Low Severity
Published: Nov 7, 2026
Swarmageddon — consent-first, non-destructive, allowlist-gated AI web-vulnerability scanning swarm with a live dashboard. Team ALANI · AITX & MLOps World Community Hackathon.
# VulnSwarm — Swarmageddon
A consent-first, non-destructive, allowlist-gated multi-agent web-vulnerability scanner. A swarm of specialist agents maps a target you own, probes it in parallel, re-verifies every finding against a fresh observation, and streams a ranked report to a live dashboard.
**It detects. It does not exploit.** Probes are small, deterministic markers (a reflected token, a single quote, `;id`, a traversal to `/etc/passwd`) used only to confirm that a weakness exists. The planner refuses to inject into destructive or sensitive fields (password, token, CSRF, delete/update/create/logout controls), and skips a whole form when it carries a destructive control (reset, clear, drop, delete, …), because probing any field also submits the form's other buttons.
## Tech stack
- **Backend:** Python 3, FastAPI + Uvicorn, Pydantic.
- **HTTP probing:** Python standard-library `urllib` only (no third-party scraper); every request is paced and allowlist-checked.
- **Concurrency:** `ThreadPoolExecutor` runs the specialist swarm in parallel over one shared `ScanContext`.
- **Streaming:** Server-Sent Events push every phase, agent and finding to the dashboard live.
- **Frontend:** a single-file vanilla HTML/CSS/JS dashboard — no build step.
- **Optional triage:** `openai` SDK pointed at a Featherless hosted model (off unless `FEATHERLESS_API_KEY` is set).
- **Storage:** an append-only JSONL audit log. No database.
- **Tests:** `pytest` (75 test functions).
## Architecture
```mermaid
flowchart LR
UI["Live dashboard (SSE)"] -->|POST /scan/stream| API["FastAPI backend"]
API --> ORCH["Orchestrator — 6 barrier phases"]
ORCH --> AUTH["AUTH"] --> MAP["MAP: recon · crawl · fingerprint"] --> PLAN["PLAN"]
PLAN --> SWARM
subgraph SWARM["SWARM — parallel specialists (thread pool)"]
CH["config_headers"]
EP["exposed_paths"]
INJ["injection"]
CVE["CVE registry: misconfig · recon · auth · secrets"]
end
SWARM --> VERIFY["VERIFY: re-check each finding"