How chu0119/pojun works
Pojun is an AI-driven penetration-testing platform: a user supplies a target and goals, then an event-driven multi-agent workflow explores, executes tools, records evidence and findings, and produces a report. Its web console also exposes task oversight, approvals, traffic, vulnerability intelligence, and platform configuration. The graph combines sampled Go call/import references with README-described capabilities; unsampled subsystems are included only where the README establishes their role, and their links are documented rather than inferred from names.
Main entry points: server.go HTTP API · worker.go Intent worker · page.tsx Web console · manager.go Task manager
Components 21
User interface
- Web console
web/src/app/(main)/function/tasks/detail/page.tsx - HTTP API
server/server.go
Task execution
- Task manager
server/manager.go - Exploration engine
server/engine.go - Intent worker
agent/worker.go - Intent planner
agent/planner.go - Agent tools
agent/tools.go - Approval gates
intercept/intercept.go
Evidence and findings
- PostgreSQL store
db/db.go - Traffic capture
traffic/traffic.go - Evidence store
evidence/store.go - Finding workflow
db/findings.go - Report export
report/report.go
Platform services
- Vulnerability intelligence
vulnintel/intel.go - LLM pool
llmpool/pool.go - Callback listener
listener/listener.go - Notifications
notify/notify.go
Operations
- Host installer
hostd/server.go
Other components
- Operator
- Authorized target
- LLM provider
Connections 24
- Operator → Web console: sets target
- Web console → HTTP API: calls API
- HTTP API → Task manager: handles tasks
server/server.go - Task manager → Exploration engine: runs tasks
- Exploration engine → Intent planner: requests plans
- Exploration engine → Intent worker: dispatches intents
- Intent planner → PostgreSQL store: reads task state
- Intent worker → Agent tools: executes tools
agent/worker.go - Intent worker → Approval gates: gates tool calls
agent/worker.go - Intent worker → LLM provider: requests completions
- Task manager → LLM pool: configures pool
- Intent worker → PostgreSQL store: writes task results
- Intent worker → Traffic capture: routes HTTP traffic
- Traffic capture → Evidence store: supplies traffic evidence
evidence/store.go - Intent worker → Finding workflow: reports findings
- Finding workflow → PostgreSQL store: persists findings
- HTTP API → Report export: exports reports
- HTTP API → Vulnerability intelligence: serves intelligence
- HTTP API → Callback listener: exposes callbacks
- HTTP API → Notifications: configures delivery
- HTTP API → Host installer: requests installs
- Agent tools → Authorized target: tests target
- Web console → Finding workflow: reviews findings
- Web console → Traffic capture: reviews traffic