RedAmon vs RedFang

RedAmon is a free, open-source framework for authorized red-team operations, including reconnaissance, exploitation and post-exploitation. It maps attack surfaces from domains, IP/CIDR targets or batches of domains, then merges findings into a Neo4j graph that its AI agent can query for planning and exploitation. GVM/OpenVAS provides network vulnerability scanning with more than 170,000 NVTs; separate tools detect secrets and scan for vulnerable or malicious packages against a local OSV database. The Secret Multiscanner has 1,060 detectors across 14 sources and optional live API verification. RedAmon supports twelve AI providers and more than 400 language models, and its MCP server lets external agents drive the framework. The Dockerized application runs on Linux, macOS and Windows and supports on-prem deployment. Tools, scanners and agents run in separate containers with per-job ephemeral filesystems and network namespaces. Rules of Engagement, approval gates and scope controls govern operations, with a guardrail blocking government, military and intergovernmental targets. The project warns that configured API keys and credentials are stored unencrypted in PostgreSQL, leaving database security to the user.

RedFang is a cloud AI red-team scanner aimed at indie builders. It scans AI agents, GitHub repositories and application URLs, including listed customer-service chatbot targets. Before scanning, it requires a TXT-record or file-upload challenge to verify target ownership. RedFang says scans take five minutes and return grades from A+ to F. Seven v1 categories cover direct prompt injection, tool misuse, sensitive data leakage, output-as-attack-vector, agent overreach, denial-of-wallet and system-prompt extraction. Repository scans look for exposed keys, broken authentication and AI-introduced bugs. The stated methodology follows the OWASP LLM Top 10 threat model and tests 12 known direct prompt-injection patterns per scan. Reports can include plain-language findings, the successful prompt, a curl reproduction command, fix code and a retest. PDF and HTML exports are listed. Free preview costs nothing; Full report costs $19 a month. A shareable badge shows the latest grade, with weekly, daily or continuous scan cadence by tier.