---
name: cai-security-tooling
description: CAI (Cybersecurity AI) pentest framework + OWASP Juice Shop installed on the VPS for security testing
metadata: 
  node_type: memory
  type: project
  originSessionId: 09013e0f-2e94-4156-8686-e27053e7e466
---

Ahmed had CAI (Cybersecurity AI, Alias Robotics, v1.1.5) installed on the VPS at
`/root/tools/cai` — an agentic offensive/defensive security framework (red/blue/purple
teamer, web_pentester, bug_bounter, dfir, reverse_engineering, etc.). He refers to it
verbally as "cyber streak ai." State/logs live in `/root/.cai/`. Config in
`/root/tools/cai/.env` (has its own OPENAI/ANTHROPIC keys, CAI_MODEL, license-off).
OWASP Juice Shop is at `/root/tools/juice-shop` as the legal practice target.

As of 2026-07-03 nothing had been run via CAI itself (usage.json = 0 sessions) — install/exploration stage.

**Pentest toolkit installed 2026-07-04** (Ahmed wants to build offensive-security AI):
apt → nmap, masscan, nikto, gobuster, ffuf, sqlmap, hydra, john, tshark, whois, dnsutils,
python3-scapy, python3-impacket. go install → /usr/local/bin/{nuclei,httpx,subfinder,amass}
(nuclei build pulled Go 1.25 toolchain + huge dep tree, ~15min). Wordlists: SecLists (2.5G)
at /root/tools/SecLists. All smoke-tested working against a throwaway local target. Juice Shop
does NOT run yet — needs its Angular frontend built (`npm run build:frontend`, heavy); deferred
so it wouldn't starve the live Maps scraper. Do that build when the scraper is idle.

**Why:** Separate from the Ultron lead-gen pipeline; not in /root/ultron/CLAUDE.md.
**How to apply:** Only aim these tools at our own assets or Juice Shop / written-permission
targets. He may ask about OSINT ("ONSIT") recon — CAI's recon agents cover much of that.
Relates to [[ahmed-agentic-vision]].