quareth/drowai

DrowAI is a work-in-progress platform for running AI agents that perform security testing tasks in isolated environments. Each task gets its own Docker or Kali Linux runtime, so an agent's actions stay contained and separate from other work. The project is public but still pre-v1: setup, deployment packaging, APIs, and documentation are expected to keep changing while the architecture settles. The system is built around three parts. A backend control plane, written with FastAPI, handles login, tenants, tasks, chat, settings, reporting, and real-time updates over WebSocket and server-sent events. A React and TypeScript frontend lets a person operate tasks, watch live streams, review artifacts and terminals, and read reports. An agent runtime, built on LangGraph, plans and runs the actual work, choosing from a registry of tools. Not every implemented tool is shown to the AI model, only tools that meet a certain quality bar for parsing, result formatting, and evidence tracking are exposed for the model to pick from on its own. Task execution happens through a runtime provider layer that can use either a local Docker setup or a separate managed runner process, which itself starts per-task Kali Linux containers through the host's Docker socket. The Kali runtime images used for these tasks are published on Docker Hub, and their build files are included in the repository. The project was built almost entirely through AI-assisted coding, led by a cybersecurity engineer with a decade of professional experience but no formal background in software development. The author has written publicly about the experience of building a large application this way. To run it locally, you need Python 3.11 or newer, Node.js 20.19 or newer, PostgreSQL 15 or newer with the pgvector extension, and Docker. A setup script installs dependencies, checks for the right database and extension, and offers to create them if missing. Once running, the frontend is available on localhost, and the backend exposes an API with documentation. This is meant for developers and researchers exploring red team automation, not for people without technical setup experience.