of engagement before activity begins. Out-of-scope actions, rate-limit violations, and unwanted impact are blocked.

target.com · approvedother targets · blocked
02 / Operator workflow

Work where your tools already live.

Run RedCell from the terminal, connect the tools you rely on, and keep the engagement close to your existing process.

03 / Evidence

Keep the proof with the finding.

Review collected evidence and export findings in Markdown or JSON.

04 / Extensible

Make it work with your stack.

Bring custom MCP servers, Python scripts, and native security binaries into the workflow.

The RedCell platform

AI security testing for every authorized assessment

Move from authorized targets to verified, review-ready findings in one connected workflow.

Authorize the engagement
Assess the attack surface
Validate and report

Security validation

Support cyber defense with security audits and scoped exploit testing.

How CVE scanning works
Action layer

Scope-aware runs

Tool orchestration

Operator review

Report export

Agent intelligence

Target context

Workflow planning

Tool selection

Finding verification

Evidence mapping

Authorized surface
DomainsWeb applicationsAPIsHosts & servicesCloud assetsCodebasesCustom MCP tools

Compare tools

How RedCell compares to other AI pentesting tools

Read side-by-side guides to understand how different security tools fit different workflows.

From the RedCell blog

Learn AI penetration testing

AI pentesting FAQ

Find quick answers to common questions about the platform, pricing, and security.

RedCell·Support & Docs

Still have questions?

Explore the CLI guides or reach out to our team for assistance.

RedCell is an AI security agent that runs in your terminal. It helps with authorized security testing by automating reconnaissance, CVE scanning, vulnerability verification, and evidence-backed reporting. You define the targets and rules of engagement, and RedCell applies scope guardrails during the workflow.

RedCell is for systems you own or have written permission to test. Define the authorized targets and rules of engagement before testing. Testing systems without permission may be illegal and violates RedCell’s Acceptable Use Policy.

RedCell runs on macOS (Apple Silicon), Linux, and Windows. Install it from a terminal on macOS or Linux, or use the PowerShell installer on Windows. The agent runs on your machine.

RedCell plans start at $20 per month: Starter $20, Pro $99 and Max $199 per month, or $16, $79 and $159 per month billed yearly. Creating an account is free, but CLI inference needs a paid plan. New accounts can try any monthly plan for 24 hours for $1.

AI penetration testing uses AI models or agents to assist with parts of an authorized security assessment, such as reconnaissance, scanning, vulnerability validation, and reporting. A human operator defines scope and reviews results.

AI can speed up repetitive work such as reconnaissance and CVE checks, but human testers still provide scope decisions, judgment, review, and accountability. RedCell is designed to support an operator, not remove that responsibility.

Metasploit and nuclei provide security testing frameworks and scanners. RedCell is a terminal-based AI agent that can plan and coordinate work across tools, preserve engagement context, and organize findings with evidence. RedCell can use nuclei templates in its workflow.

RedCell applies scope guardrails to help keep activity within the targets and rules of engagement you define. Its security policy blocks out-of-scope traffic, rate-limit violations, and prohibited high-impact actions.

RedCell can help automate passive OSINT, subdomain enumeration, port and service fingerprinting, template-based CVE scanning, scoped vulnerability verification, evidence collection, and Markdown or JSON report export.

Yes. RedCell can connect to custom MCP servers, Python scripts, and native security binaries. See the CLI documentation for setup details.

RedCell is a paid terminal product with model usage included in paid plan budgets, integrated scope guardrails, and structured usage and billing in one service. Check the pricing page and product documentation for current plan features.

RedCell runs on your machine, but model turns needed for reasoning are sent to its inference backend. RedCell says provider data retention is set to deny and that it does not store prompt or file content beyond lightweight session aggregates needed to run and resume work. Read the Security and Privacy pages for details.

Your next authorized assessment

Run your next authorized assessment from the terminal

Install RedCell, define your scope, and review verified findings with their evidence—all from your terminal.

RedCell community / 001

Better security work starts with a conversation.

Meet the people building with RedCell, trade field notes, and get a hand when you hit a wall.

Join the Discord