Summary

Cairn is a sophisticated, general-purpose state-space search engine engineered to tackle complex problems defined by a known origin, a specific goal, and an inherently unknown path. Initially validated through rigorous autonomous penetration testing, it offers a powerful, unified framework for engineers, researchers, and power users. Its applicability extends beyond cybersecurity to domains like vulnerability research, mathematical proof generation, and Capture The Flag (CTF) challenges, providing an automated and adaptive approach to navigating vast and intricate problem spaces.

How It Works

The engine's core architecture is built upon a Blackboard system, featuring an explicit fact-intent graph that dynamically represents the search state. Key conceptual primitives include Facts (objective, confirmed findings), Intents (declared, unexecuted directions for exploration), and Hints (human judgment injected into the process). Agent Workers execute an OODA loop (Observe, Orient, Decide, Act), coordinating their actions exclusively through the shared board via Stigmergy, thereby eliminating information silos and enabling emergent behavior. Tasks are generated dynamically at runtime from the graph's current state, allowing workers to adapt and evolve without reliance on predefined roles or rigid workflows, fostering a highly flexible and emergent problem-solving capability.

Quick Start & Requirements

Cairn necessitates a macOS or Linux environment, Python version 3.12 or higher, and Docker. The recommended and most straightforward setup method utilizes Docker Compose. Initial steps involve pulling the required worker container and base images (ghcr.io/oritera/cairn-worker-container:latest and ghcr.io/astral-sh/uv:python3.13-trixie). Subsequently, users must edit the dispatch.yaml file to integrate their specific LLM endpoints and API keys. Executing docker compose up --build initiates both the server and the dispatcher services, with all persistent data automatically stored in the ./datas/cairn/ directory.

Highlighted Details

Cairn achieved remarkable success at the Tencent Cloud Hackathon AI Penetration Testing Challenge, notably securing "AK" (All Known) status by solving all 54 presented problems, a feat unmatched by other participants. Significantly, the entire system pipeline was brought online for the first time on the morning of the competition day. This accomplishment was realized without any prior system training, parameter tuning, domain-specific tooling, or reliance on predefined agent roles or external Retrieval-Augmented Generation (RAG) systems.

Maintenance & Community

The provided README does not contain specific details regarding notable contributors, ongoing sponsorships, or community engagement channels such as Discord or Slack, which may require further investigation for users seeking community support or project roadmaps.

Licensing & Compatibility

The project is distributed under the GNU AGPLv3 license, which is primarily intended for personal and educational use. For any commercial deployment or integration into proprietary environments, obtaining a separate commercial license directly from the author is a mandatory requirement. Contributions submitted to the project are understood to be usable under both the terms of the AGPLv3 and the project's commercial license.

Limitations & Caveats

A critical operational caveat is that Cairn is strictly intended for use within environments where explicit authorization to operate has been granted. Unauthorized security testing, exploitation, or data access activities are explicitly warned against, as they may carry significant legal repercussions and potential for harm. Furthermore, the copyleft nature of the AGPLv3 license imposes certain obligations on derivative works or software linked with Cairn, which could impact commercial or closed-source integrations.