sapper-v2
Autonomous pentest legion running AI commanders and worker swarms.
Orchestrate multi-agent swarms with layered fact-intent graphs for autonomous penetration testing.
sapper-v2 is an autonomous multi-agent penetration testing harness that won top honors in the Tencent Cloud Intelligent Attack-Defense Challenge. It orchestrates commanders, generals, and scouts using a shared fact-intent graph to tackle complex security targets. You should use this if you want to push multi-agent coordination beyond single-instance AI limits.
What it is
It coordinates multiple agent CLIs and models through a structured hierarchy, separating high-level strategy from parallel execution. A layered fact-intent graph preserves observations across session deaths so successors can resume operations seamlessly. Model tiering routes expensive tasks to elite reasoning models and bulk work to lighter, faster ones.
Who it's for
It suits security professionals and AI researchers building advanced multi-agent workflows for competitive or complex automation tasks. It does not suit casual users looking for a simple point-and-click vulnerability scanner or those without experience managing AI CLI environments.
Key features
AI Commander Legion
Separates strategic command from parallel worker execution across multiple tmux panes.
Layered Fact Graph
Stores observations in a title, summary, and evidence hierarchy to prevent context poisoning.
Economic Model Tiering
Pairs heavy reasoning models for commanders with light flash models for mass worker tasks.
Autonomous Emergence
Enables agents to invent operational roles like signalmen and performance reviews dynamically.
Up and running in 3 steps
Our honest verdict
What's great
- Achieved top performance in competitive challenges using significantly fewer tokens.
- Decoupled from specific models, allowing you to swap agent CLIs and backends freely.
- Maintains shared memory across agent sessions through the nvwabase fact-intent graph.
- Includes self-healing watchdog mechanisms to keep long-horizon operations alive.
Where it falls short
- Requires substantial technical skill to configure and run multi-agent terminal environments.
- Consumes significant token volume depending on your model choices and campaign length.
- Designed primarily for competitive capture-the-flag scenarios, requiring doctrine adaptation for other uses.
Pricing & license
Free under its MIT licence. The only cost is running your own infrastructure and the heavy API token usage required to fuel multi-agent swarms.
Open remote AI-training roles
879 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
Is sapper-v2 tied to a specific AI model?
No, you can swap out agent CLIs and models for every role using configuration flags or environment variables.
What is the Nüwa Test?
A conceptual framework testing if AI can develop division of labor and independent civilization dynamics from a survival axiom.
