Next-generation AI-powered
automated security audit agent
Give it an authorized target or code repository and it lists the steps, then runs them one by one in a terminal and browser, keeping every command and its output in the task. Run it on your own machine or in a cloud sandbox we host. Thanks to a new task architecture, the agent works fluently with 600+ tools.
Overview
The agent's built-in security tool catalog. Common tools come with a description, usage examples and a risk level, and the agent reads them before use.
Web & API, Network, Internal & identity, Web3, Fuzzing & reverse engineering, and Forensics & defense.
Ask for approval, Approve for me or Full access, set per task and switchable any time from the input box.
Tool catalog
These are widely used open-source and community tools. The cloud sandbox comes with some of them preinstalled; local mode uses the tools already installed on your machine.
686 tools in total.
- Arjun
- Bandit
- Cadaver
- Checkov
- cloud_enum
- Commix
- CRLFuzz
- Dalfox
- DAVTest
- DIRB
- dirsearch
- DotDotPwn
- Feroxbuster
- ffuf
- FinalRecon
- Flawfinder
- GetAllUrls
- GitTools
- Gobuster
- GoSpider
- GraphQL Cop
- GraphQLmap
- Hakrawler
- HTTPERF
- httprobe
- HTTrack
- InQL
- Interactsh
- JoomScan
- JWT Cracker
- jwt_tool
- Katana
- Kiterunner
- LinkFinder
- mitmproxy
- Monsoon
- Nikto
- Nuclei
- OWASP ZAP
- PadBuster
- ParamSpider
- Parsero
- ProjectDiscovery httpx
- Proxytunnel
- Retire.js
- Ruff
- S3Scanner
- Schemathesis
- Siege
- Skipfish
- SlowHTTPTest
- SQLmap
- sqlninja
- sslscan
- SSLsplit
- SSLstrip
- SSLyze
- testssl.sh
- theHarvester
- TInjA
How it works
Agent mode
- It writes a to-do list first, then works through it item by item, with progress visible in the task.
- It runs commands in a terminal and opens pages in a browser, and you see the tools' raw output.
- Commands, output, screenshots and notes stay in one task, so you can check each one while writing the report.
Chat mode
Runs no commands. Use it for questions and for analyzing code or logs you paste in. Switch to Agent from the input box when you need it to act.
Upload files
Drop in reports, screenshots, source, and data. Hackcat works from what you give it instead of guessing at your environment.
Skill library
When it meets a specific framework or platform, the agent loads the matching skill and follows its checklist.
Where it runs and what it may do
Local or cloud, per task. You define the environment and how much the agent may do on its own.
Where it runs
Cloud Agent sessions run terminal and browser actions in an isolated sandbox we host. Delete it whenever you like from Settings. What we process, and who processes it, is spelled out on the Security & Trust page.
Read Security & TrustHow much the agent may do
Always ask before commands and file changes.
Web, Desktop, and Mobile.
Start a task in the browser. Install Hackcat Desktop when you want to connect local tools. Pick up the same task on your phone from the mobile web app.
Web
Opens in a browser. Nothing to install.
Desktop
macOS, Windows and Linux, for connecting the tools on your machine.
Phone
Open it in your phone's browser to continue a task from your computer.
Before you start
Results need your confirmation
AI output and tool actions can be incomplete or wrong. Confirm evidence and impact before you report or act on it.
Only test targets you're authorized to test
Hackcat speeds up security work. It does not replace your judgment, your authorization, or your validation.
Local mode needs a connection first
Commands only run on your machine after you connect Hackcat Desktop or the Local Agent CLI.
Limits depend on your plan
Model access, included usage, files, context, and cloud-agent capacity depend on your plan and current availability.
Try it free first
Try free text chat without creating an account. Sign in to upload files or start an Agent task.
Verify the details yourself. Release checksums, guidance, and subprocessors are public.
Desktop ReleasesHelp CenterSubprocessors