Disclosure: I work on Darkmoon. NodeZero is a genuinely good autonomous pentest platform. This is for the teams that cannot use it because the targets cannot leave their environment.
Why SaaS is a blocker for some
Regulated, air gapped or data sensitive environments often cannot send targets or results to a vendor cloud. That rules out most hosted platforms regardless of quality.
What self hosted changes
A self hosted engine keeps scope, data and evidence inside your environment. You run it on your own model and infrastructure.
What you get with an open source MCP host
Darkmoon is GPL-3.0, model agnostic, and orchestrates 80 plus offensive tools via MCP across web, cloud, AD and Kubernetes, keeping a proof trail per finding.
Being fair
You give up the polish and support of a funded SaaS. You gain control, privacy and the ability to read and change the method.
Try it
If data residency is the constraint, a self hosted open source engine is worth a lab run.
- Repo (GPLv3): https://github.com/ASCIT31/Dark-Moon
- Docs: https://docs.dark-moon.org/
- Demo: https://youtu.be/1bFRVuMkZzY
Built by pentesters, open sourced for pentesters. Feedback on the methodology and the evidence trail is genuinely welcome.
Top comments (0)