Mapache

Active project

Mapache is an autonomous offensive-security agent built around a single ReAct reasoning loop that runs on either local models (via Ollama) or frontier cloud providers. Rather than a collection of one-off scripts, it maintains a phase-aware view of an engagement — recon, foothold, escalation, and beyond — and routes each decision by discipline instead of assuming everything is a web target.

Around that core sit composable loop middleware, an autonomous multi-agent supervisor that can fan work out to specialist operators, a toolchain of roughly fifty offensive tools, and fifteen built-in domain playbooks. Persistent and cross-engagement memory let it carry lessons from one target into the next, and the whole thing can be driven from the terminal or operated remotely over Telegram and Discord.

Every run is bounded by rules-of-engagement guardrails and a prompt-injection shield, with findings recorded evidence-first into an engagement log. Mapache reached its first public release, v0.7.0, in August 2026 under the Apache-2.0 license.

Capabilities

What it does

Full-spectrum coverage

One agent spanning web, network, cloud, Active Directory, binary, mobile, and social-engineering targets — routed by discipline, not biased toward any single one.

Phase-aware ReAct loop

A single reasoning loop with attack-state tracking and composable middleware, running on local (Ollama) or cloud models.

Multi-agent supervisor

An autonomous orchestrator that fans work out to specialist operators and reconciles their findings.

~50-tool toolchain

Roughly fifty offensive tools plus fifteen domain playbooks, a live headless browser, and a compile-run-fix code loop.

Persistent memory

Per-engagement and cross-engagement memory so lessons learned on one target inform the next.

Guardrails & RoE

Rules-of-engagement enforcement, a prompt-injection shield, and evidence-first finding logs on every run.

Mapache docs →