A cybersecurity agent for autonomous vulnerability discovery. Uses deliberate context management, human-like workflow phases, and sandboxed tool execution.
git clone https://github.com/nwang783/tempo-sec.git
cd tempo-sec
# Create virtual environment
python -m venv .venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
# Install dependencies
pip install -e .# Copy example config
cp config.example.toml config.toml
# Edit with your API keys
# Required: ANTHROPIC_API_KEY or OPENAI_API_KEY or GEMINI_API_KEY in .env
cp .env.example .envRecommended: Use the Orchestrator (fully autonomous)
# Run the Orchestrator Agent - coordinates recon and testing automatically
tempo --agent orchestrator --target https://mysouschef.com
# With custom findings path and max iterations
tempo --agent orchestrator --target https://example.com \
--findings ./findings/example.yaml \
--max-iterations 15| Document | Description |
|---|---|
| MISSION.md | Vision, guiding principles, philosophy |
| AGENTS.md | AI coding assistant guidance |
| docs/ARCHITECTURE.md | Component architecture, structure |
| docs/WORKFLOW.md | Phase workflow, branching |
| docs/TOOLS.md | Tool specifications |
| diagrams/ | Architecture diagrams |
tempo-sec/
├── tempo/
│ ├── agent/ # Agent orchestration, workflow
│ ├── context/ # State management, persistence
│ ├── prompts/ # LLM instruction templates
│ ├── tools/ # Shell, browser, meta tools
│ ├── visualization/ # Real-time UI server
│ └── infra/ # LLM client, container, protocols
├── docs/ # Detailed documentation
├── diagrams/ # Architecture diagrams
├── tests/ # Test suite
└── config.toml # Configuration
python -m pytest tests/ -vNote to Ryan: This is my attempt to separate the main concerns of building an agentic systen. We can change this if you have a better idea.
CRITICAL: Context, Prompts, and Tools MUST NOT import from each other.
They may only import frominfra/or external packages.
Only Agent composes them together.
See AGENTS.md for complete development guidelines.
Note to Ryan: This is in here in case we do open source.
Contributions welcome! Please:
- Fork the repository
- Create a feature branch
- Run tests before submitting PR
- Follow the architecture rules above
Apache 2.0 - See LICENSE for details.