Sapper

What it is

Sapper (repo name sapper-v2) is a multi-agent orchestration harness for penetration testing competitions and authorized labs. An AI commander reads the board, decides, and dispatches work; worker agents (generals, scouts, and soldiers) run in parallel, typically with Kali tooling in the Docker image. It does not bind to one model or CLI: you swap the agent and model behind each role. It is open source under MIT.

What it helps with

- Orchestrating several AI agents as a coordinated pentest force rather than running a single agent
- Running CTF-style and lab assessments where a commander schedules work and workers attack in parallel
- Keeping shared memory in a layered fact-intent graph so later agents can pick up after earlier ones
- Deploying a full legion with a pre-built Docker image that bundles a Kali toolchain, or installing a lightweight Python CLI with install.sh

Who it's for

CTF teams, red teamers, and researchers who want multi-agent orchestration for penetration testing on systems they own or have written permission to test. Authorized use only.

Worth knowing

Use Sapper only for authorized security testing and educational research. The authors require written permission for any target you do not own. The full Docker path expects model gateway credentials (for example Anthropic-compatible API base URL and token, or a SAPPER_KEY_POOL of providers). The repo is very new (created late October 2026) and is maintained by a single GitHub user.

Do I need a specific LLM vendor?
No. The README says you can swap the agent CLI and model per role (examples include Claude Code, Codex, DeepSeek, and GLM), and docker/ENV.md shows Anthropic-compatible env vars plus an optional multi-provider key pool.

Does it require Docker and Kali?
The lightweight CLI installs with bash install.sh and Python 3 only. The full legion uses Docker; the v18-champion release ships a pre-built image described as including a full Kali toolchain.

How does it compare with Shannon, Strix, and XBOW?
In our view those are AI pentest products aimed at web apps and APIs, while Sapper is an open orchestration harness built for CTF-style multi-agent campaigns with a commander and worker swarm.