How stanleynull/autohunter works
AutoHunter is a continuously running, multi-agent vulnerability-research platform: users configure and start tasks, targets are collected and prioritized, workers investigate them with LLM-directed tools, AI review filters findings, and people make final review decisions. Approved findings can trigger broad validation against similar targets. The console exposes task, findings, intelligence, settings, and runtime views. The README documents the main agent workflow; the sampled source and SOURCE INDEX identify the orchestrator, persistence, tool, API, and frontend layers. Some UI-to-API wiring and unsampled subsystem details are therefore shown only as unverified links or omitted.
Main entry points: orchestrator.py Task orchestrator · App.vue Web console · reviewer.py AI reviewer · worker.py Target worker
Components 22
Research workflow
- Target collector
app/agents/collector.py - Discovery engines
app/engines - Target worker
app/agents/worker.py - AI reviewer
app/agents/reviewer.py - Ownership proof
app/agents/write_proof.py - Broad validation
app/agents/killsweep.py - Impact escalation
app/agents/escalate.py
Agent runtime
- Task orchestrator
app/orchestrator.py - Security tools
app/tools/executor.py - LLM client
app/llm/client.py
Platform services
- HTTP API
app/main.py - Task controls
app/api/tasks.py - Finding review API
app/api/findings.py - Runtime settings
app/settings_service.py - Persistent task state
app/db/models.py
Review console
- Web console
frontend/src/App.vue - Reviewed findings
frontend/src/views/VulnsView.vue - Task dashboard
frontend/src/views/BoardView.vue - Intelligence view
frontend/src/views/IntelView.vue
Other components
- Task operator
- LLM provider
- Human reviewer
Connections 26
- Task operator → Web console: configures tasks
- Web console → HTTP API: requests data
- HTTP API → Task controls: routes tasks
app/main.py - HTTP API → Finding review API: routes findings
app/main.py - Task controls → Task orchestrator: controls runs
app/api/tasks.py - Task controls → Persistent task state: reads task state
app/api/tasks.py - Task orchestrator → Target collector: schedules collection
app/orchestrator.py - Target collector → Discovery engines: searches targets
- Task orchestrator → Target worker: dispatches targets
app/orchestrator.py - Target worker → LLM client: requests decisions
app/agents/worker.py - Target worker → Security tools: executes tools
app/agents/worker.py - LLM client → LLM provider: calls provider
- Task orchestrator → AI reviewer: sends findings
app/orchestrator.py - AI reviewer → LLM client: requests assessment
app/agents/reviewer.py - AI reviewer → Ownership proof: checks ownership
app/agents/reviewer.py - AI reviewer → Finding review API: returns review
- Finding review API → Task orchestrator: requests deepen
app/api/findings.py - Human reviewer → Web console: reviews results
- Web console → Reviewed findings: shows findings
- Task orchestrator → Broad validation: starts broad validation
app/orchestrator.py - Broad validation → Target worker: validates targets
- Task orchestrator → Impact escalation: coordinates escalation
app/orchestrator.py - Task orchestrator → Persistent task state: persists workflow state
app/orchestrator.py - Task orchestrator → Runtime settings: loads configuration
app/settings_service.py - Web console → Task dashboard: shows task activity
- Web console → Intelligence view: shows intelligence