VigilOSS - An agent harness for long-running pentests and code audits
VigilOSS - https://github.com/VigilOSS/Vigil
I built this tool because I was interested in Bug Bounties, wanted to learn how far AI could go at finding bugs, and was very interested in whether it could remove the mundane parts I remember from preparing for my OSCP.
Over time it went from a pile of prompts to a structured harness for long-running engagements. It's the result of hundreds of hours of running it on real targets, watching where it went wrong, and refining.
An operator agent coordinates specialist agents, and most every tool runs through one shared Kali container. Scope, attack surface, coverage, commands, credentials, evidence and findings live in a backend that survives restarts and compaction, so the agent doesn't redo work or forget why it ruled something out. It works with Claude Code and Codex. One engagement can mix source review and live web testing, and a bug found in code and then confirmed live stays as one finding.
I've used it on authorized HackerOne programs for findings that paid out more than $12,000 (Scanning large amounts of source maps, finding potential bugs, and having the web engagement test and verify). It has been most useful on large codebases, where tracking what has and hasn't been reviewed is harder than finding any single bug.