PHANTOM is an unconstrained, self-improving multi-agent framework equipped with 25 autonomous tools, real-time WebSockets, Scrapling anti-bot scrapers, 4-tier vector memory, and full LLM compatibility.
Everything needed for automated penetration testing, security audit, and deep web research in a single dashboard.
Specialized parallel sub-agents (Threat Modeling, Log Analysis, Compliance Review, Code Auditing) coordinated by an Orchestrator DAG planner.
No strict turn limits. PHANTOM recursively invokes tools, installs missing CLI packages, parses stdout/stderr, and resolves roadblocks autonomously.
Combines SQLite persistence, local `@xenova/transformers` embeddings, FTS5 lexical search, and Reciprocal Rank Fusion (RRF) for long-term recall.
Integrates Scrapling engine to bypass anti-bot challenges, solve Cloudflare turnstiles, and render JavaScript heavy web applications.
Encrypted one-time sudo password handling allowing seamless system-level diagnostic execution (`nmap`, `tcpdump`, `iptables`) safely.
Plug-and-play support for OpenAI, OpenRouter (100+ models like DeepSeek & Claude), Ollama (local free inference), and custom OpenAI APIs.
How components collaborate between the WebSocket UI, Multi-Agent Task Graph, Memory Engine, and Tool Execution Sandbox.
Explore the built-in capabilities available to the LLM agent during security operations.
Executes arbitrary terminal bash commands with auto-sudo password injection and non-blocking streaming execution.
Reads exact file content with line ranges and UTF-8 encoding support across the system workspace.
Creates or overwrites system files, scripts, reports, and code modules with automatic directory creation.
Inspects directory contents, file sizes, permissions, and structure recursively.
Auto-installs missing dependencies across package managers (`apt`, `pacman`, `pip`, `npm`, `cargo`, `go`).
Sends custom HTTP requests (GET, POST, PUT, DELETE) with custom headers, query params, and payload analysis.
Performs real-time web searches using DuckDuckGo to obtain fresh CVE details, exploits, and documentation.
Fetches HTML pages, strips clutter, and extracts clean structured text and links.
Advanced anti-bot scraper utilizing Scrapling to solve Cloudflare Turnstile, JavaScript rendering, and browser fingerprinting.
Executes Python scripts inline in isolated sub-processes for data analysis, payload generation, and math.
Stores critical findings, target IPs, credentials, or architectural patterns into 4-tier vector memory.
Performs hybrid Reciprocal Rank Fusion (RRF) search across long-term stored agent memories.
Retrieves memory store health, total record counts, vector index status, and top recalled entities.
Self-modification capability allowing PHANTOM to edit its own tools, agents, and server logic on the fly.
Logs execution steps and operational timelines for self-optimization and audit reporting.
Converts complex web pages and documentation into clean, structured Markdown format via Jina AI.
Searches YouTube video databases for security talk presentations, demos, and walkthroughs.
Extracts complete video transcripts and subtitles for fast LLM summarization.
Parses RSS and Atom security feeds to track zero-days, advisories, and threat intelligence updates.
Browses V2EX technology community threads and developer discussions.
Searches subreddits (`r/netsec`, `r/cybersecurity`) for recent vulnerability advisories and discussions.
Crawls public tech posts, company updates, and article content for OSINT research.
Detailed guides for running PHANTOM via 1-Line installer, manual npm clone, Docker, or CLI configuration.
Run the universal automated installer script directly in any terminal:
The installer automatically verifies Node.js 18+, clones/updates PHANTOM into ~/.phantom, installs native bindings (sharp, better-sqlite3), configures path symlinks, and sets up shell aliases.
If you want to contribute or modify the PHANTOM codebase:
PHANTOM supports any OpenAI-compatible LLM endpoint. Configure your keys in .env or via the Web UI Settings panel:
Deploy PHANTOM in an isolated, containerized environment with zero local setup:
Once built, open http://localhost:3000 in your web browser.
After running install.sh, use the phantom CLI command anywhere in your terminal: