Darkmoon orchestrates an end-to-end offensive campaign — it reasons about the target, dispatches domain specialists, validates findings with real payloads, builds an infrastructure graph and produces a structured report. A scanner runs one-pass signatures. Darkmoon runs a pentest.

By design. The model plans and reasons, but every tool invocation passes through an MCP gateway that validates and gatekeeps the call. The model never executes a shell directly — which keeps the engagement auditable, bounded and safe. The whole architecture is open source.

Yes. The engine is published on GitHub at ASCIT31/Dark-Moon under the GPLv3 licence. You can read the orchestration logic, the agent playbooks and the MCP layer, and self-host it. The commercial licence adds the hardened runtime, the managed dashboard and support.

ISO 27001 standard, HackerOne, Bugcrowd (VRT / P1–P5) and a custom format. Every report includes CVSS 3.1 scoring, MITRE ATT&CK mapping, ISO 27001 controls, raw evidence and remediation guidance. PDF export is branded and password-protected.

Darkmoon uses hardware-bound licensing. Your licence key is tied to a machine fingerprint derived from your hardware (MAC address, CPU model) — it cannot be cloned or moved to another machine by changing an environment variable.

Darkmoon includes configurable noise levels (stealth, low, moderate), safe-harbor mode, out-of-scope enforcement and per-agent scope propagation. The runtime is hardened with a read-only filesystem, seccomp, no-new-privileges and continuous watchdog checks.